Skip to main content
Corelight
Investigation and management

Fleet Manager

Central management of the Corelight sensor fleet

Corelight Fleet Manager is the central console for the whole sensor fleet, whether the sensors are appliances, virtual machines, software packages or cloud instances. Administrators build policy templates, apply baseline configurations to sensor groups and manage Zeek packages, Suricata rulesets, YARA rules and threat intelligence feeds from one place. Software upgrades and new packages roll out to chosen sensors in a coordinated way. A health dashboard shows CPU and memory use, log output rates, traffic throughput and connectivity alerts for each sensor. Role-based access works with LDAP, SAML, RADIUS and TACACS+, and every configuration change lands in an audit trail. Corelight reports that quick-start templates cut policy creation time by up to 80 percent. ICWT designs the group and template structure with your administrators.

Security

Enterprise-grade protection compliant with regulatory requirements and security standards

Performance

Fast deployment with minimal resource overhead

Support

Dedicated support from a certified partner

Integration

Easy integration with your existing infrastructure

Key features

  • Policy templates and baseline configurations applied to sensor groups across every sensor form factor
  • Central management of Zeek packages, Suricata rulesets, YARA rules and threat intelligence feeds
  • Coordinated sensor software updates rolled out to selected sensor groups
  • Fleet health dashboard: CPU, memory, log rates, throughput and connectivity alerts
  • Role-based access with LDAP, SAML, RADIUS and TACACS+ integration and a full audit trail

Business benefits

  • Consistent detection settings across headquarters, branches and cloud accounts
  • Less administration: Corelight reports up to 80 percent shorter policy creation with quick-start templates
  • A failing sensor shows on the dashboard before a network segment goes dark
  • The audit trail of configuration changes and user actions gives auditors the accountability they ask for
  • Connectors for CrowdStrike, Microsoft Defender and SentinelOne add endpoint context to network evidence
Corelight

Why Corelight?

Corelight is an Open NDR platform that turns network traffic into evidence your SOC can act on: Zeek logs, Suricata alerts, YARA file analysis and selective packet capture with Smart PCAP. Appliance, virtual, software and cloud sensors feed that evidence into Corelight Investigator or your own SIEM, where AI/ML detections and Agentic Triage shorten investigations.

All products

Official product page

Learn more at Corelight

Ask about implementation

Contact our experts

Need Fleet Manager in your organization?

As a certified Corelight partner, we'll help you deploy and configure the solution.

Book a free consultation
Back to Corelight