Corelight

Corelight is a network detection and response platform built on Zeek that records network evidence and layers machine-learning detections and AI-assisted investigation on top. Security operations teams in government, finance, healthcare and energy use it for threat hunting and incident response.

Sensors passively monitor traffic on-premises, in the cloud or in hybrid setups, producing Zeek logs, intrusion detection alerts, file analysis and smart packet capture. Fleet Manager handles sensors and ML detection rollout across large networks.

Investigator adds AI-powered workflows and Agentic Triage, which works through alerts and shows the evidence behind each conclusion. Corelight integrates with a wide partner ecosystem of security tools and can enrich data from AWS, GCP and Azure.