Corelight Open NDR vs Trellix Network Detection and Response comparison

Corelight and Trellix are both solutions in the Network Detection and Response (NDR) category. Corelight is ranked #7 with an average rating of 8.5, while Trellix is ranked #13 with an average rating of 7.3. Corelight holds a 4.9% mindshare in NDaR, compared to Trellix’s 2.9% mindshare. Additionally, 100% of Corelight users are willing to recommend the solution, compared to 97% of Trellix users who would recommend it.

Corelight Open NDR

Read 7 Corelight Open NDR reviews

2,982 Views
2,535 Comparison Views

100% willing to recommend

Trellix Network Detection a...

Read 40 Trellix Network Detection and Response reviews

3,756 Views
1,164 Comparison Views

97% willing to recommend

Corelight Open NDR

Trellix Network Detection a...

Comparison Buyer's Guide

Download the report

Executive SummaryUpdated on Apr 22, 2026

Trellix Network Detection and Response and Corelight Open NDR compete in the network security domain. Corelight Open NDR has the upper hand in features, providing superior data analysis and visibility, which users find worth the cost.

Features: Trellix Network Detection and Response excels in advanced threat detection, notable for handling zero-day attacks, APTs, and robust malware identification. It integrates SIEM, IPS, and sandboxing effectively. Corelight Open NDR leverages open-source Zeek and integrates Suricata's IDS, providing detailed data analysis and visibility, a primary choice for forensic data analysis and cybersecurity.

Room for Improvement: Trellix's area for growth includes enhancing analytics and usability, along with providing better explanations and filtering capabilities. Corelight needs improvements in interface usability and a simplified architecture. The lack of a GUI in Corelight is an area users find needs enhancement, particularly for visualization.

Ease of Deployment and Customer Service: Trellix supports on-premises and hybrid cloud deployment, offering good customer service and responsive support. Corelight is recognized for quick deployment and effective service in on-premises and hybrid cloud scenarios, though its technical support responsiveness needs improvement.

Pricing and ROI: Corelight is viewed as affordable due to its open-source foundation. Trellix, while slightly more expensive with maintenance cost concerns, delivers a strong ROI in threat prevention. Corelight also offers significant ROI by preventing network-impacting attacks.

To learn more, read our detailed Corelight Open NDR vs. Trellix Network Detection and Response Report (Updated: April 2026).

Buyer's Guide

Corelight Open NDR vs. Trellix Network Detection and Response

April 2026

Download the complete report

Helped 893,244 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

Corelight Open NDR

Ranking in Network Detection and Response (NDR)

7th

Average Rating

8.8

Reviews Sentiment

7.6

Number of Reviews

Ranking in other categories

Network Traffic Analysis (NTA) (3rd)

Trellix Network Detection a...

Ranking in Network Detection and Response (NDR)

13th

Average Rating

8.4

Reviews Sentiment

7.3

Number of Reviews

Ranking in other categories

Advanced Threat Protection (ATP) (17th)

Mindshare comparison

As of May 2026, in the Network Detection and Response (NDR) category, the mindshare of Corelight Open NDR is 4.9%, down from 5.5% compared to the previous year. The mindshare of Trellix Network Detection and Response is 2.9%, up from 2.1% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Network Detection and Response (NDR) Mindshare Distribution
Product	Mindshare (%)
Corelight Open NDR	4.9%
Trellix Network Detection and Response	2.9%
Other	92.2%

Network Detection and Response (NDR)

Featured Reviews

reviewer2834367

Growth And Strategy Lead at a computer software company with 51-200 employees

Network visibility has transformed how we detect nation state threats and protect critical industry

Before Corelight recently started pushing some of the agentic features, querying at times could be a little difficult, depending on your mastery of log scale. However, I think with a lot of the artificial intelligence that they are building in, it is getting a lot easier to query in the platform. I would definitely encourage them to continue down that path where anybody can hop into the platform and start running queries, whether it is a simple instruction like I want this, and an artificial intelligence process can actually build the query and do it. I think that would be super powerful. Cyber skill sets are in high demand, and there is a huge backlog in cyber talent. We cannot fill all the positions we need. The easier we can make these cyber systems for people to pick up and be effective on, I think is really key. Explainability of data is hyper important. In the past few artificial intelligence related updates we have gotten from Corelight, that has been one of the first questions our team has asked every time or that I have asked: show me what the model is doing, show me how it came to this analysis. Within Investigator platform, they are able to walk through and see exactly what data the artificial intelligence pulled from where and why it did what it did as far as making its suggestions. They have definitely built their system with artificial intelligence in mind up front, and having that openness as one of the key features of any of their artificial intelligence and machine learning processes in the platform is important. The issue with black boxes is obviously hallucinations from artificial intelligence and just not being able to trace to ground truth. When we are talking about these cyber incidents and being able to do forensics, you need to be able to pinpoint and tie everything together, and black boxes really obscure that and prevent you from doing so. Corelight has done a really good job of making sure that everything is explainable and everything is mapped when it comes to leveraging any of their artificial intelligence features.

Read full review

Jose Vargas

Agente De Servicios Técnicos at a computer software company with 11-50 employees

Has improved threat detection workflows and supports seamless customer monitoring

The best features Trellix Network Detection and Response offers include very good threat detection, and I believe that it is one of the best XDR tools. For example, ePO and XDR components are very comfortable and similar to many other tools for this type of monitoring, and I have received very good feedback for this tool. What makes Trellix Network Detection and Response stand out for me compared to other tools is the way you can detect threats. It is very easy and comfortable to use, and the detection shows clearly on the screen, which is very easy to understand. Regarding the features, I think that the integration with other platforms is very comfortable with the customer because we can integrate it with any switch or firewall, and it is comfortable to add this tool. Trellix Network Detection and Response has positively impacted my organization as I have improved my knowledge about detection and response. I have already used some other tools such as CrowdStrike and Umbrella, but Trellix is one of the best that I have tested. I believe that for my organization, Trellix has helped a lot with detection and supported our customers effectively. Trellix Network Detection and Response is a great tool that integrates with a lot of security tools such as Palo Alto, which is a good firewall. If you have these types of tools, your organization would benefit greatly.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"It's an easy way for us to get visibility in a client's environment."

"Our company has seen massive improvements in cybersecurity position for our clients."

"Technical support seems to be good."

"The most valuable feature is the embedded IDS from Suricata."

"It's easy to create additional dashboards specific to supporting specific tasks."

"Corelight Open NDR has had a positive impact on my company, providing visibility as the Suricata engine can scan huge volumes of traffic, including north-south and east-west, revealing signatures and exposures I was not expecting and enabling me to catch them with Suricata alerts."

"Corelight makes much easier the remediation of cyber attacks; instead of facing a chaotic amount of logs, Corelight provides correlated metrics that allow pivoting to find, in seconds, all the data related to an alert, detection, or asset."

"It is easy to deploy and easy to handle."

More Corelight Open NDR pros

"Before FireEye, most of the times that an incident would happen nobody would be able to find out where or why the incident occurred and that the system is compromised. FireEye is a better product because if the incident already happened I know that the breach is there and that the system is compromised so we can take appropriate action to prevent anything from happening."

"The most valuable feature is the network security module."

"We see ROI in the sense that we don't have to react because it stops anything from hurting the network. We can stop it before we have a bigger mess to clean up."

"FireEye is so effective at blocking attacks that we were even able to defer an upgrade of our IPS solution, saving a significant amount of money."

"The most valuable feature of the solution stems from how it allows users to do the investigation part. Another important part of the product that is valuable is associated with how it gives information to users in the form of a storyline."

"The product has helped improve our organization by being easy to use and integrate, saving time, trouble, and money."

"The product has helped improve our organization by being easy to use and integrate. This saves time, trouble and money."

"Application categorization is the most valuable feature for us. Application filtering is very interesting because other products don't give you full application filtering capabilities."

More Trellix Network Detection and Response pros

Cons

"It's an expensive solution and the price could be reduced."

"Machine learning could be a good improvement, but it's very costly."

"They can enhance the interface of the product. They can make it more interactive and also easier to use for feature access."

"Machine learning could be a good improvement, but it's very costly."

"Before Corelight recently started pushing some of the agentic features, querying at times could be a little difficult, depending on your mastery of log scale."

"They can enhance the interface of the product. They can make it more interactive and also easier to use for feature access."

"The solution’s architecture is complex and difficult to understand. There are multiple machines and VMs."

"Corelight hasn’t added features in a long time."

More Corelight Open NDR cons

"A better depth of view, being able to see deeper into the management process, is what I'd like to see."

"Its documentation can be improved. The main problem that I see with FireEye is the documentation. We are an official distributor and partner of FireEye, and we have access to complete documentation about how to configure or implement this technology, but for customers, very limited documentation is available openly. This is the area in which FireEye should evolve. All documents should be easily available for everyone."

"It would be great if we could create granular reports based on the protocols, types of attacks, regions of attack, etc. Also we would like to easily be able to add exceptions to rules in cases of false positives."

"FireEye’s main feature is its sandboxing or threat emulation capabilities to detect malware with extra add-ons such as signature-based IPS or endpoint protection, but these features are lacking compared to most IPS or endpoint vendors."

"I heard that FireEye recently was hacked, and a lot of things were revealed. We would like FireEye to be more secure as an organization. FireEye has to be more protective because it is one of the most critical devices that we are using in our environment. They have a concept called SSL decryption, but that is only the packet address. We would like FireEye to also do a lot of decryption inside the packet. Currently, FireEye only does encryption and decryption of the header, but we would like them to do encryption and decryption of the entire packet."

"It doesn't connect with the cloud, advanced machine learning is not there. A known threat can be coming into the network and we would want the cloud to look up the problem. I would also like to see them develop more file replication and machine learning."

"We'd like the potential for better scaling."

"The initial setup was complex because of the nature of our environment."

More Trellix Network Detection and Response cons

Pricing and Cost Advice

"It's a yearly fee and depends on what you are looking for."

"When you purchase FireEye Network Security NX, will need to purchase a megabit per second package. You must know your needs from day one."

"We're partners with Cisco so we get a reasonable price. It's cheaper than Palo Alto in terms of licensing."

"The pricing is a little high."

"Its price is a bit high. A small customer cannot buy it. Its licensing is on a yearly basis."

"FireEye is comparable to other products, such as HX, but seems expensive. It may cause us to look at other products in the market."

"There are some additional services that I understand the vendor provides, but our approach was to package all of the features that we were looking to use into the product."

"The pricing is fair, a little expensive, but fair. We've evaluated other products, and they're similarly priced."

"The tool is a bit pricey."

More Trellix Network Detection and Response pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Network Detection and Response (NDR) solutions are best for your needs.

See recommendations

893,244 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Financial Services Firm

12%

Government

12%

Real Estate/Law Firm

Computer Software Company

Financial Services Firm

14%

Comms Service Provider

12%

Manufacturing Company

11%

Government

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

By reviewers
Company Size	Count
Small Business	4
Midsize Enterprise	2
Large Enterprise	1

By reviewers
Company Size	Count
Small Business	20
Midsize Enterprise	8
Large Enterprise	19

Questions from the Community

Ask a question

Earn 20 points

What do you like most about FireEye Network Security?

We wanted to cross-reference that activity with the network traffic just to be sure there was no lateral movement. With Trellix, we easily confirmed that there was no lateral network involvement an...

See all answers

What is your experience regarding pricing and costs for FireEye Network Security?

My experience with pricing, setup cost, and licensing for Trellix Network Detection and Response is very great.

See all answers

What needs improvement with FireEye Network Security?

I would like to see in Trellix Network Detection and Response more explanation about some details of the threat, and I wish it had more actions that you can take to contain the host or move it some...

See all answers

Comparisons

Darktrace vs Corelight Open NDR

Compared 23% of the time

ExtraHop Reveal(x) vs Corelight Open NDR

Compared 11% of the time

Vectra AI vs Corelight Open NDR

Compared 11% of the time

NetWitness NDR vs Corelight Open NDR

Compared 8% of the time

Arista NDR vs Corelight Open NDR

Compared 3% of the time

More Corelight Open NDR Competitors

Palo Alto Networks WildFire vs Trellix Network Detection and Response

Compared 6% of the time

Fortinet FortiSandbox vs Trellix Network Detection and Response

Compared 6% of the time

Vectra AI vs Trellix Network Detection and Response

Compared 4% of the time

Darktrace vs Trellix Network Detection and Response

Compared 3% of the time

Hillstone Cloud Sandbox vs Trellix Network Detection and Response

Compared 3% of the time

More Trellix Network Detection and Response Competitors

Product Reports

Buyer's Guide

Corelight Open NDR

May 2026

Download Corelight Open NDR product report

Buyer's Guide

Trellix Network Detection and Response

April 2026

Trellix Network Detection and Response report

Download Trellix Network Detection and Response product report

Also Known As

Corelight Open NDR

FireEye Network Security, FireEye

Overview

Corelight Open NDR delivers rapid deployment, essential insight, and data for cybersecurity. Known for ease of use, cost-effectiveness, and open-source Zeek code, it enhances security by streamlining traffic monitoring and integrating with threat feeds.

Corelight Open NDR offers organizations enhanced network security and visibility, utilizing physical sensors in addition to cloud, virtual, and software variants. It supports incident response with packet capture sampling, monitoring internet, data center, and LAN traffic while facilitating east-west traffic identification. Despite its complexity, users suggest architectural simplifications and a graphical interface to boost usability and reduce costs. Features like Smart PCAP and service catalogs contribute positively, but an interactive interface with more seamless feature access is desired.

What Are Corelight Open NDR's Key Features?

Quick Deployment: Allows rapid implementation in varied environments.
Comprehensive Insight: Offers in-depth data and visibility for effective cybersecurity.
Ease of Handling: Designed for simplicity and cost-efficiency in complex networks.
Open-Source Zeek Code: Provides transparency and flexibility in operations.
Integrated Threat Feeds: Streamlines threat detection and analysis.
Suricata IDS: Enhances existing security frameworks effectively.
Custom Dashboards: Enables tailored task-specific visualizations.

What Benefits Should Users Consider?

Cost-Effectiveness: Delivers impressive cybersecurity capabilities at a competitive price.
Scalability: Offers solutions from physical to cloud-based implementations.
Enhanced Security: Strengthens incident response and threat detection efforts.
Ease of Use: Simplifies complex security processes for improved efficiency.

Primarily utilized by organizations to bolster network security, Corelight Open NDR is deployed in various sectors to increase visibility and streamline incident response. Its deployment spans physical, cloud, virtual, and software models, focusing on comprehensive packet capture sampling for effective traffic monitoring. Across industries, it serves managed services by identifying lateral network traffic, optimizing internet, data center, and LAN performance.

Corelight

Trellix Network Detection and Response provides robust threat protection with advanced detection of zero-day attacks and APTs. Its user-friendly dashboard and real-time response capabilities enhance security and visibility across networks.

Trellix Network Detection and Response stands out with its MVX engine, leveraging virtual machines for comprehensive behavioral analysis. The solution supports detection of advanced cyber threats through features like sandboxing and application filtering, offering real-time response and packet capture for detailed contextual insights. Companies benefit from seamless integration with other platforms, enhancing usability and overall protection. User-friendly interfaces improve network visibility, while stability and ease of configuration safeguard against both signature-based and signature-less threats.

What key features does Trellix offer?

Zero-Day Attacks Detection: Identifies and mitigates unknown threats.
APTs Detection: Detects advanced persistent threats through sophisticated techniques.
MVX Engine: Uses virtual machines for behavioral analysis.
Sandboxing: Adds a layer of threat protection.
Real-Time Response: Offers immediate threat mitigation and context.
User-Friendly Dashboard: Enhances visibility with application filtering.

What are the benefits of Trellix Network Detection and Response?

Enhanced Usability: Integrates easily with other platforms for seamless operations.
Detailed Context: Real-time packet capture provides in-depth threat analysis.
Comprehensive Threat Protection: Covers both signature-based and signature-less threats.
Improved Visibility: Offers clear dashboard analytics for network monitoring.

Companies in sectors like finance, healthcare, and enterprise security utilize Trellix Network Detection and Response for tasks such as network intrusion detection, endpoint protection, and securing data transmission paths. It aids in threat investigations, pre-sales demos, and network forensics, reducing risks by protecting against cyber threats like phishing.

Trellix

Sample Customers

CarrefourEdnonGrand Canyon EducationSektorCERTTietoevryVolkswagen Financial Services

FFRDC, Finansbank, Japan Advanced Institute of Science and Technology, Investis, Kelsey-Seybold Clinic, Bank of Thailand, City of Miramar, Citizens National Bank, D-Wave Systems

Buyer's Guide

Corelight Open NDR vs. Trellix Network Detection and Response

April 2026

Free Report: Corelight Open NDR vs. Trellix Network Detection and Response

Find out what your peers are saying about Corelight Open NDR vs. Trellix Network Detection and Response and other solutions. Updated: April 2026.

DOWNLOAD NOW

893,244 professionals have used our research since 2012.

See our Corelight Open NDR vs. Trellix Network Detection and Response report.

See our list of best Network Detection and Response (NDR) vendors.

We monitor all Network Detection and Response (NDR) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.