Corelight Open NDR

6.5easy start · #12 of 19
in Anomaly Detection Software

Free to practise onnot on record
Free trialnot on record
Well documentedyes
Runs where you worknot on record

Runs on api, Linux, self-hosted, Web.

Corelight Open NDR is ranked #12 of 19 in anomaly detection software on The Geeks Club. It runs on API, Linux, Self-hosted, Web.

Corelight Open NDR plans and pricing

All plans

Custom Not published capacity-based licensing corelight.com · 30 Sept 2026

Compared on anomaly detection software

Detection method: hybrid
Real-time detection: Yes
Supported data: network traffic, packet data, flow logs, cloud network traffic, protocol logs, files
Deployment options: hybrid
Anomaly explanations: Yes

Best Corelight Open NDR alternatives

See all 18

Metaplane 0 of 4 in the starter kit Lesson 17.6 OpenSearch 0 of 4 in the starter kit Lesson 27.2 Anomalib 0 of 4 in the starter kit Lesson 37.1 ManageEngine NetFlow Analyzer 0 of 4 in the starter kit Lesson 47.1 ObservabilityOS 0 of 4 in the starter kit Lesson 57.1 PyOD 0 of 4 in the starter kit Lesson 67.1

The record

Purpose: Corelight Open NDR transforms raw network and cloud traffic into context-enriched, high-fidelity evidence for security operations.
Detection: Its detection strategy combines machine learning, behavioral analytics, curated signatures, and threat intelligence.
Incident response: AI-powered explainability, automated triage, and integrated response workflows provide context for containing threats and lowering MTTR.
Tool consolidation: Corelight says Open NDR combines network security monitoring, intrusion detection, static file analysis, and intelligent packet capture in one platform.
Integrations: The platform has native integrations with SIEM, XDR, SOAR, and cloud platforms including Splunk, CrowdStrike, Microsoft, Elastic, and AWS.
APIs: Logs API and an MCP server provide programmatic access for custom orchestration and management.
Deployment: Corelight offers physical, software, virtual, cloud, and flow-log sensors for on-premises, air-gapped, hybrid, and multicloud environments.
Cloud coverage: Cloud-native sensors support AWS, Azure, and Google Cloud, while software sensors support Linux-based systems.
Scale: Physical and software sensors are built to handle network environments at 100+ Gbps scale.
Security and compliance: Corelight maintains a dedicated security program and says select products are independently audited and certified to industry-leading compliance standards.
Federal certifications: Corelight states that its sensors comply with FIPS 140-2, are NIAP Common Criteria certified, and that the Open NDR Platform is FedRAMP Class C (Moderate) in process.
Audience: Corelight serves large enterprises and government agencies in more than fifteen countries.
Founded: 2016
Headquarters: San Francisco, California, USA

Where it ranks on The Geeks Club

Best Anomaly Detection Software in 2026#12 of 19

Is Corelight Open NDR yours?

Claim it for free: prove the domain, then correct facts, plans and screenshots. An editor reviews every change.

Claim it free Promote Corelight Open NDR

Sources

corelight.com/platform/· checked 30 Sept 2026
corelight.com/platform/deployment-options· checked 30 Sept 2026
corelight.com/legal/trust-center· checked 30 Sept 2026
corelight.com/solutions/industry/federal· checked 30 Sept 2026
corelight.com/company/about-corelight· checked 30 Sept 2026
corelight.com/contact· checked 30 Sept 2026