Corelight Features

Response (7)

Resolution Automation: Diagnose and resolve incidents without the need for human interaction.
Resolution Guidance: Guide users through the resolution process and give specific instructions to remedy individual occurrences.
System Isolation: Cuts off network connection or temporarily inactivate applications until incidents are remedied.
Threat Intelligence: Gathers information related to threats in order to gain further information on remedies.
Incident Alerts: Gives alerts when incidents arise. Some responses may be automated, but users will still be informed.
Response Orchestration: Integrates additional security tools to automate security and incident response processes.
Response Automation: Reduces time spent remedying issues manually. Resolves common network security incidents quickly

Records (3)

Management (6)

Incident Alerts: Gives alerts when incidents arise. Some responses may be automated, but users will still be informed.
Database Management: Adminstrators can access and organize data related to incidents to produce reports or make data more navigable.
Workflow Management: Administrators can organize workflows to guide remedies to specific situations incident types.
Performance Baseline: Sets a standard performance baseline by which to compare live network activity.
Data Visualization: Charts or graphs live and historical network performance for quick status checking and analysis.
Path Analysis: Gives insights into which specific network paths are performing suboptimally.

Network Management (3)

Incident Management (6)

Event Management: Alerts users of incidents and allows users to intervene manually or triggers an automated response.
Automated Response: Reduces time spent remedying issues manually. Resolves common network security incidents quickly.
Incident Reporting: Documents cases of abnormal activity and compromised systems.
Incident Logs: Information on each incident is stored in databases for user reference and analytics.
Incident Alerts: Gives alerts when incidents arise. Some responses may be automated, but users will still be informed.
Incident Reporting: Produces reports detailing trends and vulnerabilities related to their network and infrastructure.

Security Intelligence (4)

Threat Intelligence: Stores information related to common threats and how to resolve them once incidents occur.
Vulnerability Assessment: Analyzes your existing network and IT infrastructure to outline access points that can be easily compromised.
Advanced Analytics: Allows users to customize analytics with granulized metrics that are pertinent to your specific resources.
Data Examination: Allows users to search databases and incident logs to gain insights on vulnerabilities and incidents.

Administration (10)

Risk Scoring: Provides risk scoring for suspicious activity, vulnerabilities, and other threats.
Secrets Management: Provides tools for managing authentication credentials such as keys and passwords.
Security Auditing: Analyzes data associated with security configurations and infrastructure to provide vulnerability insights and best practices.
Configuration Management: Monitors configuration rule sets and policy enforcement measures and document changes to maintain compliance.
Compliance: Supports compliance with PII, GDPR, HIPPA, PCI, and other regulatory standards.
Administration Console -: Provides a centralized console for administation tasks and unified control.
API / integrations: Application Programming Interface - Specification for how the application communicates with other software. API's typically enable integration of data, logic, objects, etc. with other software applications.
Security Automation: Streamline the flow of work processes by establishing triggers and alerts that notify and route information to the appropriate people when their action is required within the compensation process.
Security Integration: Integrates additional security tools to automate security and incident response processes.
Multicloud Visibility: Allows users to track and control activity across cloud services and providers.

Monitoring (3)

Continuous Image Assurance: Provides image verification features to establish container approval requirements and continuously monitor for policy violations to identify containers with known vulnerabilities, malware, and other threats.
Behavior Monitoring: Constantly monitors acivity related to user behavior and compares activity to benchmarked patterns and fraud indicators.
Observability: Generate insights across IT systems utilizing event metrics, logging, traces, and metadata.

Protection (4)

Dynamic Image Scanning: Scans application and image source code for security flaws without executing it in a live environment
Runtime Protection: Monitors container activities and detects threats across containers, networks, and cloud service providers.
Workload Protection: Protects compute resources across a networks and cloud service providers. Serves as Firewall and prompts additional authentication for suspicious users.
Network Segmentation: Allows administrative control over network components, mapping, and segmentation.

Detection (6)

Intrusion Detection: Detects unauthorized access and use of privileged systems.
Security Monitoring: Detects anomalies in functionality, user accessibility, traffic flows, and tampering.
Anti-Malware / Malware Detection: Provides multiple techniques and information sources to alert users of malware occurrences.
Multi-Network Monitoring: Provides monitoring capabilities for multiple networks at once.
Asset Discovery: Detect new assets as they enter a network and add them to asset inventory.
Anomaly Detection: Constantly monitors activity related to user behavior and compares activity to benchmarked patterns

Functionality (12)

Performance Monitoring: Continuously monitors network performance across the entire span of a network.
Alerting: Sends alerts via pop-up notifications, texts, emails, or calls regarding network issues or failures.
Improvement Suggestions: Suggests potential remedies or improvements to slowdowns, errors, or failures.
Multi-Network Capability: Provides monitoring capabilities for multiple networks at once.
Multi-Network Capability: Provides monitoring capabilities for multiple networks at once.
Anomaly Detection: Constantly monitors activity related to user behavior and compares activity to benchmarked patterns.
Network Visibility: Provides all-encompassing display and analysis of environments, resources, traffic, and activity across networks.
Scalability: Provides features to allow scaling for large organizations.
Incident Alerts: Gives alerts when incidents arise. Some responses may be automated, but users will still be informed.
Anomaly Detection: Constantly monitors activity related to user behavior and compares activity to benchmarked patterns.
Continuous Analysis: Constantly monitors traffic and activity. Detects anomalies in functionality, user accessibility, traffic flows, and tampering.
Decryption: Facilitates the decryption of files and data stored using cryptographic algorithms.

Automation (4)

Metadata Management: Indexes metadata descriptions for easier searching and enhanced insights
Artificial Intelligence & Machine Learning: Facilitates Artificial Intelligence (AI) or Machine Learning (ML) to enable data ingestion, performance suggestions, and traffic analysis.
Response Automation: Reduces time spent remedying issues manually. Resolves common network security incidents quickly.
Continuous Analysis: Constantly monitors traffic and activity. Detects anomalies in functionality, user accessibility, traffic flows, and tampering.

Analysis (9)

File Analysis: Identifies potentially malicious files and applications for threats files and applications for abnormalities and threats.
Memory Analysis: Analyzes infortmation from a computer or other endpoint's memory dump for information removed from hard drive.
Registry Analysis: Identifies recently accessed files and applications for abnormalities and threats.
Email Analysis: Parses and/or extracts emails and associated content for malware, phishing, other data that can be used in investigations.
Linux Analysis: Allows for parsing and/or extraction of artifacts native to Linux OS including but not limited to system logs, SSH activity, and user accounts.
Incident Reporting: Produces reports detailing trends and vulnerabilities related to their network and infrastructur
Network Visibility: Provides all-encompassing display and analysis of environments, resources, traffic, and activity across networks.
Metadata Enrichment: Facilitates Artificial Intelligence (AI) such as Machine Learning (ML) to enable data ingestion, performance suggestions, and traffic analysis.
Metadata Management: Indexes metadata descriptions for easier searching and enhanced insight

Remediation (3)

Activity Monitoring (4)

Usage Monitoring: Tracks infrastructure resource needs and alerts administrators or automatically scales usage to minimize waste.
Database Monitoring: Monitors performance and statistics related to memory, caches and connections.
API Monitoring: Detects anomalies in functionality, user accessibility, traffic flows, and tampering.
Activity Monitoring: Actively monitors status of work stations either on-premise or remote.

Security (3)

Connected Device Security (8)

Vulnerability Assessment: Performs risk and security gap assessments for connected assets.
Identity Lifecycle: Assists with authentication and authorization of connected assets.
Threat Protection: Provides general protection against device threats, such as firewall and antivirus tools.
Behavior Analysis: Monitors device behaviors to identify abnormal events.
Incident Response: Responds to suspicious activity related to IoT devices. This may include actions such as threat containment and eradication as well as device recovery.
IoT Network Security: Provides security measures for IoT networks and gateways.
OTA Updates: Automatically sends over-the-air (OTA) security updates to connected devices.
Alerts & Notifications: Sends timely security notifications to users in-app or through email, text message or otherwise.

Platform (4)

Generative AI (5)

Monitoring - Network Monitoring (3)

360-Degree Network Visibility: Offers full observability of all network environments, including on-premises, cloud, SD-WAN, WLAN, and edge computing.
Automated Network Discovery: Automatically detects and maps all network devices and architectures, reducing manual effort and improving visibility.
Real-Time Monitoring: Provides true real-time network monitoring to detect and resolve issues instantly, rather than relying on near-time data.

Analytics - Network Monitoring (2)

Security - Network Monitoring (3)

Network Performance - Network Monitoring (2)

AI Automation - Network Monitoring (3)

Machine Learning-Based Anomaly Detection: Uses machine learning to identify network anomalies, preventing security and performance issues before they escalate.
Self-Healing Networks: Automates corrective actions for common network issues, reducing downtime and manual intervention.
Predictive Network Maintenance: Leverages AI to anticipate hardware failures, capacity issues, and performance bottlenecks before they occur.

Agentic AI - Security Information and Event Management (SIEM) (4)

Agentic AI - Intrusion Detection and Prevention Systems (IDPS) (2)

Agentic AI - Cloud Security Monitoring and Analytics (3)

Agentic AI - Cloud Detection and Response (CDR) (3)

Agentic AI - AWS Marketplace (3)

Agentic AI - Network Monitoring (7)

Autonomous Task Execution: Capability to perform complex tasks without constant human input
Multi-step Planning: Ability to break down and plan multi-step processes
Cross-system Integration: Works across multiple software systems or databases
Adaptive Learning: Improves performance based on feedback and experience
Natural Language Interaction: Engages in human-like conversation for task delegation
Proactive Assistance: Anticipates needs and offers suggestions without prompting
Decision Making: Makes informed choices based on available data and objectives