Corelight Investigator

Corelight Investigator is a cloud-native Network Detection and Response (NDR) solution designed to give security operations teams fast, comprehensive visibility into network threats, accelerated incident investigations, and automated threat hunting capabilities. Powered by open-source Zeek and Suricata telemetry and enriched by machine learning, Investigator transforms raw network traffic into structured, actionable security intelligence.

The platform ingests comprehensive network evidence generated by Corelight Sensors deployed across on-premises data centers and cloud VPCs (AWS, Azure, GCP). Key technical capabilities encompass automated machine-learning threat detections mapped to the MITRE ATT&CK framework, interactive visual investigation graphs, entity tracking (mapping IP addresses to hostnames and user identities over time), smart search across petabytes of historical network logs, and 1-click query pivot workflows. Analysts can inspect network transactions, TLS certificates, and DNS queries in seconds without complex query syntax.

Enterprise security operations centers and incident response teams deploy Corelight Investigator to eliminate network blind spots and dramatically compress Mean Time to Respond (MTTR). It integrates seamlessly with CrowdStrike Falcon, Microsoft Sentinel, Splunk, and Slack. Common operational use cases include investigating suspicious lateral movement during active incident response, hunting for persistent command-and-control beacons, analyzing encrypted traffic anomalies without breaking decryption, and validating endpoint security alerts with indisputable ground-truth network evidence.