Corelight Cloud Sensor

We use the solution to monitor Internet traffic, the data center, and LAN traffic.

The huge library especially the open source link, makes it the main engine for Corelight with some enhancements in the commercial version. It has a very powerful level, such as signature-based attacks or behavioral attacks, with enhancements in the design. It is very flexible for intelligent implementations like IPs, especially between big companies and banks.

Corelight is easy to understand and monitor what is going on behind the team.

The solution is already integrated with other systems like Suricata, Elastic, and Microsoft tools. It's very easy to integrate signature-based or behavior-based engines. You can use Elastic for the dashboards to get it from Corelight, along with all the benefits and expandability.

The tool helps us track the traffic easily. Additionally, the soft analysis is very easy to learn due to the simplicity of the engine. It can integrate with multiple threat and intelligence feeds. This empowers the solution more than its powerful. It's also easy to create additional dashboards specific to supporting specific tasks.

The solution’s architecture is complex and difficult to understand. There's multiple machines and VMs. It’s size will increase the pricing to reflect the design. The solution should make it to one single platform with all the features.

I have been using Corelight as a distributor for one and a half years.

The product is very stable.

The solution is very scalable. More than 12 users are using this solution in the middle east. Corelight is easy to expand, especially in Kubernetes. Just add the new machine, and it will work with the existing ones.

There is a strong community behind Corelight. You may need support due to stability from the team in very specific cases.

Positive

The initial setup is not straightforward. You need expertise for it. I rate the solution’s documentation a six out of ten.

Deployment depends on the MVP, the amount and the capacity of the environment. If it's a huge customer, you will face big problem, and it will not be easy to implement. You will have multiple integrations, multiple positions to position the sensors. It will be easier to pick for the smaller customers or networks. Deployment can take be two weeks to three months to complete.

I rate the initial setup a five out of ten, where one is difficult, and ten is easy.

The solution is too expensive compared to others. If you have the technical knowledge, it's good. Corelight is a very big gap between you and others if you’re new.

Overall, I rate the solution a seven out of ten.

We use the solution for packet capture sampling. We offer it as part of our managed service. It's so we can identify east-west traffic on a customer's network.

Corelight is low-cost and made on open-source, and the code is Zeek. It's an easy way for us to get visibility in a client's environment.

Corelight hasn’t added features in a long time.

I have five years of experience with the solution.

The solution is stable.

The solution is very scalable.

The initial setup was straightforward. When deploying Corelight, the customer just needs to put the solution on a VM. The only maintenance required is the maintenance of the license.

We immediately realized the solution’s ROI. Its visibility into east-west traffic, being able to sample capture, gives a sense of traffic flow. Moreover, it's inexpensive.

The product is open-source.

I rate the solution an eight out of ten.