Corelight Sensors

Corelight Sensors are high-performance physical, virtual, and cloud network monitoring appliances engineered to ingest high-volume network traffic, extract rich protocol metadata, and execute real-time threat detection using Zeek and Suricata engines. Designed for enterprise data centers and multi-cloud perimeters, Corelight Sensors process network packet streams ranging from 1 Gbps to 100 Gbps with zero dropped packets.

Available as 1U/2U physical hardware appliances, virtual appliances on VMware ESXi and KVM, or native cloud sensors in AWS, Azure, and Google Cloud, they deploy non-intrusively via network TAP or SPAN ports. Core technical capabilities encompass hardware-accelerated packet capture, deep protocol decoding across dozens of network protocols, integrated Suricata intrusion detection signatures, automated file extraction, encrypted traffic analysis, and high-speed streaming of structured JSON or Zeek TSV logs directly into SIEMs, Kafka, or cloud storage.

Global telecommunication networks, defense organizations, and Fortune 500 enterprises deploy Corelight Sensors to establish indisputable ground-truth network visibility across physical and virtual infrastructures. They integrate natively with Corelight Fleet Manager, Splunk, Elastic, and Microsoft Sentinel. Common operational use cases include capturing comprehensive network metadata for digital forensics, detecting malicious network command-and-control communications, monitoring encrypted SSL/TLS session health, and streaming structured network telemetry into central enterprise security data lakes.