
Corelight Open NDR
5.5#15 in threat hunting softwareWebAPILinuxSelf-hosted
Visit
| Fact | Corelight Open NDR | Microsoft Defender for Business |
|---|---|---|
| APIs | Logs API and an MCP server provide programmatic access for custom orchestration and management. | The product comparison lists APIs as included with Defender for Business. |
| Headquarters | San Francisco, California, USA | Redmond, Washington, United States |
| Integrations | The platform has native integrations with SIEM, XDR, SOAR, and cloud platforms including Splunk, CrowdStrike, Microsoft, Elastic, and AWS. | The product integrates with Microsoft 365 Lighthouse and can work with remote monitoring and management tools and professional services automation software. |
| Purpose | Corelight Open NDR transforms raw network and cloud traffic into context-enriched, high-fidelity evidence for security operations. | Microsoft Defender for Business is an endpoint security solution for small and medium-sized businesses with up to 300 users that helps protect devices from ransomware, malware, phishing, and other threats. |
| Support | Standard and Enterprise support plans include telephone and email support, software updates, security bulletins, an online support portal, and hardware replacement; Enterprise adds 24x7 availability and a one-hour P1 response SLA. | Microsoft's Defender for Business documentation provides a guide for getting help or contacting support. |
Corelight Open NDR is aimed at security operations teams in large enterprises and government agencies. Its deployment options cover on-premises, air-gapped, hybrid and multicloud environments.
You want what its maker publishes above — check its page for the details.