Corelight Tech Stack
Network detection and response platform built on Zeek, powering AI-driven SOC workflows
Corelight operates an open NDR platform that converts raw network telemetry into actionable security evidence. The stack reflects a mature detection-focused engineering org: Zeek and Suricata for packet analysis, Python for custom logic, Kafka and Elasticsearch for data pipelines, and Splunk for SIEM integration. Recent adoption of Agentforce, OpenAI, and Anthropic signals a shift toward AI-assisted threat hunting and automation—matching their stated focus on AI-driven detection. Sales velocity is accelerating with leadership hiring, but pain points around incident response delays and scaling data pipelines suggest the product is hitting performance boundaries as customers deploy at enterprise scale.
Tech Stack 79 technologies
What Corelight Is Building
◆Challenges
- Incident response delays
- Scaling internal infrastructure
- Stable high-performance releases
- Threat hunting
- Reliable delivery of actionable insights
- Complex multi-stakeholder enterprise sales cycles
- Scaling massive network data pipelines
- Systematizing product processes
- Complex technical challenges
- Network visibility gaps
▲Active Projects
- Open ndr platform release testing
- Siem query and dashboard implementation
- Area sales strategy
- Scalable test infrastructure
- Automated test suite development
- Custom threat hunting content development
- Soc/ir workflow automation playbooks
- High-performance api services
- Infrastructure as code implementation
- Integration test development
Hiring Activity
Department
Seniority
Notable leadership hires: Director of Sales
