Compare products
Put two or three cybersecurity products side by side and see how they differ on deployment, pricing, features, integrations and compliance.
| Product | Corelight Investigator by Corelight View product | Zeek by Zeek View product |
|---|---|---|
| Overview | ||
| What it is | Looking for Network Security software? Corelight Investigator by Corelight provides entity tracking for Incident Investigation. Compare features and alternatives. | What does Zeek do? It covers file hash extraction and high-speed packet capture. See typical use cases, self-hosted deployment and how it compares to rivals. |
| Product type | Cloud-Native Network Detection and Response (NDR) | Open-Source Network Security Monitoring & Behavioral Analysis Engine |
| Best for | Enterprise Security Operations, Banking, Tech, Healthcare, Public | Cybersecurity, SOC Teams, Network Engineering, Defense, Research, Telecom |
| Pricing | ||
| Pricing model | Contact Vendor | Contact Vendor |
| Free trial | Free trial: yes | Free trial: yes |
| Deployment | ||
| Deployment options | SaaSCloud | CloudOn-Premise |
| Deployment details | Cloud (SaaS); Sensor-Backed Analytics; Cloud SaaS; Sensor-backed network analytics | Open Source; Self-hosted Software; Self-hosted Software Engine; Hardened Appliance; Cloud Virtual Sensor |
| Data residency | US; EU; Global | Customer Infrastructure Dependent (Completely Self-Contained) |
| Key features | ||
| What it offers |
|
|
| Platform & access | ||
| API access | API access: yes | API access: no |
| Single sign-on (SSO) | SSO: yes | SSO: no |
| Role-based access (RBAC) | RBAC: yes | RBAC: yes |
| Multi-tenant | Multi-tenant: yes | Multi-tenant: no |
| Mobile app | Mobile app: no | Mobile app: no |
| Supported platforms | Corelight SensorsAWSAzureGCPOn-premises Networks | Enterprise NetworksDatacenter FabricsMulti-Cloud VPCsMonitoring Taps |
| Compliance | SOC 2 Type IIISO 27001GDPRHIPAA | BSD LicenseCommon CriteriaNetwork Standards |
| Integrations & coverage | ||
| Integrations | Corelight SensorsCrowdStrike FalconMicrosoft SentinelSplunk | ElasticsearchSplunkSuricataKafkaArkimeWiresharkCorelight |
| Industries | Enterprise Security OperationsBankingTechHealthcarePublic | CybersecuritySOC TeamsNetwork EngineeringDefenseResearchTelecom |
| Regions | GlobalUSEU | Global |
| Vendor | ||
| Company | Corelight | Zeek |
| Headquarters | San Francisco, California, USA | Berkeley, California, USA |
| Company size | 201-500 | 1-10 |
| Founded | 2013 | 1994 |
Overview
What it is
Corelight Investigator
Looking for Network Security software? Corelight Investigator by Corelight provides entity tracking for Incident Investigation. Compare features and alternatives.Zeek
What does Zeek do? It covers file hash extraction and high-speed packet capture. See typical use cases, self-hosted deployment and how it compares to rivals.Product type
Corelight Investigator
Cloud-Native Network Detection and Response (NDR)Zeek
Open-Source Network Security Monitoring & Behavioral Analysis EngineBest for
Corelight Investigator
Enterprise Security Operations, Banking, Tech, Healthcare, PublicZeek
Cybersecurity, SOC Teams, Network Engineering, Defense, Research, TelecomPricing
Pricing model
Corelight Investigator
Contact VendorZeek
Contact VendorFree trial
Corelight Investigator
Free trial: yesZeek
Free trial: yesDeployment
Deployment options
Corelight Investigator
SaaSCloud
Zeek
CloudOn-Premise
Deployment details
Corelight Investigator
Cloud (SaaS); Sensor-Backed Analytics; Cloud SaaS; Sensor-backed network analyticsZeek
Open Source; Self-hosted Software; Self-hosted Software Engine; Hardened Appliance; Cloud Virtual SensorData residency
Corelight Investigator
US; EU; GlobalZeek
Customer Infrastructure Dependent (Completely Self-Contained)Key features
What it offers
Corelight Investigator
- Cloud-native NDR
- Zeek network telemetry
- MITRE ATT&CK threat detections
- Entity tracking
- Rapid network query pivots
- NDR
- Network Security
- Threat Detection
Zeek
- Stateful network protocol analysis
- Structured transaction logging (HTTP/DNS/TLS)
- File hash extraction
- Event-driven domain scripting language
- High-speed packet capture
- Network security monitoring
- Network forensic investigation
- Protocol transaction logging
Platform & access
API access
Corelight Investigator
API access: yesZeek
API access: noSingle sign-on (SSO)
Corelight Investigator
SSO: yesZeek
SSO: noRole-based access (RBAC)
Corelight Investigator
RBAC: yesZeek
RBAC: yesMulti-tenant
Corelight Investigator
Multi-tenant: yesZeek
Multi-tenant: noMobile app
Corelight Investigator
Mobile app: noZeek
Mobile app: noSupported platforms
Corelight Investigator
Corelight SensorsAWSAzureGCPOn-premises Networks
Zeek
Enterprise NetworksDatacenter FabricsMulti-Cloud VPCsMonitoring Taps
Compliance
Corelight Investigator
SOC 2 Type IIISO 27001GDPRHIPAA
Zeek
BSD LicenseCommon CriteriaNetwork Standards
Integrations & coverage
Integrations
Corelight Investigator
Corelight SensorsCrowdStrike FalconMicrosoft SentinelSplunk
Zeek
ElasticsearchSplunkSuricataKafkaArkimeWiresharkCorelight
Industries
Corelight Investigator
Enterprise Security OperationsBankingTechHealthcarePublic
Zeek
CybersecuritySOC TeamsNetwork EngineeringDefenseResearchTelecom
Regions
Corelight Investigator
GlobalUSEU
Zeek
Global
Vendor
Company
Corelight Investigator
CorelightZeek
ZeekHeadquarters
Corelight Investigator
San Francisco, California, USAZeek
Berkeley, California, USACompany size
Corelight Investigator
201-500Zeek
1-10Founded
Corelight Investigator
2013Zeek
1994