SECURITY ATLAS / EVALUATION BRIEF Open NDR with Investigator Research reviewed: 2026-10-18 https://atlasofsecurity.com/landscape/vendors/corelight-investigator/ THE ATLAS TAKE Corelight Open NDR with Investigator is appealing for SOCs that want a commercial investigation workflow around structured network evidence. Its sensor lineage matters, but buying Investigator is not the same decision as installing open-source Zeek. Atlas would concentrate on whether an analyst can reproduce an assisted narrative from retained observations, then carry out a properly scoped response. Current product material emphasizes agentic triage, which raises the evidence bar rather than lowering it. Sensor collection, SaaS retention and integration authority must be visible in the quote and the evaluation. SCOPE The evaluated bundle is Corelight network sensors plus Investigator, not the open-source Zeek engine alone. Sensor type, collection licenses, retention, assisted-triage availability and downstream response integrations must be itemized. WORTH A LOOK WHEN Evidence-oriented SOCs that can validate structured network records and want an operated investigation interface. THINK TWICE WHEN The team expects a generated narrative to substitute for source evidence or assumes Zeek alone supplies the bundle. IMPLEMENTATION 1. Pin the evidence contract List sensor records, detection sources, ingest limits and searchable retention required for the pilot. 2. Use a claim-evidence review Ask analysts to support or reject each step of an assisted timeline using actual retained records. 3. Constrain response authority Test one expendable target with explicit approval, integration permissions, target-side audit and reversal. OPERATING REALITY The platform needs sensor coverage, ingest health and retained investigation data. Analysts must adjudicate assisted conclusions and maintain downstream integration permissions. Evidence volume is also an operations issue: unnecessary ingestion can consume resources, while aggressive filtering can remove context needed to challenge a later hypothesis. COMMERCIAL CONSIDERATIONS Quote sensors, collections and Investigator together with retention, assisted functions and integrations. Compare the complete operational bundle with open-source infrastructure and staffing requirements. - Sensor form factors and observed traffic - Licensed collections, ingest and Investigator retention - Response integrations and evidence operations EVALUATION PLAN / PROPOSED TESTS, NOT COMPLETED RESULTS 1. Reconstruct a synthetic lateral-movement timeline Acceptance evidence: Link every claim to timestamped network observations. Owner: __________ Pass criterion: __________ Observed result: __________ Evidence location: __________ 2. Challenge a deliberately unsupported narrative step Acceptance evidence: Record the missing evidence and analyst correction. Owner: __________ Pass criterion: __________ Observed result: __________ Evidence location: __________ 3. Trace an approved lab response Acceptance evidence: Preserve source case, integration authority and target-side reversal. Owner: __________ Pass criterion: __________ Observed result: __________ Evidence location: __________ QUESTIONS FOR THE VENDOR - Which capabilities come from the licensed sensor versus Investigator? - Can an analyst reproduce an assisted conclusion from retained evidence? - Which external EDR, firewall or identity permissions are required for the proposed response? EVIDENCE GAPS - Atlas has not independently measured assisted-triage accuracy or analyst time savings. - Confirm current sensor collections, SaaS retention and response entitlements. SOURCES Corelight Investigator (Product information) https://corelight.com/platform/investigator Corelight Investigator data sheet (Product information) https://corelight.com/hubfs/resources/product-data-sheets/corelight-investigator-ds.pdf Corelight sensor architectures (Product information) https://corelight.com/platform/sensors Use synthetic fixtures in an authorized environment. Agree rollback and acceptance criteria before enforcement. Documentation research and Atlas analysis. Independent hands-on effectiveness, effort, and complete price remain unassessed.