Arkime vs Plaso
Arkime
arkime.comPlaso
plaso.readthedocs.ioSide by side
| Figure | Arkime | Plaso |
|---|---|---|
| Price from | Free | Free |
| Free plan | Yes | Yes |
| Free trial | — | — |
| Open source | Yes | Yes |
| Web | Yes | — |
| Windows | — | Yes |
| macOS | — | Yes |
| Linux | Yes | Yes |
| API | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 1 | 2 |
| Spec score · Digital Forensics Software | 9.0 (#1) | 8.5 (#4) |
| Docker | Official Docker images have been provided since version 5.5.0 and contain all Arkime applications. | Official instructions provide a Docker Hub image, Dockerfile build, bind mounts and commands for log2timeline, psort, pinfo and psteal. |
| Extensibility | The project documents capture rules, tagger plugins, command sockets, Python support, WISE sources and S3 storage. | The project supports adding parsers, parser plugins, analysis plugins, output modules, tagging rules and automation scripts. |
| Integrations | Arkime uses OpenSearch or Elasticsearch for indexed metadata and offers WISE threat-intelligence integration. | The documented analysis plug-ins include VirusTotal, NSRL server, and hash tagging. |
| Licence | Arkime is distributed under the permissive Apache License 2.0. | PyPI and GitHub identify the project as Apache-2.0 licensed. |
| Purpose | Arkime is an open-source network analysis and session search tool that passively watches network traffic and creates searchable session records. | Plaso is a Python-based engine used by tools to create super timelines or more targeted timelines for digital forensic analysis. |
| Self-hosting | Arkime is installed as Linux packages or official containers and runs its capture and viewer services on infrastructure you operate. | Plaso is distributed as a local command-line application and can be run in Docker or installed through Linux and macOS packaging paths. |
| Support | The project offers a Slack workspace and office hours for questions, and GitHub Issues for bugs and feature requests. | The project directs users to its discussion mailing list, Open Source DFIR Slack community, troubleshooting guide, and GitHub issue tracker; contributions are best effort. |
| What it does | Arkime passively captures network traffic, indexes session metadata and can retain packets as standard PCAP for investigation. | Plaso is a Python engine that automatically builds super timelines from computer logs and files for digital-forensics analysis. |
Plans
In their own words
Arkime
Arkime is a free, open-source network analysis and session search tool that passively observes traffic and creates searchable session records. It parses layers 3–7 and indexes fields including protocols, DNS names, HTTP headers, TLS/JA4 fingerprints, file hashes, and GeoIP in OpenSearch or Elasticsearch. Operators can store full packets in standard PCAP format or use metadata-only capture, with rules to select traffic for saving. Users can search sessions, inspect packet data, and export results as PCAP or CSV. Cont3xt enriches supported indicators using commercial and OSINT sources, including VirusTotal, Censys, and Shodan; phone enrichment is limited to the U.S. Parliament groups clusters and displays cluster issues and Elasticsearch health. Capture can scale by adding machines or increasing CPU and disk. Arkime has no license fees or paid-only features. Installation guidance covers Linux, recommends Debian or Ubuntu LTS, and links to a container guide. OpenSearch or Elasticsearch is required for session metadata. Authentication options include basic, form, digest, header, and OIDC, while the project advises against anonymous authentication.
Plaso
Plaso is a Python-based engine for creating timelines used in digital forensic analysis. Its log2timeline tool extracts events from files, directories, storage-media images, or devices and stores them in a Plaso storage file. The psort tool can filter and sort that data and run automatic analysis. Other command-line tools include image_export, pinfo, and psteal. Documented inputs include Windows event logs and registry data, browser histories, SQLite databases, text logs, and cloud audit logs from AWS CloudTrail, Azure Activity, Google Cloud, and Microsoft 365. Plaso can create a CSV timeline from a storage image using psteal with dynamic output; listed formats also include JSON, JSON Lines, KML, TLN, XLSX, OpenSearch, and Timesketch. The framework supports additional parsers, analysis plug-ins, and scripts for forensic tasks. Documented analysis plug-ins include VirusTotal, NSRL server, and hash tagging. Plaso is free, with no commercial plan or usage limits stated. The project recommends packaged releases for general use and a version no older than six months.