Skip to main content
Corelight
Open NDR sensors

Virtual Sensors

VMware and Hyper-V, up to 8 Gbps (Corelight data)

Corelight Virtual Sensors run Open NDR as a virtual machine on VMware or Microsoft Hyper-V. The sensor needs two virtual network interfaces, one for management and one for monitoring, and analyzes up to 8 Gbps according to Corelight. It writes the same evidence as the appliances: Zeek logs for dozens of protocols, Suricata alerts, file analysis results and ML detections, with threat intelligence enrichment built in. Updates arrive automatically and Fleet Manager handles configuration. ICWT sizes the VM and sets up traffic mirroring with your virtualization admins. The virtual sensor suits branch offices, test environments and segments where traffic between VMs never reaches a physical switch.

Security

Enterprise-grade protection compliant with regulatory requirements and security standards

Performance

Fast deployment with minimal resource overhead

Support

Dedicated support from a certified partner

Integration

Easy integration with your existing infrastructure

Key features

  • VMware and Microsoft Hyper-V support, up to 8 Gbps of monitored traffic (Corelight data)
  • Two virtual interfaces: one for management, one for monitoring
  • Zeek logs, Suricata alerts, file analysis and ML detections, identical to the appliance output
  • Automatic updates and configuration through the Corelight Fleet Manager console
  • Built-in threat intelligence enrichment, the same as on the appliances

Business benefits

  • Visibility into VM-to-VM traffic that a physical sensor never sees
  • Live in minutes on an existing cluster, with nothing to buy or rack
  • The same evidence format as the rest of the fleet, so SOC playbooks work unchanged
  • Scale by adding another VM when traffic or segment count grows
  • Less data in the SIEM: Corelight reports log volume 50 to 80 percent lower
Corelight

Why Corelight?

Corelight is an Open NDR platform that turns network traffic into evidence your SOC can act on: Zeek logs, Suricata alerts, YARA file analysis and selective packet capture with Smart PCAP. Appliance, virtual, software and cloud sensors feed that evidence into Corelight Investigator or your own SIEM, where AI/ML detections and Agentic Triage shorten investigations.

All products

Official product page

Learn more at Corelight

Ask about implementation

Contact our experts

Need Virtual Sensors in your organization?

As a certified Corelight partner, we'll help you deploy and configure the solution.

Book a free consultation
Back to Corelight