Corelight Open NDR

What Corelight Open NDR is

Corelight Open NDR converts network and cloud traffic into context-rich evidence for security operations. Its detection approach combines machine learning, behavioral analytics, curated signatures and threat intelligence, with real-time detection across network traffic, packet data, flow logs, cloud traffic, protocol logs and files. The platform combines network security monitoring, intrusion detection, static file analysis and intelligent packet capture. Explainability, automated triage and response workflows help security teams investigate and contain threats. Deployment options include physical, software, virtual, cloud and flow-log sensors for on-premises, air-gapped, hybrid and multicloud environments. Cloud-native sensors support AWS, Azure and Google Cloud, and software sensors support Linux-based systems. Native integrations connect with SIEM, XDR, SOAR and cloud platforms such as Splunk, CrowdStrike, Microsoft, Elastic and AWS; a Logs API and MCP server enable programmatic access. Corelight serves large enterprises and government agencies. Pricing is on request with capacity-based licensing.