Compare products

Put two or three cybersecurity products side by side and see how they differ on deployment, pricing, features, integrations and compliance.

Corelight Open NDR PlatformZeek2 of 3 products

Side-by-side comparison of Corelight Open NDR Platform, Zeek
Product	Corelight Open NDR Platform by Corelight View product	Zeek by Zeek View product
Overview
What it is	Looking for NDR software? Corelight Open NDR Platform by Corelight provides SIEM/lake streaming for Network Analytics. Compare features and alternatives.	What does Zeek do? It covers file hash extraction and high-speed packet capture. See typical use cases, self-hosted deployment and how it compares to rivals.
Product type	Open Enterprise Network Detection & Response Platform	Open-Source Network Security Monitoring & Behavioral Analysis Engine
Best for	Global Enterprise, Defense, Financial, Telecom, Healthcare	Cybersecurity, SOC Teams, Network Engineering, Defense, Research, Telecom
Pricing
Pricing model	Contact Vendor	Contact Vendor
Free trial	Free trial: yes	Free trial: yes
Deployment
Deployment options	SaaSCloudOn-Premise	CloudOn-Premise
Deployment details	Hardware; Virtual; Cloud Sensors & SaaS; Hardware appliance; Virtual appliance; Cloud sensors	Open Source; Self-hosted Software; Self-hosted Software Engine; Hardened Appliance; Cloud Virtual Sensor
Data residency	On-premises Data Center; Multi-Cloud	Customer Infrastructure Dependent (Completely Self-Contained)
Key features
What it offers	Open NDR architecture Zeek protocol parsing Suricata intrusion detection Encrypted traffic analysis SIEM/lake streaming NDR Network Analytics Network Security	Stateful network protocol analysis Structured transaction logging (HTTP/DNS/TLS) File hash extraction Event-driven domain scripting language High-speed packet capture Network security monitoring Network forensic investigation Protocol transaction logging
Platform & access
API access	API access: yes	API access: no
Single sign-on (SSO)	SSO: yes	SSO: no
Role-based access (RBAC)	RBAC: yes	RBAC: yes
Multi-tenant	Multi-tenant: yes	Multi-tenant: no
Mobile app	Mobile app: no	Mobile app: no
Supported platforms	Bare-metal HardwareVMwareKVMAWSAzureGCP	Enterprise NetworksDatacenter FabricsMulti-Cloud VPCsMonitoring Taps
Compliance	Common CriteriaFIPS 140-2SOC 2 Type IIISO 27001	BSD LicenseCommon CriteriaNetwork Standards
Integrations & coverage
Integrations	SplunkMicrosoft SentinelElasticCrowdStrikeSnowflakeKafka	ElasticsearchSplunkSuricataKafkaArkimeWiresharkCorelight
Industries	Global EnterpriseDefenseFinancialTelecomHealthcare	CybersecuritySOC TeamsNetwork EngineeringDefenseResearchTelecom
Regions	GlobalUSEU	Global
Vendor
Company	Corelight	Zeek
Headquarters	San Francisco, California, USA	Berkeley, California, USA
Company size	201-500	1-10
Founded	2013	1994

Corelight Open NDR Platform

by Corelight

View product

Zeek

by Zeek

View product

Overview

What it is

Corelight Open NDR Platform

Looking for NDR software? Corelight Open NDR Platform by Corelight provides SIEM/lake streaming for Network Analytics. Compare features and alternatives.

Zeek

What does Zeek do? It covers file hash extraction and high-speed packet capture. See typical use cases, self-hosted deployment and how it compares to rivals.

Product type

Corelight Open NDR Platform

Open Enterprise Network Detection & Response Platform

Zeek

Open-Source Network Security Monitoring & Behavioral Analysis Engine

Best for

Corelight Open NDR Platform

Global Enterprise, Defense, Financial, Telecom, Healthcare

Zeek

Cybersecurity, SOC Teams, Network Engineering, Defense, Research, Telecom

Pricing

Pricing model

Corelight Open NDR Platform

Contact Vendor

Zeek

Contact Vendor

Free trial

Corelight Open NDR Platform

Zeek

Deployment

Deployment options

Corelight Open NDR Platform

SaaSCloudOn-Premise

Zeek

CloudOn-Premise

Deployment details

Corelight Open NDR Platform

Hardware; Virtual; Cloud Sensors & SaaS; Hardware appliance; Virtual appliance; Cloud sensors

Zeek

Open Source; Self-hosted Software; Self-hosted Software Engine; Hardened Appliance; Cloud Virtual Sensor

Data residency

Corelight Open NDR Platform

On-premises Data Center; Multi-Cloud

Zeek

Customer Infrastructure Dependent (Completely Self-Contained)

Key features

What it offers

Corelight Open NDR Platform

Open NDR architecture
Zeek protocol parsing
Suricata intrusion detection
Encrypted traffic analysis
SIEM/lake streaming
NDR
Network Analytics
Network Security

Zeek

Stateful network protocol analysis
Structured transaction logging (HTTP/DNS/TLS)
File hash extraction
Event-driven domain scripting language
High-speed packet capture
Network security monitoring
Network forensic investigation
Protocol transaction logging

Platform & access

API access

Corelight Open NDR Platform

Zeek

Single sign-on (SSO)

Corelight Open NDR Platform

Zeek

Role-based access (RBAC)

Corelight Open NDR Platform

Zeek

Multi-tenant

Corelight Open NDR Platform

Zeek

Mobile app

Corelight Open NDR Platform

Zeek

Supported platforms

Corelight Open NDR Platform

Bare-metal HardwareVMwareKVMAWSAzureGCP

Zeek

Enterprise NetworksDatacenter FabricsMulti-Cloud VPCsMonitoring Taps

Compliance

Corelight Open NDR Platform

Common CriteriaFIPS 140-2SOC 2 Type IIISO 27001

Zeek

BSD LicenseCommon CriteriaNetwork Standards

Integrations & coverage

Integrations

Corelight Open NDR Platform

SplunkMicrosoft SentinelElasticCrowdStrikeSnowflakeKafka

Zeek

ElasticsearchSplunkSuricataKafkaArkimeWiresharkCorelight

Industries

Corelight Open NDR Platform

Global EnterpriseDefenseFinancialTelecomHealthcare

Zeek

CybersecuritySOC TeamsNetwork EngineeringDefenseResearchTelecom

Regions

Corelight Open NDR Platform

GlobalUSEU

Zeek

Global

Vendor

Company

Corelight Open NDR Platform

Corelight

Zeek

Headquarters

Corelight Open NDR Platform

San Francisco, California, USA

Zeek

Berkeley, California, USA

Company size

Corelight Open NDR Platform

201-500

Zeek

1-10

Founded

Corelight Open NDR Platform

2013

Zeek

1994