Skip to main content
Corelight
Open NDR sensors

Appliance Sensors

AP 220 to AP 5200 appliances, 125+ Gbps (Corelight data)

Corelight Appliance Sensors are the hardware form of Open NDR for server rooms and data centers. They attach passively to a TAP or SPAN port, outside the traffic path. Corelight publishes two throughput figures per model: baseline analysis, and analysis with Zeek, Suricata and Smart PCAP together. The AP 220 handles up to 4 Gbps and 2 Gbps, the AP 620 up to 10 and 5 Gbps, the AP 1200 up to 25 and 12.5 Gbps, the AP 3200 more than 50 and 25 Gbps, the AP 5200 more than 125 and more than 62.5 Gbps. Larger units take 10G, 40G and 100G optics. Each appliance streams Zeek logs, Suricata alerts, YARA results and Smart PCAP to your SIEM or the Investigator console. Sizing, supply and commissioning are ICWT's job.

Security

Enterprise-grade protection compliant with regulatory requirements and security standards

Performance

Fast deployment with minimal resource overhead

Support

Dedicated support from a certified partner

Integration

Easy integration with your existing infrastructure

Key features

  • Five models, throughput per Corelight: AP 220 up to 4 Gbps (2 Gbps with Zeek, Suricata and Smart PCAP), AP 620 up to 10 Gbps (5 Gbps), AP 1200 up to 25 Gbps (12.5 Gbps), AP 3200 more than 50 Gbps (25 Gbps), AP 5200 more than 125 Gbps (more than 62.5 Gbps)
  • Copper and optical interfaces from 100M and 1G up to 8 x 10G, 2 x 40G and 2 x 100G modules
  • Passive connection to a TAP or SPAN port with no impact on production traffic
  • The full evidence set: Zeek, Suricata, YARA, Smart PCAP and threat intelligence enrichment, at the lower of the two rated speeds
  • Managed and updated through Corelight Fleet Manager

Business benefits

  • Visibility into data center and internet edge traffic without agents on servers
  • A model sized to real throughput, with headroom for traffic growth
  • Vendor-supported hardware instead of a self-built server and hand-tuned Zeek
  • The same data format as virtual and cloud sensors, so the SOC works from one evidence set
  • Less to store: Corelight reports that integrated log reduction typically cuts data volume by 30 to 50 percent
Corelight

Why Corelight?

Corelight is an Open NDR platform that turns network traffic into evidence your SOC can act on: Zeek logs, Suricata alerts, YARA file analysis and selective packet capture with Smart PCAP. Appliance, virtual, software and cloud sensors feed that evidence into Corelight Investigator or your own SIEM, where AI/ML detections and Agentic Triage shorten investigations.

All products

Official product page

Learn more at Corelight

Ask about implementation

Contact our experts

Need Appliance Sensors in your organization?

As a certified Corelight partner, we'll help you deploy and configure the solution.

Book a free consultation
Back to Corelight