Authorized Corelight Partner
Corelight
Open NDR platform built on Zeek and Suricata, with AI detections and sensors for on-prem and cloud networks
Corelight is an Open NDR platform that turns network traffic into evidence your SOC can act on: Zeek logs, Suricata alerts, YARA file analysis and selective packet capture with Smart PCAP. Appliance, virtual, software and cloud sensors feed that evidence into Corelight Investigator or your own SIEM, where AI/ML detections and Agentic Triage shorten investigations.
ICWT is an Authorized Corelight Partner based in Poland. We implement the Open NDR platform for organizations in Poland and abroad and support them after go-live.
- Authorized Corelight Partner
- Full Corelight portfolio
- NDR implementation and support
- Support in Polish and English
What Corelight does
Corelight sensors watch traffic passively across the corporate network, data center and cloud, then write it out as Zeek logs, Suricata alerts and packet extracts. Your SOC gets one body of evidence for the whole environment and reviews it in Corelight Investigator or your existing SIEM. Deployment can be on-prem, SaaS or hybrid, and sensors also run in air-gapped networks.
The portfolio covers three areas: Open NDR sensors, investigation and management, and detection collections.
Open NDR sensors
Appliance, virtual (VMware and Hyper-V), software (Linux and Kubernetes) and cloud sensors for AWS, Azure and GCP take traffic from TAPs, SPAN ports and packet brokers, or via cloud packet mirroring.
Investigation and management
Corelight Investigator runs AI/ML detections and Agentic Triage as a SaaS service, Fleet Manager configures and updates the whole sensor fleet, and Smart PCAP stores only the packets your rules select.
Detection collections
Corelight's detection packages analyze SSL, SSH, RDP and VPN traffic without decryption, inventory hosts and applications, and flag command-and-control activity such as Cobalt Strike and DNS tunneling.
Corelight products and services
10 products and servicesExplore the Corelight products ICWT implements and supports across Open NDR sensors, investigation and management, and detection collections.
Open NDR sensors4
Investigation and management4
How ICWT works with Corelight
ICWT deploys Corelight and supports you after go-live: sensor placement, SIEM integration, detection tuning and first-line support. Our team works from Poland and serves customers there and abroad.
Implementation
We map the network, agree on success criteria and roll out sensors in phases, fed from TAPs, SPAN ports, packet brokers or cloud traffic mirroring. We connect Investigator or your SIEM, enable detection collections and Smart PCAP, and train your SOC on your own data.
Support
We provide first-line support in Polish and English and escalate to Corelight when needed. We review network coverage, license use and expansion plans on a set schedule.
Corelight expertise backed by Authorized Corelight Partner status and NDR practice
ICWT combines its Authorized Corelight Partner status with hands-on implementation of network detection and response for customers in Poland and abroad.
Partner status
Authorized Corelight Partner
Service scope
NDR implementation and support
Planning a Corelight project?
Talk to us about sensor placement, SIEM integration, implementation or support of the Corelight platform, whether you operate in Poland or internationally.