No more typing reviews! Try our Samantha, our new voice AI agent.

Corelight Open NDR vs Fortra's Tripwire Enterprise comparison

Why PeerSpot?
 

Comparison Buyer's Guide

Executive Summary

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Corelight Open NDR
Ranking in Intrusion Detection and Prevention Software (IDPS)
19th
Average Rating
8.8
Reviews Sentiment
7.6
Number of Reviews
7
Ranking in other categories
Network Traffic Analysis (NTA) (4th), Network Detection and Response (NDR) (7th), AI-Powered Cybersecurity Platforms (12th)
Fortra's Tripwire Enterprise
Ranking in Intrusion Detection and Prevention Software (IDPS)
20th
Average Rating
8.0
Reviews Sentiment
7.2
Number of Reviews
8
Ranking in other categories
No ranking in other categories
 

Mindshare comparison

As of October 2026, in the Intrusion Detection and Prevention Software (IDPS) category, the mindshare of Corelight Open NDR is 1.3%, down from 2.7% compared to the previous year. The mindshare of Fortra's Tripwire Enterprise is 2.1%, up from 1.3% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Intrusion Detection and Prevention Software (IDPS) Mindshare Distribution
ProductMindshare (%)
Corelight Open NDR1.3%
Fortra's Tripwire Enterprise2.1%
Other96.6%
Intrusion Detection and Prevention Software (IDPS)
 

Featured Reviews

reviewer2834367 - PeerSpot reviewer
Growth And Strategy Lead at a computer software company with 51-200 employees
Network visibility has transformed how we detect nation state threats and protect critical industry
Before Corelight recently started pushing some of the agentic features, querying at times could be a little difficult, depending on your mastery of log scale. However, I think with a lot of the artificial intelligence that they are building in, it is getting a lot easier to query in the platform. I would definitely encourage them to continue down that path where anybody can hop into the platform and start running queries, whether it is a simple instruction like I want this, and an artificial intelligence process can actually build the query and do it. I think that would be super powerful. Cyber skill sets are in high demand, and there is a huge backlog in cyber talent. We cannot fill all the positions we need. The easier we can make these cyber systems for people to pick up and be effective on, I think is really key. Explainability of data is hyper important. In the past few artificial intelligence related updates we have gotten from Corelight, that has been one of the first questions our team has asked every time or that I have asked: show me what the model is doing, show me how it came to this analysis. Within Investigator platform, they are able to walk through and see exactly what data the artificial intelligence pulled from where and why it did what it did as far as making its suggestions. They have definitely built their system with artificial intelligence in mind up front, and having that openness as one of the key features of any of their artificial intelligence and machine learning processes in the platform is important. The issue with black boxes is obviously hallucinations from artificial intelligence and just not being able to trace to ground truth. When we are talking about these cyber incidents and being able to do forensics, you need to be able to pinpoint and tie everything together, and black boxes really obscure that and prevent you from doing so. Corelight has done a really good job of making sure that everything is explainable and everything is mapped when it comes to leveraging any of their artificial intelligence features.
reviewer2093205 - PeerSpot reviewer
Senior Cybersecurity Analyst at a energy/utilities company with 1,001-5,000 employees
It has excellent scalability and allows you to execute custom COCR rules, letting you fine-tune agent monitoring
I'm using Tripwire Enterprise version 9.0. In my company, thirty to forty people use Tripwire Enterprise, mainly different types of engineers, governance, risk, compliance, and cybersecurity personnel. I advise people planning to use Tripwire Enterprise to take the training because the solution has a fairly complex interface. You can do a lot of work with it, but it isn't very easy. Tripwire Enterprise is a sophisticated tool. I rate the tool an eight on a scale of one to ten because it does an excellent job of handling the unique challenges of maintaining NERC CIP compliance and monitoring industrial controls.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"Corelight is easy to use."
"Technical support seems to be good."
"It is easy to deploy and easy to handle."
"It's easy to create additional dashboards specific to supporting specific tasks."
"It's an easy way for us to get visibility in a client's environment."
"Corelight Open NDR has had a positive impact on my company, providing visibility as the Suricata engine can scan huge volumes of traffic, including north-south and east-west, revealing signatures and exposures I was not expecting and enabling me to catch them with Suricata alerts."
"The most valuable feature is the embedded IDS from Suricata."
"Our company has seen massive improvements in cybersecurity position for our clients."
"The most valuable feature is integrity management. I had some discussions with service providers, and they also agreed."
"The product supports different platforms."
"The most valuable feature is the integrity, because if the file configuration has been modified this solution calculates a hash code of the file and, if someone has changed the file, the solution will recalculate the hash and the admin receives a notice that the file has been modified, by sending an email or an alert to the administrator that someone has modified, added, or deleted a line, not just in files but also in tables metadata and network device configurations."
"Its reporting features are great. It gives you an in-depth report. Its customization is also great, and it is working fine."
"What's most valuable in Tripwire Enterprise is the ability to execute custom COCR rules that lets me fine-tune how I monitor Linux and Windows agents."
"The most valuable feature is the integrity."
"I would recommend to anybody to try out Tripwire Enterprise."
"Even if you change a single word in Notepad, it will let you know whether it was added, removed, or modified."
 

Cons

"In the next release, building a graphical user interface would be helpful."
"Before Corelight recently started pushing some of the agentic features, querying at times could be a little difficult, depending on your mastery of log scale."
"It's an expensive solution and the price could be reduced."
"They can enhance the interface of the product. They can make it more interactive and also easier to use for feature access."
"The solution’s architecture is complex and difficult to understand. There are multiple machines and VMs."
"Corelight hasn’t added features in a long time."
"Machine learning could be a good improvement, but it's very costly."
"It needs more local support from the OEM side. It would be great if this can be improved."
"The main way that it can be improved is through better reporting."
"There are several errors when deploying this solution to AIX systems, but with the help of support, it can be done."
"A lot of network devices need a custom integration."
"The stability of Tripwire Enterprise has room for improvement, but it's about 75% what it should be already."
"The Windows online integration license needs to be improved."
"The deployment with certain systems can be difficult and it needs to be simplified."
"Cloud monitoring could be better. It would also be better if the company followed a pay-as-you-use model."
 

Pricing and Cost Advice

"It's a yearly fee and depends on what you are looking for."
"The licensing depends on the equipment, how many devices and the types of devices."
"Cloud monitoring could be better. It could also be cheaper. It would be better if the company followed a pay-as-you-use model."
"Tripwire is more expensive than Netwrix."
report
Use our free recommendation engine to learn which Intrusion Detection and Prevention Software (IDPS) solutions are best for your needs.
915,341 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Financial Services Firm
12%
Government
9%
Real Estate/Law Firm
7%
Computer Software Company
7%
Construction Company
17%
Manufacturing Company
10%
Comms Service Provider
10%
Computer Software Company
6%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business4
Midsize Enterprise2
Large Enterprise1
By reviewers
Company SizeCount
Small Business5
Large Enterprise3
 

Questions from the Community

What is your experience regarding pricing and costs for Corelight?
I have a fortunate experience with pricing, setup costs, and licensing of Corelight Open NDR, as being a principal architect, I get to sit outside of that conversation and just choose the best prod...
What needs improvement with Corelight?
Corelight Open NDR does not need any improvements or additional features in the next releases. The product is excellent at what it does, and I believe what they have done with it, taking an open-so...
What is your primary use case for Corelight?
I have been using Corelight Open NDR solution for approximately three years. I leverage the Suricata engine heavily for alerting on indicators of compromise as my main use case for this solution.
Ask a question
Earn 20 points
 

Also Known As

Corelight Open NDR
No data available
 

Overview

 

Sample Customers

CarrefourEdnonGrand Canyon EducationSektorCERTTietoevryVolkswagen Financial Services
1. Aetna 2. Adobe 3. ADP 4. Airbus 5. Amazon 6. American Express 7. Aon 8. ATT 9. Bank of America 10. Barclays 11. Baxter International 12. Bechtel 13. Boeing 14. Cisco Systems 15. CocaCola 16. Comcast 17. Dell 18. ETRADE 19. ExxonMobil 20. Ford Motor Company 21. General Electric 22. General Motors 23. Google 24. JPMorgan Chase 25. Kraft Foods 26. Lockheed Martin 27. McDonald's 28. Merck 29. Microsoft 30. Morgan Stanley 31. Nike 32. Oracle
Find out what your peers are saying about Corelight Open NDR vs. Fortra's Tripwire Enterprise and other solutions. Updated: September 2026.
915,341 professionals have used our research since 2012.