Skip to main content
Corelight
Open NDR sensors

Software Sensors

Software sensor for Linux and Kubernetes

Corelight Software Sensors deliver Open NDR as a package you install on your own Linux hardware or in a Kubernetes cluster. The sensor bundles Zeek, Suricata and Corelight's detection packages, parses dozens of protocols and handles up to 8 Gbps according to Corelight. ICWT checks the hardware requirements before the package goes onto your servers. Logs stream out over Kafka, JSON, Splunk, Redis and syslog. The software sensor fits branch offices, low-bandwidth sites, container platforms and any location without room for an appliance or a hypervisor. Its output matches the other sensor types, so it feeds the same SIEM and reports to the same Fleet Manager.

Security

Enterprise-grade protection compliant with regulatory requirements and security standards

Performance

Fast deployment with minimal resource overhead

Support

Dedicated support from a certified partner

Integration

Easy integration with your existing infrastructure

Key features

  • Installs on your own Linux hardware or in Kubernetes, up to 8 Gbps according to Corelight
  • Zeek, Suricata and Corelight detection packages in one bundle
  • Log streaming over Kafka, JSON, Splunk, Redis and syslog
  • Built-in detection, monitoring and threat intelligence enrichment
  • Same evidence format as appliance, virtual and cloud sensors, managed from Fleet Manager

Business benefits

  • Monitoring for branches and sites where neither an appliance nor a VM is an option
  • Runs on servers you already own instead of a new purchase
  • Live in minutes and scales by adding another instance
  • Uniform network evidence across hybrid and distributed environments
  • Less data in the SIEM: Corelight reports log volume 50 to 80 percent lower
Corelight

Why Corelight?

Corelight is an Open NDR platform that turns network traffic into evidence your SOC can act on: Zeek logs, Suricata alerts, YARA file analysis and selective packet capture with Smart PCAP. Appliance, virtual, software and cloud sensors feed that evidence into Corelight Investigator or your own SIEM, where AI/ML detections and Agentic Triage shorten investigations.

All products

Official product page

Learn more at Corelight

Ask about implementation

Contact our experts

Need Software Sensors in your organization?

As a certified Corelight partner, we'll help you deploy and configure the solution.

Book a free consultation
Back to Corelight