Corelight Open NDR is a network detection and response platform that provides network visibility and threat detection capabilities. The platform collects and analyzes network data to identify adversarial tactics, techniques, and procedures (TTPs) across the MITRE ATT&CK framework. The system employs a multi-layered detection approach that combines AI and machine learning, behavioral analytics, signature-based detection, and threat intelligence. It uses supervised and unsupervised machine learning models to detect advanced, evasive, and novel threats. The platform generates forensic-grade network telemetry for analysis and investigation. Corelight Open NDR monitors network traffic to detect threats that evade endpoint controls, including post-exploitation behavior, credential access, DNS tunneling, and anomalous SMB usage. It provides visibility across east-west traffic, unmanaged devices, and encrypted sessions. The platform identifies high-value threat behaviors such as lateral movement, command and control communication, encrypted traffic misuse, and data exfiltration. The solution includes network security monitoring capabilities through Zeek, signature-based intrusion detection with Suricata, and static file analysis using YARA rules. It offers an AI-assisted workflow dashboard called Investigator for triage operations. Detection logic can be customized and extended based on open frameworks. The platform enriches detections with AI-driven automation, providing evidence-backed summaries, guided triage, and analyst-ready workflows to support investigation and response activities.