Corelight
Corelight provides network detection and response solutions for cybersecurity teams.
- Based in
- San Francisco, United States
- Founded
- 2013
- Ownership
- Private
About Corelight
Corelight sells an Open Network Detection and Response platform that turns network traffic into evidence for security operations. It serves security teams in energy, healthcare, education, financial services, manufacturing, and government. The platform combines machine learning, behavioural analytics, curated signatures, and threat intelligence to produce prioritised alerts. It also offers agentic triage that consolidates alerts and correlates evidence, which the company says speeds triage by ten times. Corelight builds on open source tools such as Zeek, Suricata, and Sigma, and it says its data format is open and portable. The platform integrates with SIEM, XDR, SOAR, and cloud systems from Splunk, CrowdStrike, Microsoft, Elastic, and AWS.
Products
- Open NDR PlatformA network detection and response platform that turns raw traffic into context-enriched evidence for detection, investigation, and response.
- Corelight InvestigatorA cloud product offering that operates at scale and has published service level agreements.
- Cloud Sensor for AWSA sensor that provides visibility and threat hunting for cloud activity on AWS.
- Agentic TriageA capability that automatically consolidates alerts, correlates evidence, and runs expert playbooks to speed up triage.
- SIEM Verdict ExportA feature that sends agentic triage verdicts with reasoning and evidence into a SIEM in real time.
- Natural Language QueryA tool that lets analysts search network evidence using plain English.
Ownership and deals
- Raised $150m in a Series E roundInvestor AccelReport on the Corelight funding round of May 2024 (opens in a new tab)
Acquisitions come from SecurityWeek's monthly M&A round-ups from 2021 onwards, from Cybersecurity Ventures' quarterly M&A reports for 2020, and a few from Wikipedia lists. Funding rounds from 2022 onwards come from Return on Security's weekly Security, Funded newsletter. These are dated to the month. A few deals added from the news are dated to the day. Smaller deals may be missing. Amounts are in US dollars.