Corelight Investigator is a SaaS-based network detection and response solution that provides evidence-first threat investigation capabilities. The platform is built on the Open NDR Platform architecture and integrates multiple detection and analysis technologies. The solution includes network traffic monitoring through Zeek, which serves as the foundation for converting network traffic into structured data. It incorporates Suricata IDS for signature-based alerting and intrusion detection. Smart PCAP functionality enables selective packet capture for investigations while maintaining extended traffic history storage. The platform offers static file analysis through YARA rules for pattern-based malware detection. Multiple detection collections are available, including command and control detection with 50+ signatures, encrypted traffic analysis for SSL/SSH/RDP connections without decryption, entity inventory management with subnet identification and 80+ application recognition, and ICS/OT protocol support for industrial environments. Corelight provides various sensor deployment options including hardware appliances with throughput ranging from 2 Gbps to 100+ Gbps, cloud sensors for AWS, GCP, and Azure environments, software sensors with 8 Gbps throughput, and virtual sensors for Hyper-V and VMware. Fleet Manager enables centralized management of sensor deployments through a single console with custom configuration templates.