Arkime vs Malcolm
Arkime
arkime.com
Malcolm
cisagov.github.ioSide by side
| Figure | Arkime | Malcolm |
|---|---|---|
| Price from | Free | Free |
| Free plan | Yes | Yes |
| Free trial | — | — |
| Open source | Yes | — |
| Web | Yes | Yes |
| Windows | — | Yes |
| macOS | — | Yes |
| Linux | Yes | Yes |
| API | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 1 | 1 |
| Spec score · Network Packet Capture Software | 8.9 (#1) | 7.9 (#9) |
| Deployment | The installation guide covers Linux, recommends Debian or Ubuntu LTS, and also links to a container installation guide. | Malcolm runs in containers using Docker or Podman, and documentation also describes Kubernetes deployment on premises or in AWS. |
| Integrations | Arkime uses OpenSearch or Elasticsearch for indexed metadata and offers WISE threat-intelligence integration. | Its documented components include Zeek, Suricata, Arkime, OpenSearch, NetBox, MISP, TAXII, Google, and Mandiant threat intelligence sources. |
| Purpose | Arkime is an open-source network analysis and session search tool that passively watches network traffic and creates searchable session records. | Malcolm is a network traffic analysis tool suite for network security monitoring. |
| Security | The architecture guide recommends restricting database and viewer ports with firewall rules and routing operator access through a central viewer, potentially behind a reverse proxy. | Malcolm requires authentication for its user interface and supports local TLS-encrypted basic authentication, LDAP, and Keycloak authentication. |
Plans
In their own words
Arkime
Arkime is a free, open-source network analysis and session search tool that passively observes traffic and creates searchable session records. It parses layers 3–7 and indexes fields including protocols, DNS names, HTTP headers, TLS/JA4 fingerprints, file hashes, and GeoIP in OpenSearch or Elasticsearch. Operators can store full packets in standard PCAP format or use metadata-only capture, with rules to select traffic for saving. Users can search sessions, inspect packet data, and export results as PCAP or CSV. Cont3xt enriches supported indicators using commercial and OSINT sources, including VirusTotal, Censys, and Shodan; phone enrichment is limited to the U.S. Parliament groups clusters and displays cluster issues and Elasticsearch health. Capture can scale by adding machines or increasing CPU and disk. Arkime has no license fees or paid-only features. Installation guidance covers Linux, recommends Debian or Ubuntu LTS, and links to a container guide. OpenSearch or Elasticsearch is required for session metadata. Authentication options include basic, form, digest, header, and OIDC, while the project advises against anonymous authentication.
Malcolm
Malcolm is a network traffic analysis suite for security monitoring. It accepts PCAP files, Zeek logs, and Suricata alerts through a browser interface, and can also process live captures forwarded by lightweight sensors. OpenSearch Dashboards provides visualizations, while Arkime helps locate and identify network sessions. Malcolm adds context to session data with GeoIP, hardware manufacturer lookups, asset inventory mappings, and JA4 fingerprints. It analyzes documented protocols including DNS, HTTP, Modbus, and BACnet. Deployment uses Docker or Podman containers, with Kubernetes instructions for on-premises or AWS environments. A dedicated server requires at least 8 CPU cores and 24 GB of RAM; the developers recommend 16 or more cores and at least 32 GB for an optimal experience. The interface requires authentication, with TLS-encrypted local basic authentication, LDAP, and Keycloak options. Malcolm is self-hosted and free under the Apache License 2.0.