# Corelight Open NDR: how AI models rank it, November 2026

Gane Index, November 2026 Edition. Named in 33 judge labels across 1 category by 12 of 14 models. Page: https://www.gane.ai/index/it/vendors/corelight-open-ndr

## Standing by category

| Category | Share | Rank | Negative rate | Labels |
|---|---|---|---|---|
| [Network detection and response](https://www.gane.ai/index/it/security/network-detection-and-response/index.md) | 2% | 11 | 12% | 33 |

## What the models said for it

- "The best NDR platform for a company with a limited budget is Corelight or Cisco Secure Network Analytics." (Llama 4 Maverick, NDR)
- "Evidence- and hunting-oriented, built around Zeek network data... Threat-hunting teams that value detailed investigation, customization, and data portability." (GPT-6 Luna, NDR)
- "If budget = $0 for software, build on Zeek/Suricata-based open NDR such as Corelight Open NDR, accepting higher operational cost." (Muse Glimmer 30B, NDR)
- "Corelight provides open-core network evidence based on the open-source Zeek (formerly Bro) and Suricata platforms" (Claude Haiku 4.5, NDR)

## And against it

- "One reviewer cited limits on custom alerting and potentially significant costs for some cloud monitoring setups." (GPT-6 Luna, NDR)
- "over pricier alternatives like Vectra AI, Darktrace, ExtraHop Reveal(x), or Corelight" (Grok 4.20, NDR)
- "Originally IDS-focused; evaluate if you need full response capabilities" (Kimi K2, NDR)
- "Dated, non-intuitive UI — especially challenging for novice analysts" (Kimi K2, NDR)

## By model

| Model | First choice | Alternative | Mention | Warning | Labels |
|---|---|---|---|---|---|
| Claude Haiku 4.5 | 0 | 2 | 0 | 0 | 2 |
| GPT-5.4 mini | 0 | 1 | 0 | 0 | 1 |
| Gemini 3.5 Flash | 0 | 2 | 0 | 0 | 2 |
| Perplexity Sonar | 0 | 2 | 0 | 0 | 2 |
| Grok 4.20 | 0 | 4 | 0 | 1 | 5 |
| Mistral Small | 0 | 0 | 0 | 0 | 0 |
| DeepSeek V4 Flash | 0 | 2 | 0 | 0 | 2 |
| Llama 4 Maverick | 1 | 1 | 2 | 0 | 4 |
| Qwen 3.7 Flash | 0 | 2 | 1 | 0 | 3 |
| Kimi K2 | 0 | 2 | 1 | 2 | 5 |
| GLM 4.7 FlashX | 0 | 0 | 0 | 0 | 0 |
| MiniMax M2.5 | 0 | 1 | 0 | 0 | 1 |
| GPT-6 Luna | 0 | 2 | 0 | 1 | 3 |
| Muse Glimmer 30B | 0 | 2 | 1 | 0 | 3 |

## Sources returned with these answers

The sites and pages cited by the answers that named Corelight Open NDR, from 107 of the 111 answers that named it (only the models that return a source list).

### Domains cited

- ciopages.com: 56
- vectra.ai: 52
- g2.com: 43
- peerspot.com: 37
- stellarcyber.ai: 31
- cotocus.com: 25
- gartner.com: 25
- gane.ai/index: 22
- rajeshkumar.xyz: 22
- fidelissecurity.com: 21

### Pages cited

- https://ciopages.com/buyer-guides/network-detection-response: 56
- https://stellarcyber.ai/learn/top-ndr-solutions: 29
- https://rajeshkumar.xyz/blog/network-detection-and-response-ndr: 22
- https://g2.com/categories/network-detection-and-response-ndr/small-business: 21
- https://cybersecuritynews.com/best-ndr-solutions: 20
- https://fidelissecurity.com/threatgeek/network-security/top-network-detection-and-response-solutions: 20
- https://peerspot.com/categories/network-detection-and-response-ndr: 20
- https://cotocus.com/blog/top-10-network-detection-and-response-ndr-tools-in-2025-features-pros-cons-comparison: 16

## In its own words

What Corelight Open NDR's own pages state, read 2026-10-05. Stated by the vendor, not checked by the index.

- Positioning: Evidence-first, open-core NDR with AI-powered detection and Agentic Triage. (https://corelight.com/)
- For: null (https://corelight.com/support/security)
- Customers named: Carrefour, Education First

## What it publishes

Every page corelight.com exposes, read 2026-10-05: 756 addresses. By kind, pages and the last 90 days:

- blog: 319 pages, 30 in the last 90 days, latest 2026-09-29
- conference or event: 50 pages, 0 in the last 90 days, latest 2026-03-26
- comparison: 5 pages, 1 in the last 90 days, latest 2026-08-12
- glossary or explainer: 64 pages, 7 in the last 90 days, latest 2026-09-04
- podcast or video: 23 pages, 6 in the last 90 days, latest 2026-09-24
- news or press: 69 pages, 0 in the last 90 days, latest undated
- Recent: 2026-09-29 blog: Ai agent network forensics investigation https://corelight.com/blog/ai-agent-network-forensics-investigation
- Recent: 2026-09-28 blog: Hunting citrix netscaler zero days corelight https://corelight.com/blog/hunting-citrix-netscaler-zero-days-corelight
- Recent: 2026-09-25 blog: Pqc the upgrade nobody asked for https://corelight.com/blog/pqc-the-upgrade-nobody-asked-for
- Recent: 2026-09-25 blog: Canada raises bar for critical infrastructure cybersecurity https://corelight.com/blog/canada-raises-bar-for-critical-infrastructure-cybersecurity
- Recent: 2026-09-25 blog: Natural language query https://corelight.com/blog/natural-language-query
- Recent: 2026-09-24 blog: Water system attacks securing ot https://corelight.com/blog/water-system-attacks-securing-ot

## Record

- Method: https://www.gane.ai/index/it/methodology
- License: CC BY 4.0. Cite as Gane Index, November 2026 Edition, www.gane.ai/index/it.