Corelight
Network detection and response platform built on open-source Zeek and Suricata.
Updated · AppBreakup editorial · Web, Self-hosted
Is Corelight free?
No, it's a paid product
2 alternatives with a free optionSwitch from Corelight to
All 5
DarktracePaid
Vectra AIPaid
ExtraHop RevealXPaid
- Verified facts
- 4 of 4
- Alternatives ranked
- 5
- Approved reviews
- 0
- Visits sent from here
- 0
About Corelight
Corelight sells a network detection and response (NDR) platform from the team behind the open-source Zeek network monitor. Its sensors turn raw traffic into detailed Zeek logs, then add Suricata intrusion alerts, YARA file analysis, smart packet capture, machine-learning detections and AI-assisted triage on top. Because the evidence is built on open formats, many teams stream it straight into Splunk, Microsoft Sentinel, Elastic, CrowdStrike or another SIEM rather than living in Corelight's own console. Sensors come as physical appliances for on-prem and air-gapped networks and as cloud sensors for AWS, Azure and GCP, with SaaS or self-managed deployment. It is aimed at enterprise and government security teams and threat hunters, and pricing is by quote. Teams on a budget can run the open-source pieces themselves through Zeek or Security Onion.
Best for: Security teams that want rich, open network evidence feeding their existing SIEM.
Pros and cons
What works
- Built on open Zeek and Suricata formats, so data is not locked in
- Deep integrations with Splunk, Microsoft, CrowdStrike and Elastic
- Runs on-prem, air-gapped, in the cloud or hybrid
- Combines NSM logs, IDS alerts, file analysis and packet capture
Why people leave
- Quote-only pricing aimed at enterprises
- Gets most value when paired with a separate SIEM
- Needs staff comfortable with network data to use fully
Corelight vs Darktrace, Vectra AI and ExtraHop RevealX
From each app's listing and the prices verified on its own site. A dash means we haven't verified it yet.
| Attribute | Corelight | Darktrace | Vectra AI | ExtraHop RevealX |
|---|---|---|---|---|
| Pricing | Paid | Paid | Paid | Paid |
| Verified price | — | — | — | — |
| Free plan | No | No | No | No |
| Open source | No | No | No | No |
| Self-hostable | No | No | No | Yes |
| Platforms | Web, Self-hosted | Web | Web | Web, Self-hosted |
Top Corelight alternatives
See all 5- 1Darktrace68.8
Self-learning behavioural detection with autonomous response, less focus on raw logs.
- 2Vectra AI64.8
NDR with strong identity and Microsoft 365 attack coverage and AI prioritisation.
- 3ExtraHop RevealX61.8
Packet-level NDR with decryption and forensics, also available self-hosted.
- 4
Security Onion51.2Free open-source stack with Zeek and Suricata if you can run it yourselves.
- 5
Suricata50.0Open-source IDS engine for teams that only need signature-based network alerts.
Why people left Corelight
In reviewers' own words, from reviews of the apps they moved to. These are their opinions, not ours.
No switching stories yet. If you moved away from Corelight, review the app you switched to and tell us why.
Reviews
No approved reviews yet. How we verify reviewers
Write a review of Corelight
Corelight: common questions
What is Corelight?
Corelight: Network detection and response platform built on open-source Zeek and Suricata. Best for security teams that want rich, open network evidence feeding their existing SIEM. Available for Web, and you can host it yourself.
Is Corelight free?
No, Corelight is a paid product.
Is Corelight open source?
No, Corelight is not open source.
What platforms does Corelight run on?
Corelight is available for Web and Self-hosted.
What are the best alternatives to Corelight?
The highest-ranked Corelight alternatives right now are Darktrace, Vectra AI and ExtraHop RevealX. See the full ranked list for pricing, platforms and verified facts.
Corelight vs Darktrace: what's the difference?
Both Corelight and Darktrace are paid products. Both run on Web.