Corelight
UnknownOpen NDR for network visibility, threat detection, investigation, and threat hunting.
工具信息
什么是 Corelight？
Corelight is an Open Network Detection and Response (NDR) platform that combines network evidence, analytics, detections, sensors, and investigation tools. It supports network monitoring, intrusion detection, threat intelligence, forensics, asset visibility, and threat hunting workflows.
核心功能
Open NDR Platform
Combines network visibility, analytics, detections, and investigation capabilities in an Open NDR platform.
Network Monitoring and Intrusion Detection
Supports network monitoring with Zeek and intrusion detection with Suricata.
Investigation and Forensics
Provides Investigator for triage, Smart PCAP for forensics, and YARA for static file analysis.
Threat Intelligence and Detection Collections
Includes threat intelligence capabilities and detection collections for C2, core detections, encrypted traffic, entities, and ICS/OT.
AI-Powered SOC
Includes an AI-powered SOC capability for security operations workflows.
Sensor and Asset Management
Provides performance and asset visibility, plus Fleet Manager for managing sensors in one place.
使用场景
- #1
Network Detection and Response
Supports network-based detection, investigation, and response workflows.
- #2
Threat Hunting
Provides network evidence and investigation capabilities for threat hunting.
- #3
Cloud Security
Supports cloud security use cases.
- #4
Encrypted Traffic Analysis
Supports encrypted traffic analysis and detection use cases.
- #5
Ransomware Defense
Supports ransomware-focused security use cases.
定价方案
Pricing is not clearly published by the official source.
