Corelight Open NDR
Corelight Open NDR: A network-focused NDR platform combining telemetry, detection, packet capture, and response integrations. Ranked #8 of 21 in Anomaly Detection Software by our editors (7.9/10); pricing: Pricing on request; best for security teams detecting network anomalies.
At a glance
- Editor score7.9 / 10
- PricingPricing on request
- Best forSecurity teams detecting network anomalies
- Real-time detectionYes
- Founded2016 · San Francisco, California, USA
- Facts checked22 Sep 2026
Where it wins
- Combines Zeek, Suricata, YARA, packet capture, and ML detection
- Explains detections and supports AI-assisted triage
- Integrates with Splunk, CrowdStrike, Microsoft, Elastic, and AWS
Where it doesn't
- Its scope is specialized to network security
- Hybrid deployment spans multiple sensor and SaaS components
- Pricing requires a sales conversation
Our verdict on Corelight Open NDR
Corelight Open NDR is a network detection and response platform for security operations teams, enterprises, and government agencies. It converts network and cloud traffic into structured evidence for threat detection, investigation, threat hunting, and incident response. The platform supports web, Linux, API, and self-hosted environments, with deployment options that include physical appliances, virtual and software sensors, cloud sensors, and SaaS components. It is designed for teams that need real-time visibility into network traffic, packet data, flow logs, cloud network traffic, protocol logs, and files.
Its main strength is the depth of its network analysis stack. Zeek provides network security monitoring, Suricata adds intrusion detection, and YARA supports static file analysis. Machine-learning and behavioral methods work alongside real-time packet parsing and telemetry, while Smart PCAP provides packet capture for investigation. AI-powered detection explainability and triage help security teams understand alerts and prioritize response. Centralized sensor management through Fleet Manager adds an operational layer for distributed deployments.
Corelight Open NDR also fits environments that already rely on established security operations platforms. Integrations include Splunk, CrowdStrike, Microsoft, Elastic, and AWS, alongside SIEM, XDR, SOAR, and cloud integrations. Pricing follows a contact-sales model, so purchase planning centers on a vendor conversation rather than published plan comparisons. Choose it when network telemetry, explainable anomaly detection, and packet-level investigation are central requirements. Teams seeking a broader, less network-specialized anomaly detection product may find its focus narrower than their needs.
Your product? Our editors can test Corelight Open NDR in depth and publish a review, labelled as paid · from $149/mo →
Corelight Open NDR pricing
Corelight Open NDR fact sheet
| Free plan | Not verified |
|---|---|
| Paid from | Not verified |
| Detection method | Hybrid |
| Real-time detection | Yes |
| Supported data | network traffic, packet data, flow logs, cloud network traffic, protocol logs, files |
| Deployment options | Hybrid |
| Anomaly explanations | Yes |
| Data retention | Not verified |
| Deployment | Cloud, Self-hosted |
| Platforms | Web, Linux |
| Support | Email, Phone, Tickets, Docs |
| Built for | Mid-market, Enterprise (editorial estimate) |
| Integrations | 5 integrations: Splunk, CrowdStrike, Microsoft, Elastic, AWS |
| Pricing | Pricing on request |
| Website | corelight.com |
| Facts checked | 22 Sep 2026 |
Corelight Open NDR integrations
Corelight Open NDR lists 5 integrations on its own site.
- Splunk
- CrowdStrike
- Microsoft
- Elastic
- AWS
Alternatives to Corelight Open NDR
- Progress FlowmonA network-focused platform for traffic visibility, anomaly detection and capacity planning.9.0
- ManageEngine NetFlow AnalyzerAffordable on-premises flow monitoring with alerts, reporting, and security analytics.8.6
- AnodotBroad real-time anomaly detection with forecasting, correlation, and root-cause analysis.8.4
See all Corelight Open NDR alternatives →
Corelight Open NDR vs the competition
- Corelight Open NDR vs Progress Flowmon
- Corelight Open NDR vs ManageEngine NetFlow Analyzer
- Corelight Open NDR vs Anodot
- Corelight Open NDR vs Securonix UEBA
- Corelight Open NDR vs ExtraHop RevealX
- Corelight Open NDR vs Anomalo
Compare Corelight Open NDR with any tool side by side →
Also Ranked In
Corelight Open NDR is ranked in 2 of our directories.
Used Corelight Open NDR? Be the first to review it
The editor score above is our own research. What this page doesn't have yet is a reader's view — what you used Corelight Open NDR for, what worked and what didn't. No stars are seeded and no review is paid for; an editor reads every one before it appears.
Write a reviewTwo minutes · verified accounts only · read by an editor before it appears
Featured on iTechGuides
Corelight Open NDR is listed in our Anomaly Detection Software directory. Add the badge to your site — it links back to this page.
<a href="https://www.itechguides.com/products/corelight-open-ndr/"><img src="https://www.itechguides.com/best/badge/corelight-open-ndr.svg" alt="Featured on iTechGuides" width="230" height="46"></a>
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update