Cloud Sensors
Agentless network monitoring in AWS, Azure and GCP
Corelight Cloud Sensors bring Open NDR into AWS, Microsoft Azure and Google Cloud. The sensor receives a copy of traffic from each provider's native mechanism: Amazon VPC Traffic Mirroring, including through a Gateway Load Balancer, Azure Virtual TAP and Google Cloud Packet Mirroring, plus feeds from third-party packet brokers. The sensor enriches traffic with control plane data, maps cloud services to hosts and adds cloud-specific detections such as data exfiltration and service enumeration. Separate Flow Log Sensors turn flow records, for example from AWS S3 buckets or NetFlow sources, into Zeek logs with up to 90 percent data reduction (Corelight data). Corelight lists on-prem, SaaS, hybrid and multi-cloud deployment, and Fleet Manager holds the sensor configuration. ICWT designs the mirroring and stands up the sensors in your accounts.
Why Corelight?
Corelight is an Open NDR platform that turns network traffic into evidence your SOC can act on: Zeek logs, Suricata alerts, YARA file analysis and selective packet capture with Smart PCAP. Appliance, virtual, software and cloud sensors feed that evidence into Corelight Investigator or your own SIEM, where AI/ML detections and Agentic Triage shorten investigations.
Need Cloud Sensors in your organization?
As a certified Corelight partner, we'll help you deploy and configure the solution.