Corelight Entity Collection is a network asset discovery and inventory management component of the Corelight Open NDR Platform. The product provides identification capabilities for applications, devices, services, certificates, hosts, and other network entities. The collection identifies over 80 different applications including BitTorrent, Gmail traffic, and TeamViewer, writing this information to connection log fields. It generates hourly notice logs summarizing observed local subnets and creates logs that aggregate activity over time for different entity types such as hosts, devices, and services. The product enables security teams to track entity activity, such as identifying all hosts that have used SSH within a specified timeframe. It helps detect unknown and unmanaged entities traversing the network and provides visibility into current entity activity with historical tracking capabilities. Entity Collection is included with Corelight subscriptions and can be activated based on organizational needs. The pre-aggregation of entity activity in single log formats reduces the time analysts spend manually querying larger datasets for insights.