No more typing reviews! Try our Samantha, our new voice AI agent.

Corelight Open NDR vs Exabeam comparison

Why PeerSpot?
Sponsored
 

Comparison Buyer's Guide

Executive Summary

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Cortex XDR by Palo Alto Net...
Sponsored
Ranking in AI-Powered Cybersecurity Platforms
1st
Average Rating
8.4
Reviews Sentiment
6.7
Number of Reviews
118
Ranking in other categories
Endpoint Protection Platform (EPP) (4th), Endpoint Detection and Response (EDR) (5th), Extended Detection and Response (XDR) (3rd), Ransomware Protection (2nd)
Corelight Open NDR
Ranking in AI-Powered Cybersecurity Platforms
12th
Average Rating
8.8
Reviews Sentiment
7.6
Number of Reviews
7
Ranking in other categories
Intrusion Detection and Prevention Software (IDPS) (19th), Network Traffic Analysis (NTA) (4th), Network Detection and Response (NDR) (7th)
Exabeam
Ranking in AI-Powered Cybersecurity Platforms
10th
Average Rating
7.8
Reviews Sentiment
6.6
Number of Reviews
21
Ranking in other categories
Security Information and Event Management (SIEM) (20th), User Entity Behavior Analytics (UEBA) (2nd), Security Incident Response (8th), Threat Intelligence Platforms (TIP) (11th), Security Orchestration Automation and Response (SOAR) (11th)
 

Mindshare comparison

As of October 2026, in the AI-Powered Cybersecurity Platforms category, the mindshare of Cortex XDR by Palo Alto Networks is 12.1%, up from 12.0% compared to the previous year. The mindshare of Corelight Open NDR is 2.1%, down from 5.2% compared to the previous year. The mindshare of Exabeam is 4.2%, up from 2.9% compared to the previous year. It is calculated based on PeerSpot user engagement data.
AI-Powered Cybersecurity Platforms Mindshare Distribution
ProductMindshare (%)
Cortex XDR by Palo Alto Networks12.1%
Exabeam4.2%
Corelight Open NDR2.1%
Other81.6%
AI-Powered Cybersecurity Platforms
 

Featured Reviews

ABHISHEK_SINGH - PeerSpot reviewer
Senior Process Expert at A.P. Moller - Maersk
Gained full visibility and streamlined threat detection through behavior-based insights and AI integration
Initially, we got to have a lot of false positives when we onboarded, but nowadays it's quite smooth. We have fine-tuned our security policies and allowed different levels of policies to get rid of those false positives. Currently, we are getting a fairly good amount of incidents that are not false positives or benign, but actionable items. The process is streamlined. In the initial days, the operations used to get involved in a lot of benign and other activities, but now the process is streamlined. We are leveraging the auto-detection and remediation plans. The operations teams are now more involved in other business roles as well, not just looking into the logs and fetching out what's happening there. They have fixed a lot of things. Initially, they didn't have IAC code drift detection, cloud posture management, or security posture management, but they have those now. They purchased different vendors and did a merger with that. They have now Prisma Cloud that gets integrated and now they are working with Cortex Cloud. Everything that was negative has now been addressed, and the product altogether looks to be in a very better and mature shape now. Currently, it's more or less detecting the workloads with AI-based best practices. Since most organizations are consuming AI agents and other things, we are looking forward to seeing what other feature enhancements Palo Alto can support in that.
reviewer2834367 - PeerSpot reviewer
Growth And Strategy Lead at a computer software company with 51-200 employees
Network visibility has transformed how we detect nation state threats and protect critical industry
Before Corelight recently started pushing some of the agentic features, querying at times could be a little difficult, depending on your mastery of log scale. However, I think with a lot of the artificial intelligence that they are building in, it is getting a lot easier to query in the platform. I would definitely encourage them to continue down that path where anybody can hop into the platform and start running queries, whether it is a simple instruction like I want this, and an artificial intelligence process can actually build the query and do it. I think that would be super powerful. Cyber skill sets are in high demand, and there is a huge backlog in cyber talent. We cannot fill all the positions we need. The easier we can make these cyber systems for people to pick up and be effective on, I think is really key. Explainability of data is hyper important. In the past few artificial intelligence related updates we have gotten from Corelight, that has been one of the first questions our team has asked every time or that I have asked: show me what the model is doing, show me how it came to this analysis. Within Investigator platform, they are able to walk through and see exactly what data the artificial intelligence pulled from where and why it did what it did as far as making its suggestions. They have definitely built their system with artificial intelligence in mind up front, and having that openness as one of the key features of any of their artificial intelligence and machine learning processes in the platform is important. The issue with black boxes is obviously hallucinations from artificial intelligence and just not being able to trace to ground truth. When we are talking about these cyber incidents and being able to do forensics, you need to be able to pinpoint and tie everything together, and black boxes really obscure that and prevent you from doing so. Corelight has done a really good job of making sure that everything is explainable and everything is mapped when it comes to leveraging any of their artificial intelligence features.
reviewer2265966 - PeerSpot reviewer
Enterprise Account Manager South at a outsourcing company with 201-500 employees
Advanced analytics have transformed our threat detection and streamlined incident investigations
I would appreciate seeing additional dashboards in Exabeam Fusion SIEM or perhaps more options or the ability to customize them further. While we can customize them currently, there may be additional options available. I value the outcomes navigator because it matches the log piece to the use cases, which is helpful. The correlation rules are excellent. I am interested in whether there are additional threat intelligence feeds available that we could use, whether we can integrate our own, or if we could ingest different ones.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"If you are looking to deploy a security solution as a whole, this is a good option."
"Once you become familiar with it, Cortex XDR by Palo Alto Networks is a more powerful tool and I would say that I prefer it over MDE because it is a stronger tool for me."
"The stability is pretty good except for one or two cases, and based on the performance, it's been okay with pretty high performance, no bugs or glitches, and it doesn't crash or freeze."
"It'll not slow down your system when compared to others."
"The initial setup isn't too bad."
"Cortex XDR by Palo Alto Networks saves time in various ways, although the user interface is fairly standard."
"One of the things that I enjoy the most is using policy extensions. It's like having host firewalls to control USB connections. I think it's a wonderful tool to restrict use when connecting to our computers. Another important tool is Home Insights. That is an add-on to the Cortex solution. I like that because we can see all the vulnerabilities in the environment and control what assets are connected to our network."
"I like that the product has behavior-based detection which offers many benefits over signature-based detection."
"Corelight makes much easier the remediation of cyber attacks; instead of facing a chaotic amount of logs, Corelight provides correlated metrics that allow pivoting to find, in seconds, all the data related to an alert, detection, or asset."
"It is easy to deploy and easy to handle."
"The most valuable feature is the embedded IDS from Suricata."
"It's an easy way for us to get visibility in a client's environment."
"Corelight Open NDR has had a positive impact on my company, providing visibility as the Suricata engine can scan huge volumes of traffic, including north-south and east-west, revealing signatures and exposures I was not expecting and enabling me to catch them with Suricata alerts."
"Technical support seems to be good."
"Our company has seen massive improvements in cybersecurity position for our clients."
"It's easy to create additional dashboards specific to supporting specific tasks."
"It's a very user-friendly product and it's a very comprehensive technology."
"Exabeam is very easy to use, with a straightforward platform and workflow, unlike other tools that require more expertise."
"Overall, this is a fantastic tool and it is one of the best SIEMs that I've come across."
"The most valuable feature of Exabeam is the timeline creation based on log sources, which helps in security investigations."
"The advanced analytics has a really great overview of user behavior."
"I have customers that like the EUBA functionality of it; the solution has the ability to build a session, basically, pulling a lot of information together, for example, everything a user does in a specific timeframe, which is quite helpful."
"The platform is not extremely expensive compared to its direct competitors; I would rate its pricing around six out of ten."
"The way it can connect with AWS is very useful, and the integrations are pretty good."
 

Cons

"Cortex XDR by Palo Alto Networks can improve mobile integration to allow access to the console."
"Being able to filter the events to see those that are related to the actual alert would save time spent by the engineer."
"The product's pricing needs improvement. They could provide more discounts. Additionally, the dashboard and control panel could be enhanced."
"Cortex does not offer an on-premises solution. However, some customers would prefer not to be on the cloud. It would be ideal if it could offer something on-prem as well."
"There's room for improvement with Mac device installations, which can be challenging."
"While using Cortex, I noticed some aspects that could be improved, such as increasing the synchronization speed between XDR and Xnor."
"A potential area of improvement for Cortex XDR by Palo Alto Networks is the cost."
"The solution needs better reports. I think they should let the customer go in and customize the reports."
"It's an expensive solution and the price could be reduced."
"In the next release, building a graphical user interface would be helpful."
"Corelight hasn’t added features in a long time."
"Machine learning could be a good improvement, but it's very costly."
"The solution’s architecture is complex and difficult to understand. There are multiple machines and VMs."
"They can enhance the interface of the product. They can make it more interactive and also easier to use for feature access."
"Before Corelight recently started pushing some of the agentic features, querying at times could be a little difficult, depending on your mastery of log scale."
"One area for the solution's improvement is integration capabilities, particularly out-of-the-box integration which sometimes requires additional professional services."
"Exabeam's integration capabilities are not good, as Exabeam has a very limited number of integrations and no out-of-box integration, which is an area where Exabeam should improve."
"Exabeam should be a bit faster, especially in loading and vulnerability scanning."
"We had a large volume right from the beginning and they weren't quite prepared for that. That's something that they should think about when it comes to customers that have a large volume to start off with."
"I tried to send an email, however, no one has replied."
"One area that needs improvement is interacting with Exabeam's API. There was a headache regarding the API; the documentation wasn't clear, and the syntax wasn't very precise."
"Exabeam lacks customizable dashboards, which might be a limitation if visualization is a key requirement."
"Adding to the number of certifications that they have, for example, ISO 27001, would be helpful. Currently, they only have SOC 2."
 

Pricing and Cost Advice

"The cost depends on your chosen license type, like Pro or other licenses."
"Cortex XDR by Palo Alto Networks is an expensive solution."
"I am using the Community edition."
"The solution has one subscription for endpoint protection and one subscription for detection and response. The two licenses combined give you the BRO version."
"Our license will require renewal in August, after which the maintenance will continue as usual."
"It is cost-effective compared to similar solutions. It fits for the small businesses through to the big businesses."
"The tool's price is moderate."
"Traps pays for itself within the first 16 months of a three-year subscription. This is attributed to OPEX savings, as security teams spent less time trying to identify and isolate malware for analysis as a result of a reduction in malware incidents, false positives, and breach avoidance."
"It's a yearly fee and depends on what you are looking for."
"Exabeam Fusion SIEM's pricing is reasonable."
"They have a great model for pricing that can be based either on user count or gigabits per day."
"Exabeam is not a cheap solution."
"The platform is not extremely expensive compared to its direct competitors; I would rate its pricing around six out of ten."
"The solution is expensive."
"There is an annual license required to use Exabeam Fusion SIEM. The price of the solution should be reduced."
report
Use our free recommendation engine to learn which AI-Powered Cybersecurity Platforms solutions are best for your needs.
915,341 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Outsourcing Company
12%
Comms Service Provider
12%
Construction Company
11%
Manufacturing Company
10%
Financial Services Firm
12%
Government
9%
Real Estate/Law Firm
7%
Computer Software Company
7%
Financial Services Firm
11%
Manufacturing Company
10%
Comms Service Provider
8%
Construction Company
8%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business47
Midsize Enterprise21
Large Enterprise55
By reviewers
Company SizeCount
Small Business4
Midsize Enterprise2
Large Enterprise1
By reviewers
Company SizeCount
Small Business12
Midsize Enterprise5
Large Enterprise7
 

Questions from the Community

Cortex XDR by Palo Alto vs. Sentinel One
Cortex XDR by Palo Alto vs. SentinelOne SentinelOne offers very detailed specifics with regard to risks or attacks. ...
Comparing CrowdStrike Falcon to Cortex XDR (Palo Alto)
Cortex XDR by Palo Alto vs. CrowdStrike Falcon Both Cortex XDR and Crowd Strike Falcon offer cloud-based solutions th...
How is Cortex XDR compared with Microsoft Defender?
Microsoft Defender for Endpoint is a cloud-delivered endpoint security solution. The tool reduces the attack surface,...
What is your experience regarding pricing and costs for Corelight?
I have a fortunate experience with pricing, setup costs, and licensing of Corelight Open NDR, as being a principal ar...
What needs improvement with Corelight?
Corelight Open NDR does not need any improvements or additional features in the next releases. The product is excelle...
What is your primary use case for Corelight?
I have been using Corelight Open NDR solution for approximately three years. I leverage the Suricata engine heavily f...
What are the biggest differences between Securonix UEBA, Exabeam, and IBM QRadar?
It mostly depends on your use-cases and environment. Exabeam and Securonix have a stronger UEBA feature set, friendli...
What is your experience regarding pricing and costs for Exabeam Fusion SIEM?
I would say the pricing for Exabeam Fusion SIEM is not cost prohibitive, but it was a little more than I initially th...
What needs improvement with Exabeam Fusion SIEM?
I would appreciate seeing additional dashboards in Exabeam Fusion SIEM or perhaps more options or the ability to cust...
 

Also Known As

Cyvera, Cortex XDR, Palo Alto Networks Traps
Corelight Open NDR
No data available
 

Overview

 

Sample Customers

CBI Health Group, University Honda, VakifBank
CarrefourEdnonGrand Canyon EducationSektorCERTTietoevryVolkswagen Financial Services
Hulu, ADP, Safeway, BBCN Bank
Find out what your peers are saying about Corelight Open NDR vs. Exabeam and other solutions. Updated: September 2026.
915,341 professionals have used our research since 2012.