Corelight Reviews

Pros

Corelight delivers really strong network telemetry and presents security network events in a way that's much easier to digest. The CrowdStrike integration adds a lot of value by correlating network activity very well and the built-in parsers help make those events much more readable.

Cons

There's definitely some complexity to it so it's not the best fit for a beginner security analyst. On top of that some of the online training stays pretty high level which means you may need personalized training sessions and those can get expensive.

Pros

Enriching our data every day right as it comes in and then piping that enriched output into our log aggregator has been genuinely helpful. Setup and deployments in our environment also went without a lot of friction and overall the pricing feels fair for what we're getting.

Cons

Only real downside I've run into is that we've needed to build a couple of its modules ourselves to sort and ingest the data the way we need.

Pros

It's threat detection feels really solid and the alerts come with detailed, actionable information. Coming from a regular user perspective, it's honestly very insightful and helps you understand what's going on without having to dig through everything yourself.

Cons

I do wish the threat detection could be a bit faster. I understand there are a few processes that need to run before results are returned but the turnaround time would be the one area I'd want improved.

Pros

This feels like a solid hub for handling cybersecurity needs. The overall setup fits well when you're trying to strengthen detection and response and it's been a good resource for staying on top of security tasks.

Cons

One thing I'm a bit unsure about is the way it pairs with CrowdStrike and there's some uncertainty about how the two work together and what that means in practice.

Pros

Most useful part for me is its network detection and analysis capabilities. It's been really helpful for understanding what's happening on the network and getting actionable insights from that data.

Cons

That said, I'd really like to see some improvements to the UI experience. The interface could be more polished and user friendly because right now it doesn't feel as refined as the rest of the product.

Pros

Interface feels well laid out and getting to what I need is easy. Customer support has also been really helpful whenever I've been troubleshooting technical issues. They respond in a way that actually makes sense and helps me move forward.

Cons

Nothing stands out as a downside right now. I'm still getting comfortable with the newer features so nothing has bothered me so far.

Pros

It brings a lot of upgrades for SOC teams especially the strong visibility into devices on the network. It lets you inspect every packet with plenty of detail so you can really trace what's happening instead of guessing. On top of that it works alongside SIEM using open-source support and it has a solid set of IDS capabilities. The user interface is also pretty friendly which makes it easier to work with day to day.

Cons

There are always more features that could be added but beyond that there aren't many real downsides.

Pros

This makes it much simpler to spot anything suspicious going on like hidden viruses or hackers trying to break in. It feels like having a built-in detective tool for our network so we can investigate activity and keep everything running safely and reliably without constantly guessing what's happening.

Cons

The only real downside is that getting everything set up and managed can be fairly complex. Using it effectively may call for specialized knowledge and there's still room for improvement to make the workflows more useful for everyday needs.

Pros

The tool really simplifies the management and setup of a highly advanced NIDS. Getting everything organized and running feels a lot simpler than with more complex alternatives and the overall workflow makes it easier to keep the system under control.

Cons

What missing is better visibility when you're tuning or modifying the detection signatures. It's not as transparent as I'd want which makes iterative changes harder to evaluate and adjust confidently.

Pros

It's given me much wider visibility into which devices are joining our network and how the traffic is being handled. The built-in sensors also analyze that network activity and help flag potential vulnerabilities so we're not guessing about what's connected or what risks might be present.

Cons

Support has been really helpful and responsive, every time I've reached out things got sorted out correctly and in a pretty quick turnaround. So I dont have any complaints right now.

Pros

Corelight is a centralized administration tool and the interface is genuinely user-friendly. Everything feels organized and it's simple to navigate around the different admin functions without getting lost.

Cons

Nothing so far that I dislike about Corelight.