Corelight typical implementation process:
Discovery & Planning: Assess network architecture, define monitoring goals, and select Corelight sensor models. This initial phase typically takes a few days.
Procurement & Licensing: Purchase required hardware sensors or deploy virtual/cloud sensors and obtain licenses, often in parallel with planning.
Physical/Virtual Installation: Position Corelight sensors (physical, virtual, or cloud), connect to network taps or SPAN ports, and power up hardware. On-site hardware deployment is typically completed in under an hour for standard cases, or up to a day for larger rollouts.
Configuration: Use the management UI or Fleet Manager for network, integration, and policy setup; configure log forwarding to SIEM/SOAR tools. This can be completed in hours to a couple of days, depending on the environment complexity.
Integration Testing: Validate data flow, log generation, and alerting with downstream security tools (e.g., SIEM, SOAR). This step generally requires a day or less.
Training & Handover: Provide basic or in-depth team training (standard offering: up to three days) and transition operations to SOC staff.
Corelight can be customized extensively to fit specific business needs across deployment, integration, network visibility, detection, and reporting.
Flexible Sensor Configuration: Corelight sensors and the management UI support custom configuration templates, enabling users to manage individual sensors, groups, or entire fleets tailored to diverse site or departmental requirements.
Runtime Log Tuning: Users can adjust the monitored protocols, logging levels, data retention, and filtering at runtime, optimizing log volume and targeting specific threats or flows relevant to business operations.
Custom Alert Rules: Custom rules can be created for advanced detection and alerting, using normalized data streams to trigger incident notifications fitting organizational risk policies.
Data Modeling & Integration: The platform supports extensive customization with data pipelines—log fields, mappings, and index settings can be tailored for ingestion by SIEMs like Splunk, Elastic, and LogScale, as well as for custom analytics pipelines.
Custom Dashboards & Analysis: Dashboards and enrichment fields can be personalized, allowing correlation of network data with enterprise threat intelligence, user identity, and asset context in downstream analytics tools.
Corelight provides training and support for new users, ensuring fast onboarding and ongoing operational success.
Expert-led Training Courses: New users can enroll in Corelight’s training programs, including one-day or in-depth three-day courses, designed for incident responders, threat hunters, SOC teams, and network engineers. These courses cover core topics such as sensor deployment, data interpretation, Suricata and Zeek integrations, REST API usage, fleet management, and advanced log analysis.
Hands-on Labs & Workshops: Training includes live labs, capture-the-flag exercises, and interactive scenarios, guiding users through real-world attack investigations and remediation workflows in both on-prem and cloud settings.
Resource Center & Self-paced Learning: Users have access to a comprehensive resource center with documentation, best practices, solution briefs, case studies, and video tutorials for continuous learning and reference.
Technical Account Management (TAM): Each subscription includes a TAM who serves as a strategic partner, ensuring effective deployment and acting as a direct advocate for customer needs with Corelight’s engineering and product teams.
Support Plans: Standard support (included by default) offers expert technical assistance, software upgrades, hardware replacement, and access to an online knowledge base. Enterprise support adds 24/7 coverage, priority response for critical issues, advanced hardware replacement, monthly TAM meetings, and direct escalation channels.
Corelight uses multiple layers of security to safeguard data, combining encryption, compliance certifications, threat detection, and network visibility for robust protection against advanced threats.
Encryption: All data is encrypted at rest and in transit, meeting FIPS 140-2 standards for cryptographic modules, ensuring sensitive information is protected during transmission and storage.
Threat Detection & Incident Response: Corelight deploys advanced network sensors leveraging Zeek and Suricata for deep packet inspection, flow analysis, and threat detection. Machine learning and analytics rapidly identify abnormal activity, malware, and sophisticated attacks.
Compliance Certifications: Corelight is SOC2 Type II and GDPR certified. Annual audits ensure continued operational effectiveness and adherence to established controls and international data privacy laws. Corelight also supports Standard Contractual Clauses (SCCs) for EU data transfers.
Data Loss Prevention: Custom scripts and analytic pipelines monitor for unauthorized or accidental data exfiltration, giving organizations visibility into the movement of personally identifiable information (PII) and sensitive business data.
Visibility & Monitoring: The platform offers complete network visibility and detailed protocol logs to uncover encrypted traffic, suspicious certificates, and policy compliance breaches. Security teams gain actionable evidence for investigations and compliance validation.
Corelight typically releases software updates several times per year, with critical detection content (such as the Suricata-based Corelight Feed) updated monthly, and urgent threat rules or patches released out-of-band as needed. Updates can be managed automatically via cloud-connected sensors or handled manually for offline/air-gapped deployments.
Monthly Threat Detection Updates: The proprietary Corelight Feed is distributed on a regular monthly cycle, delivering new and tuned rules for emerging threats. Out-of-band rapid response updates are released when critical vulnerabilities are found.
Major Feature Releases: Corelight delivers several software updates annually to expand detection capabilities, add protocol support, and enhance performance. New releases are announced in product updates and release notes.
Software Update Management: Updates can be automatically pushed to sensors connected to the Corelight Cloud Service (CCS), which checks for new rules and configurations hourly. For security-sensitive environments, offline update packages are available for manual installation.
Support Timeline: Customers receive support for each software release for six months after the next release is issued, with error patches and improvements prioritized by severity.
Corelight’s data ownership and portability policy is designed to provide customers with full control, privacy, and ease of export over their data throughout the engagement lifecycle.
Customers retain ownership of their data, including all network evidence and logs collected by Corelight Sensors under contract terms.
Corelight processes customer data only per customer instructions and does not “sell” or “share” any customer information, adhering fully to GDPR, CCPA, and other international privacy laws.
Corelight will retain personal or business data only as long as necessary to deliver contracted services. Upon contract termination (with standard provisions), all data is deleted or destroyed unless legal or regulatory constraints require extended retention.
Customers can export their data at any time during the contract using Corelight’s platform export capabilities, including dynamic exporters to SIEM, SOAR, cloud storage, or analytics systems (e.g., Elasticsearch, S3, JSON, syslog, Google SecOps).
Upon leaving the platform, customers are provided at least 30 days post-termination to export or retrieve their data through supported tools/portals.
Corelight's contract renewal and cancellation terms emphasize annual or multi-year subscription models, fee adjustments at renewal, defined notice periods for termination, and return obligations for hardware/software.
Corelight agreements typically cover an initial term (often 12 months) and automatically renew for equivalent periods unless terminated earlier per contract provisions.
Corelight reserves the right to increase fees at any time, effective at the time of renewal; fee changes are usually communicated before renewal.
Customers must provide written notice of non-renewal (commonly at least 30–60 days before renewal date); otherwise, the contract renews automatically.
Discounts or promotional pricing from the previous term do not carry forward automatically into renewals.
Renewal terms, fees, and conditions are outlined in the Master Customer Agreement or individual subscription documents.
Contracts may be terminated by either party, usually for convenience or for cause, with written notice; the typical notice period for termination is at least 30–60 days before the desired end date.
If terminated for cause (breach, failure to pay), Corelight reserves the right to end services immediately; customer obligations (regarding confidentiality and indemnity) often survive termination.
Specific agreements (e.g., evaluation, NFR, reseller) may allow termination with shorter notice periods (e.g., 5 days' written notice for evaluation agreements).
Upon termination or non-renewal, customers are required to return or securely destroy Corelight-provided hardware and software; written certification may be required for destruction of confidential information.
No refunds for prepaid subscriptions or cloud licenses unless specifically required by law or unique contract provisions; AWS Marketplace notes no refunds for Corelight Cloud Subscriptions.
All proprietary hardware and software must be returned to Corelight within the specified period after termination (commonly 5–14 days).
Corelight software meets several major international, federal, and industry-specific compliance standards, including SOC 2 Type II, GDPR, FIPS 140-2, HIPAA, PCI DSS, CMMC 2.0, and Common Criteria certification.
SOC 2 Type II: Audited annually to demonstrate operational effectiveness and robust controls for handling sensitive data; latest attestation completed in May 2024.
GDPR: Compliant for EU data privacy, with ongoing external audits. Utilizes standard contractual clauses for personal data transfer to the US.
FIPS 140-2: Certified for cryptographic protection of data at rest and in transit — applies to all Corelight network sensors.
HIPAA and PCI DSS: Adheres to health information and payment card industry compliance needs for organizations in regulated sectors.
CMMC 2.0: Meets stringent requirements for cybersecurity maturity and controls required for US defense and supply chain organizations.
Common Criteria: Certain modules (such as SFTP exporter) evaluated for Common Criteria (ISO 15408) certification. Compliance includes strict audit logging and security configuration protocols.
ISO 27001, SOX, NIST, CIS: Practices align with global security management, US federal, and investigative requirements, supporting frameworks such as ISO 27001, SOX, NIST, and CIS.
