Corelight

Corelight is a network detection and response platform that turns network traffic into structured evidence for security teams. It is described as an open NDR platform, and the vendor positions it as the data foundation for what it calls a defensible AI SOC, where machine learning detections and agentic triage run on top of auditable network records. The platform covers network visibility, threat detection and incident response. Its detection engine combines threat intelligence, machine learning, behavioral analytics and expert tuned signatures to produce risk prioritized alerts with context and AI generated, evidence backed summaries. Agentic Triage consolidates alerts, correlates evidence and runs expert authored playbooks so analysts can reach decisions faster, and the vendor describes on premises AI agents and automated verdict exports to SIEM tools. Corelight also publishes industry pages, including one for the energy sector, and blog material on detecting AI related activity and shadow AI governance. It is aimed at security operations and threat hunting teams in enterprises that already run SIEM and SOC tooling and want richer network data feeding it. Visitors can request a demo or call the sales line. The vendor does not publish prices. Visitors are directed to request a demo.