Corelight Open NDR vs Trellix Network Detection and Response comparison

Corelight and Trellix are both solutions in the Network Detection and Response (NDR) category. Corelight is ranked #7 with an average rating of 8.5, while Trellix is ranked #13 with an average rating of 7.3. Corelight holds a 4.9% mindshare in NDaR, compared to Trellix’s 2.9% mindshare. Additionally, 100% of Corelight users are willing to recommend the solution, compared to 97% of Trellix users who would recommend it.

Corelight Open NDR

Read 7 Corelight Open NDR reviews

2,982 Views
2,535 Comparison Views

100% willing to recommend

Trellix Network Detection a...

Read 40 Trellix Network Detection and Response reviews

3,756 Views
1,164 Comparison Views

97% willing to recommend

Corelight Open NDR

Trellix Network Detection a...

Comparison Buyer's Guide

Download the report

Executive SummaryUpdated on Apr 22, 2026

Trellix Network Detection and Response and Corelight Open NDR compete in the network security domain. Corelight Open NDR has the upper hand in features, providing superior data analysis and visibility, which users find worth the cost.

Features: Trellix Network Detection and Response excels in advanced threat detection, notable for handling zero-day attacks, APTs, and robust malware identification. It integrates SIEM, IPS, and sandboxing effectively. Corelight Open NDR leverages open-source Zeek and integrates Suricata's IDS, providing detailed data analysis and visibility, a primary choice for forensic data analysis and cybersecurity.

Room for Improvement: Trellix's area for growth includes enhancing analytics and usability, along with providing better explanations and filtering capabilities. Corelight needs improvements in interface usability and a simplified architecture. The lack of a GUI in Corelight is an area users find needs enhancement, particularly for visualization.

Ease of Deployment and Customer Service: Trellix supports on-premises and hybrid cloud deployment, offering good customer service and responsive support. Corelight is recognized for quick deployment and effective service in on-premises and hybrid cloud scenarios, though its technical support responsiveness needs improvement.

Pricing and ROI: Corelight is viewed as affordable due to its open-source foundation. Trellix, while slightly more expensive with maintenance cost concerns, delivers a strong ROI in threat prevention. Corelight also offers significant ROI by preventing network-impacting attacks.

To learn more, read our detailed Corelight Open NDR vs. Trellix Network Detection and Response Report (Updated: April 2026).

Buyer's Guide

Corelight Open NDR vs. Trellix Network Detection and Response

April 2026

Download the complete report

Helped 893,244 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

Corelight Open NDR

Ranking in Network Detection and Response (NDR)

7th

Average Rating

8.8

Reviews Sentiment

7.6

Number of Reviews

Ranking in other categories

Network Traffic Analysis (NTA) (3rd)

Trellix Network Detection a...

Ranking in Network Detection and Response (NDR)

13th

Average Rating

8.4

Reviews Sentiment

7.3

Number of Reviews

Ranking in other categories

Advanced Threat Protection (ATP) (17th)

Mindshare comparison

As of May 2026, in the Network Detection and Response (NDR) category, the mindshare of Corelight Open NDR is 4.9%, down from 5.5% compared to the previous year. The mindshare of Trellix Network Detection and Response is 2.9%, up from 2.1% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Network Detection and Response (NDR) Mindshare Distribution
Product	Mindshare (%)
Corelight Open NDR	4.9%
Trellix Network Detection and Response	2.9%
Other	92.2%

Network Detection and Response (NDR)

Featured Reviews

reviewer2834367

Growth And Strategy Lead at a computer software company with 51-200 employees

Network visibility has transformed how we detect nation state threats and protect critical industry

Before Corelight recently started pushing some of the agentic features, querying at times could be a little difficult, depending on your mastery of log scale. However, I think with a lot of the artificial intelligence that they are building in, it is getting a lot easier to query in the platform. I would definitely encourage them to continue down that path where anybody can hop into the platform and start running queries, whether it is a simple instruction like I want this, and an artificial intelligence process can actually build the query and do it. I think that would be super powerful. Cyber skill sets are in high demand, and there is a huge backlog in cyber talent. We cannot fill all the positions we need. The easier we can make these cyber systems for people to pick up and be effective on, I think is really key. Explainability of data is hyper important. In the past few artificial intelligence related updates we have gotten from Corelight, that has been one of the first questions our team has asked every time or that I have asked: show me what the model is doing, show me how it came to this analysis. Within Investigator platform, they are able to walk through and see exactly what data the artificial intelligence pulled from where and why it did what it did as far as making its suggestions. They have definitely built their system with artificial intelligence in mind up front, and having that openness as one of the key features of any of their artificial intelligence and machine learning processes in the platform is important. The issue with black boxes is obviously hallucinations from artificial intelligence and just not being able to trace to ground truth. When we are talking about these cyber incidents and being able to do forensics, you need to be able to pinpoint and tie everything together, and black boxes really obscure that and prevent you from doing so. Corelight has done a really good job of making sure that everything is explainable and everything is mapped when it comes to leveraging any of their artificial intelligence features.

Read full review

Jose Vargas

Agente De Servicios Técnicos at a computer software company with 11-50 employees

Has improved threat detection workflows and supports seamless customer monitoring

The best features Trellix Network Detection and Response offers include very good threat detection, and I believe that it is one of the best XDR tools. For example, ePO and XDR components are very comfortable and similar to many other tools for this type of monitoring, and I have received very good feedback for this tool. What makes Trellix Network Detection and Response stand out for me compared to other tools is the way you can detect threats. It is very easy and comfortable to use, and the detection shows clearly on the screen, which is very easy to understand. Regarding the features, I think that the integration with other platforms is very comfortable with the customer because we can integrate it with any switch or firewall, and it is comfortable to add this tool. Trellix Network Detection and Response has positively impacted my organization as I have improved my knowledge about detection and response. I have already used some other tools such as CrowdStrike and Umbrella, but Trellix is one of the best that I have tested. I believe that for my organization, Trellix has helped a lot with detection and supported our customers effectively. Trellix Network Detection and Response is a great tool that integrates with a lot of security tools such as Palo Alto, which is a good firewall. If you have these types of tools, your organization would benefit greatly.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"Corelight is easy to use."

"It is easy to deploy and easy to handle."

"Corelight makes much easier the remediation of cyber attacks; instead of facing a chaotic amount of logs, Corelight provides correlated metrics that allow pivoting to find, in seconds, all the data related to an alert, detection, or asset."

"It is easy to deploy and easy to handle."

"Technical support seems to be good."

"The most valuable feature is the embedded IDS from Suricata."

"Corelight Open NDR has had a positive impact on my company, providing visibility as the Suricata engine can scan huge volumes of traffic, including north-south and east-west, revealing signatures and exposures I was not expecting and enabling me to catch them with Suricata alerts."

"Our company has seen massive improvements in cybersecurity position for our clients."

More Corelight Open NDR pros

"The solution has allowed for growth and improvement in our information security and security operations teams."

"Improved our systems and our customers' by providing better malware protection, defense against zero-day threats, and improved network security."

"There are sandbox capabilities; you can submit malicious files and get great feedback, including if there is malware and what it is doing, and it can give you simulations in different operating systems and applications to provide real insights from the perspective of a real environment."

"The sandbox feature of FireEye Network Security is very good. The operating system itself has many features and it supports our design."

"Its ability to find zero-day threats, malware and anything malicious has greatly improved my customer's organization, especially for protecting the users' browser."

"It is a good product to implement, especially where the existing technology fails to detect zero day attacks."

"Initially, we didn't have much visibility around what is occurring at our applications lower level. For instance, if we are exposed to any malicious attacks or SQL injections. But now we've integrated FireEye with Splunk, so now we get lots of triggers based on policy content associated with FireEye. The solution has allowed for growth and improvement in our information security and security operations teams."

"Because of what the FireEye product does, it has significantly decreased our meantime in being able to identify and detect malicious threats."

More Trellix Network Detection and Response pros

Cons

"Machine learning could be a good improvement, but it's very costly."

"In the next release, building a graphical user interface would be helpful."

"Before Corelight recently started pushing some of the agentic features, querying at times could be a little difficult, depending on your mastery of log scale."

"They can enhance the interface of the product. They can make it more interactive and also easier to use for feature access."

"Corelight hasn’t added features in a long time."

"Machine learning could be a good improvement, but it's very costly."

"They can enhance the interface of the product. They can make it more interactive and also easier to use for feature access."

"It's an expensive solution and the price could be reduced."

More Corelight Open NDR cons

"I heard that FireEye recently was hacked, and a lot of things were revealed."

"I would love to see better reporting. Because you can't export some of the reports in proper formats, it is hard to extract the data from reports."

"Its documentation can be improved. The main problem that I see with FireEye is the documentation."

"The pricing is not reasonable. The user fee is not as high but the maintenance fee is expensive."

"The initial setup was complex because of the nature of our environment. When it comes to the type of applications and functions which we were looking at in terms of identifying malicious threats, there would be some level of complexity, if we were doing it right."

"FireEye Network Security should have better integration with other vendors' firewalls or proxies, such as Palo Alto and Fortinet. Files that are being submitted should happen through the API or automatically."

"Cybersecurity posture has room for improvement."

"It would be very helpful if there were better integration with other solutions from other vendors, such as Fortinet and Palo Alto."

More Trellix Network Detection and Response cons

Pricing and Cost Advice

"It's a yearly fee and depends on what you are looking for."

"The user fee is not as high but the maintenance fee is expensive."

"There are some additional services that I understand the vendor provides, but our approach was to package all of the features that we were looking to use into the product."

"Because of what the FireEye product does, it has significantly decreased our mean time in being able to identify and detect malicious threats. The company that I work with is a very mature organization, and we have seen the meantime to analysis decrease by at least tenfold."

"We're partners with Cisco so we get a reasonable price. It's cheaper than Palo Alto in terms of licensing."

"Its price is a bit high. A small customer cannot buy it. Its licensing is on a yearly basis."

"The pricing is a little high."

"Pricing and licensing are reasonable compared to competitors."

"When I compare this solution to its competitors in the market, I find that it is a little expensive."

More Trellix Network Detection and Response pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Network Detection and Response (NDR) solutions are best for your needs.

See recommendations

893,244 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Financial Services Firm

12%

Government

12%

Real Estate/Law Firm

Computer Software Company

Financial Services Firm

14%

Comms Service Provider

12%

Manufacturing Company

11%

Government

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

By reviewers
Company Size	Count
Small Business	4
Midsize Enterprise	2
Large Enterprise	1

By reviewers
Company Size	Count
Small Business	20
Midsize Enterprise	8
Large Enterprise	19

Questions from the Community

Ask a question

Earn 20 points

What do you like most about FireEye Network Security?

We wanted to cross-reference that activity with the network traffic just to be sure there was no lateral movement. With Trellix, we easily confirmed that there was no lateral network involvement an...

See all answers

What is your experience regarding pricing and costs for FireEye Network Security?

My experience with pricing, setup cost, and licensing for Trellix Network Detection and Response is very great.

See all answers

What needs improvement with FireEye Network Security?

I would like to see in Trellix Network Detection and Response more explanation about some details of the threat, and I wish it had more actions that you can take to contain the host or move it some...

See all answers

Comparisons

Darktrace vs Corelight Open NDR

Compared 23% of the time

ExtraHop Reveal(x) vs Corelight Open NDR

Compared 11% of the time

Vectra AI vs Corelight Open NDR

Compared 11% of the time

NetWitness NDR vs Corelight Open NDR

Compared 8% of the time

Arista NDR vs Corelight Open NDR

Compared 3% of the time

More Corelight Open NDR Competitors

Palo Alto Networks WildFire vs Trellix Network Detection and Response

Compared 6% of the time

Fortinet FortiSandbox vs Trellix Network Detection and Response

Compared 6% of the time

Vectra AI vs Trellix Network Detection and Response

Compared 4% of the time

Darktrace vs Trellix Network Detection and Response

Compared 3% of the time

Hillstone Cloud Sandbox vs Trellix Network Detection and Response

Compared 3% of the time

More Trellix Network Detection and Response Competitors

Product Reports

Buyer's Guide

Corelight Open NDR

May 2026

Download Corelight Open NDR product report

Buyer's Guide

Trellix Network Detection and Response

April 2026

Trellix Network Detection and Response report

Download Trellix Network Detection and Response product report

Also Known As

Corelight Open NDR

FireEye Network Security, FireEye

Overview

Corelight Open NDR delivers rapid deployment, essential insight, and data for cybersecurity. Known for ease of use, cost-effectiveness, and open-source Zeek code, it enhances security by streamlining traffic monitoring and integrating with threat feeds.

Corelight Open NDR offers organizations enhanced network security and visibility, utilizing physical sensors in addition to cloud, virtual, and software variants. It supports incident response with packet capture sampling, monitoring internet, data center, and LAN traffic while facilitating east-west traffic identification. Despite its complexity, users suggest architectural simplifications and a graphical interface to boost usability and reduce costs. Features like Smart PCAP and service catalogs contribute positively, but an interactive interface with more seamless feature access is desired.

What Are Corelight Open NDR's Key Features?

Quick Deployment: Allows rapid implementation in varied environments.
Comprehensive Insight: Offers in-depth data and visibility for effective cybersecurity.
Ease of Handling: Designed for simplicity and cost-efficiency in complex networks.
Open-Source Zeek Code: Provides transparency and flexibility in operations.
Integrated Threat Feeds: Streamlines threat detection and analysis.
Suricata IDS: Enhances existing security frameworks effectively.
Custom Dashboards: Enables tailored task-specific visualizations.

What Benefits Should Users Consider?

Cost-Effectiveness: Delivers impressive cybersecurity capabilities at a competitive price.
Scalability: Offers solutions from physical to cloud-based implementations.
Enhanced Security: Strengthens incident response and threat detection efforts.
Ease of Use: Simplifies complex security processes for improved efficiency.

Primarily utilized by organizations to bolster network security, Corelight Open NDR is deployed in various sectors to increase visibility and streamline incident response. Its deployment spans physical, cloud, virtual, and software models, focusing on comprehensive packet capture sampling for effective traffic monitoring. Across industries, it serves managed services by identifying lateral network traffic, optimizing internet, data center, and LAN performance.

Corelight

Trellix Network Detection and Response provides robust threat protection with advanced detection of zero-day attacks and APTs. Its user-friendly dashboard and real-time response capabilities enhance security and visibility across networks.

Trellix Network Detection and Response stands out with its MVX engine, leveraging virtual machines for comprehensive behavioral analysis. The solution supports detection of advanced cyber threats through features like sandboxing and application filtering, offering real-time response and packet capture for detailed contextual insights. Companies benefit from seamless integration with other platforms, enhancing usability and overall protection. User-friendly interfaces improve network visibility, while stability and ease of configuration safeguard against both signature-based and signature-less threats.

What key features does Trellix offer?

Zero-Day Attacks Detection: Identifies and mitigates unknown threats.
APTs Detection: Detects advanced persistent threats through sophisticated techniques.
MVX Engine: Uses virtual machines for behavioral analysis.
Sandboxing: Adds a layer of threat protection.
Real-Time Response: Offers immediate threat mitigation and context.
User-Friendly Dashboard: Enhances visibility with application filtering.

What are the benefits of Trellix Network Detection and Response?

Enhanced Usability: Integrates easily with other platforms for seamless operations.
Detailed Context: Real-time packet capture provides in-depth threat analysis.
Comprehensive Threat Protection: Covers both signature-based and signature-less threats.
Improved Visibility: Offers clear dashboard analytics for network monitoring.

Companies in sectors like finance, healthcare, and enterprise security utilize Trellix Network Detection and Response for tasks such as network intrusion detection, endpoint protection, and securing data transmission paths. It aids in threat investigations, pre-sales demos, and network forensics, reducing risks by protecting against cyber threats like phishing.

Trellix

Sample Customers

CarrefourEdnonGrand Canyon EducationSektorCERTTietoevryVolkswagen Financial Services

FFRDC, Finansbank, Japan Advanced Institute of Science and Technology, Investis, Kelsey-Seybold Clinic, Bank of Thailand, City of Miramar, Citizens National Bank, D-Wave Systems

Buyer's Guide

Corelight Open NDR vs. Trellix Network Detection and Response

April 2026

Free Report: Corelight Open NDR vs. Trellix Network Detection and Response

Find out what your peers are saying about Corelight Open NDR vs. Trellix Network Detection and Response and other solutions. Updated: April 2026.

DOWNLOAD NOW

893,244 professionals have used our research since 2012.

See our Corelight Open NDR vs. Trellix Network Detection and Response report.

See our list of best Network Detection and Response (NDR) vendors.

We monitor all Network Detection and Response (NDR) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.