

Cisco Secure Network Analytics and Corelight Open NDR compete in the network security analytics category. Cisco Secure Network Analytics seems to have the upper hand due to its comprehensive integration capabilities and expansive feature set, bolstered by user feedback on robust analytics and threat protection.
Features: Cisco Secure Network Analytics provides extensive network maps, server and network response time monitoring, and excellent visibility via NetFlow data. The integration within Cisco's ecosystem offers unparalleled network visibility. Corelight Open NDR excels in threat detection using Suricata and integrates seamlessly with open-source tools like Zeek, offering detailed insights crucial for cybersecurity.
Room for Improvement: Cisco Secure Network Analytics could enhance its user interface and streamline reporting. Users desire better filtration and fewer false positives. Corelight Open NDR requires a more interactive interface, improved service catalogs, and a simpler architecture. There's also a need for advanced features and improved AI capabilities.
Ease of Deployment and Customer Service: Both solutions offer on-premises deployment; however, Corelight additionally provides hybrid cloud deployment. Cisco's technical support is generally well-regarded, yet some users cite inconsistencies in expertise. Corelight users report satisfaction with knowledgeable support addressing their concerns effectively.
Pricing and ROI: Cisco Secure Network Analytics is perceived as expensive with flow-based licensing contributing to costs, but users find it justifiable due to enhanced network visibility and reduced threat response times. Corelight Open NDR is more affordable due to its open-source nature, yet it's seen as costly compared to similar products. It offers solid ROI, particularly in initial cybersecurity investments, through efficient threat detection.
| Product | Mindshare (%) |
|---|---|
| Cisco Secure Network Analytics | 6.0% |
| Corelight | 5.0% |
| Other | 89.0% |


| Company Size | Count |
|---|---|
| Small Business | 11 |
| Midsize Enterprise | 7 |
| Large Enterprise | 52 |
Cisco Secure Network Analytics is a highly effective network traffic analysis (NTA) solution that enables users to find threats in their network traffic even if those threats are encrypted. It turns an organization’s network telemetry into a tool that creates a complete field of vision for the organization’s administrators. Users can find threats that may have infiltrated their systems and stop them before they can do irreparable harm.
Cisco Secure Network Analytics Benefits
A few ways that organizations can benefit by choosing to deploy Cisco Secure Network Analytics include:
Cisco Secure Network Analytics Features
Some of the many features that Cisco Secure Network Analytics offers include:
Reviews from Real Users
Cisco Secure Network Analytics is a solution that stands out even when compared to many other comparable products. Two major advantages that it offers are the way that it enables users to define the threshold at which the solution will issue a warning to administrators and the predefined alerts that it offers straight out of the box.
Gerald J., the information technology operations supervisor at Aboitiz Equity Ventures, Inc., writes, “StealthWatch lets me see the ports running in and out and the country. It has excellent reporting, telemetry, and artificial intelligence features. With the telemetry, I can set thresholds to detect sudden changes and the alarms go through the PLC parts. I can see all the ports running on that trunk.”
A senior security engineer at a tech services company, says, “Cisco Stealthwatch has predefined alerts for different types of security issues that might happen in the network. Whether it's PCs or servers that are used for botnets or Bitcoin mining we receive the alerts automatically. This functionality is what we receive from the solution out of the box.”
Corelight Open NDR delivers rapid deployment, essential insight, and data for cybersecurity. Known for ease of use, cost-effectiveness, and open-source Zeek code, it enhances security by streamlining traffic monitoring and integrating with threat feeds.
Corelight Open NDR offers organizations enhanced network security and visibility, utilizing physical sensors in addition to cloud, virtual, and software variants. It supports incident response with packet capture sampling, monitoring internet, data center, and LAN traffic while facilitating east-west traffic identification. Despite its complexity, users suggest architectural simplifications and a graphical interface to boost usability and reduce costs. Features like Smart PCAP and service catalogs contribute positively, but an interactive interface with more seamless feature access is desired.
What Are Corelight Open NDR's Key Features?Primarily utilized by organizations to bolster network security, Corelight Open NDR is deployed in various sectors to increase visibility and streamline incident response. Its deployment spans physical, cloud, virtual, and software models, focusing on comprehensive packet capture sampling for effective traffic monitoring. Across industries, it serves managed services by identifying lateral network traffic, optimizing internet, data center, and LAN performance.
We monitor all Network Detection and Response (NDR) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.