Corelight hasn’t added features in a long time.

The solution’s architecture is complex and difficult to understand. There's multiple machines and VMs. It’s size will increase the pricing to reflect the design. The solution should make it to one single platform with all the features.

They can enhance the interface of the product. They can make it more interactive and also easier to use for feature access.

We wanted Corelight to have service catalogs, and it seems they have done it this year. 

Al the beginning I was surprised that it didn't include Machine learning based detection, but after some months, I understand why. Our SIEM and our SOAR already includes Machine Learning detection, and Corelight already make behavior based detection as well as signature based detection. Everything in Corelight is useful, and adding ML to an NDR would just make it more expensive, and I'm not sure if it would really improve the final result since Corelight sees everything and ML can be used in other solutions.

Last release included Smart PCAP, a tool that makes PCAP storing easier (and more cost-effective).

It's an expensive solution and the price could be reduced.

They don't have a GUI. In the next release, building a graphical user interface would be helpful.