Overview

Corelight delivers the most powerful network visibility solutions for information security professionals, helping them understand network traffic and defend their organizations more effectively. Corelight solutions are built on the Zeek framework (formerly known as “Bro”), the powerful and widely-used open source network analysis framework that generates actionable, real-time data for thousands of security teams worldwide. Zeek data has become the ‘gold standard’ for incident response, threat hunting, and forensics in large enterprises and government agencies worldwide. Corelight makes a family of network sensors — both physical and virtual, at every scale — that take the pain out of deploying open-source Zeek by adding integrations and capabilities large organizations need.
Corelight Sensors extract more than 400 data elements from network traffic in real-time, using a format that was chosen by incident responders, for incident responders. The Corelight Sensor is zero-maintenance and fine-tuned for enterprise performance at scale. Corelight extends Zeek’s powerful functionality with new capabilities and a suite of enterprise features such as higher throughput (up to 25 Gbps), an elegant web GUI, log filtering and forking, sensor health monitoring, and streaming data export to Splunk, Elastic, Kafka, Syslog, S3, and more.