# Corelight, Inc.
*Also known as Corelight*

- Website: https://corelight.com
- Location: San Francisco, CA, United States
- Agent profile: https://directory.haycion.ai/agents/corelight-com

> Corelight delivers evidence-based network security to improve visibility and incident response for enterprises and government organizations.

Corelight is a cybersecurity company that emphasizes evidence-based security by delivering network visibility and detection capabilities to protect organizations from cyber threats. It supports a wide range of industries and government customers, providing scalable, data-driven analytics to accelerate investigations, strengthen threat detection, and improve incident response across cloud and on-premises environments. Corelight focuses on enabling security teams with reliable, actionable network evidence and a strong emphasis on customer success and support.

**Mission:** We put evidence at the heart of security.

## Products & Services

### [Open NDR Platform](https://corelight.com/products/open-ndr)
*Platform*
Enhance detection coverage and response speed with unified visibility across environments.

- **Network visibility** — Gain Complete Visibility
- **Intrusion detection with Suricata** — Detect Intrusions
- **Network monitoring with Zeek** — Achieve High-Fidelity Evidence
- **Cloud Visibility Features** — Enhance Cloud Security
- **AI-Driven SOC Operations** — Leverage AI for Efficiency
- **Forensics with Smart PCAP** — Analyze Past Incidents
- **MITRE ATT&CK coverage** — Contextualize Threats
- **Static file analysis with YARA** — Identify Malware Patterns
- **Threat intelligence** — Enrich Detections
- **Investigation and triage** — Accelerate Response Times

### [AI-powered SOC](https://corelight.com/products/ai-powered-soc)
*Platform*
Enhances threat detection and response through AI-driven capabilities and automated workflows.

- **Agentic workflows** — Accelerate Triage And Investigations
- **AI-driven threat detection** — Enhance Threat Detection with AI
- **AI-enabled ecosystem** — Integrate Seamlessly with Existing Tools
- **Real-time evidence generation** — Facilitate Informed Decisions
- **Autonomous triage** — Streamline Triage Processes
- **Multi-cloud support** — Enable Cloud Environment Security

### [Cloud Sensors](https://corelight.com/products/cloud)
*Product*
Enhance security and visibility across hybrid and multi-cloud environments with Corelight's Cloud Sensors.

- **Cloud-Native Detections** — Leverage Cloud-Native Detection
- **Real-Time Cloud Threat Detection** — Detect Threats In Real-Time
- **Cloud Visibility Across Environments** — Achieve Complete Visibility
- **Uniform Telemetry Across Environments** — Ensure Consistent Telemetry
- **Cloud Service Mapping to Hosts** — Identify And Map Services
- **Multi-Cloud Support** — Support All Major Clouds
- **Log Volume Reduction** — Reduce Log Volume

### [ICS/OT Collection](https://corelight.com/products/ics-ot)
*Product*
Enhanced visibility and security for ICS/OT devices and protocols to rapidly identify threats.

- **Evidence Collection for ICS/OT Events** — Collect Evidence Effectively
- **ICS/OT Protocol Identification** — Identify Protocols Accurately
- **Industrial Device Visibility** — Monitor Devices Continuously
- **Real-Time Anomaly Detection** — Identify Anomalies Swiftly

### [Entity Collection](https://corelight.com/products/entity-collection)
*Product*
Enhance asset visibility and network management through comprehensive entity tracking and profiling.

- **Entity Discovery and Profiling** — Identify And Profile Entities
- **Host and Device Inventory** — Automate Asset Inventory
- **Open NDR Platform Integration** — Utilize Open NDR Framework

### [Fleet Manager](https://corelight.com/products/fleet-manager)
*Product*
Centralizes sensor management for efficient security response.

- **Centralized Sensor Management** — Streamline Updates And Configurations
- **Deployment Control** — Simplify Sensor Deployments
- **Custom Configuration Templates** — Enhance Consistency Across Sensors
- **Role-Based Access Control** — Manage User Permissions Effectively
- **Sensor Health Monitoring** — Ensure Optimal Operational Status
- **Group Management** — Organize Sensors By Need

### [Corelight Appliances](https://corelight.com/products/appliances)
*Product*
Enhance Threat Detection and Response with Enterprise-Grade Network Sensors.

- **Traffic Analysis Speed** — Support High-Speed Monitoring
- **Seamless Integration** — Integrate with Existing Security Infrastructure
- **Versatile Deployment Options** — Customize for Your Environment
- **Operational Mode** — Enhance Network Performance Monitoring

### [Virtual Sensors](https://corelight.com/products/virtual-sensors)
*Product*
Provides high-fidelity network data for comprehensive visibility in virtual environments.

- **Deployment Speed** — Deploy And Scale Quickly
- **High-Fidelity Network Data** — Generate High-Fidelity Data
- **Hyper-V and VMware Support** — Support For Hyper-V And VMware
- **Log Reduction** — Reduce Log Volume
- **Automatic Updates** — Receive Automatic Updates

### [Cloud Security Solutions](https://corelight.com/solutions/cloud-solutions)
*Solution*
Enhance cloud security with comprehensive visibility, rapid threat detection, and efficient incident response.

- **AWS, GCP, and Azure Support** — Enables Multi-Cloud Security
- **Cloud Visibility Across Hybrid/Multi-Cloud** — Achieves Complete Cloud Oversight
- **Real-Time Cloud Threat Detection** — Enables Swift Incident Management
- **Cloud Control Plane Data Integration** — Enhances Detection Capabilities
- **Uniform Telemetry Across Environments** — Standardizes Security Monitoring
- **Cloud-Native Detections** — Targets Cloud Threats Effectively
- **Log Reduction in Cloud** — Minimizes Log Management Overhead

## Market Segments

- **Network detection and response** (market size $4.0B, CAGR 14.1%): Capabilities that detect, investigate, and contain malicious activity across enterprise network traffic using AI-driven telemetry, alert prioritization, and enforced containment.
- **Cloud network visibility and detection** (market size $3.0B, CAGR 16%): Visibility and threat detection across multi-cloud and hybrid environments using cloud-native detections, cloud control plane integration, and uniform telemetry to reduce log volume and accelerate cloud incident response.
- **AI-driven security operations (AI SOC)** (market size $9.2B, CAGR 28.54%): Platforms that apply AI-guided investigations, configurable autonomy modes and agentic task execution to enable autonomous or AI-assisted SOC workflows and improve analyst efficiency.
- **Sensor management and orchestration** (market size $3.5B, CAGR 18%): Centralized management, deployment, configuration, and health monitoring of network and virtual sensors with role-based access and templated configuration for operational scale.
- **Operational technology security** (market size $27.4B, CAGR 16.6%): Visibility, monitoring, and risk management for industrial and OT environments to protect ICS/SCADA assets with asset discovery, continuous monitoring, and zero-trust controls.