Arkime vs Timesketch
Arkime
arkime.comTimesketch
timesketch.orgSide by side
| Figure | Arkime | Timesketch |
|---|---|---|
| Price from | Free | Free |
| Free plan | Yes | Yes |
| Free trial | — | — |
| Open source | Yes | — |
| Web | Yes | Yes |
| Linux | Yes | Yes |
| API | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 1 | 1 |
| Spec score · Digital Forensics Software | 9.0 (#1) | 7.6 (#17) |
| Deployment | The installation guide covers Linux, recommends Debian or Ubuntu LTS, and also links to a container installation guide. | The preferred installation method is Docker, and the documentation says it is the only tested and actively maintained installation method. |
| Integrations | Arkime uses OpenSearch or Elasticsearch for indexed metadata and offers WISE threat-intelligence integration. | Documented analyzer integrations include Sigma, Google Safe Browsing, BigQuery, Yeti, and HashR. |
| Purpose | Arkime is an open-source network analysis and session search tool that passively watches network traffic and creates searchable session records. | Timesketch is an open-source tool for collaborative forensic timeline analysis. |
| Security | The architecture guide recommends restricting database and viewer ports with firewall rules and routing operator access through a central viewer, potentially behind a reverse proxy. | The installation guide documents optional TLS setup for the web server. |
| Support | The project offers a Slack workspace and office hours for questions, and GitHub Issues for bugs and feature requests. | The project lists user and developer mailing lists and a Timesketch Slack community as resources. |
Plans
In their own words
Arkime
Arkime is a free, open-source network analysis and session search tool that passively observes traffic and creates searchable session records. It parses layers 3–7 and indexes fields including protocols, DNS names, HTTP headers, TLS/JA4 fingerprints, file hashes, and GeoIP in OpenSearch or Elasticsearch. Operators can store full packets in standard PCAP format or use metadata-only capture, with rules to select traffic for saving. Users can search sessions, inspect packet data, and export results as PCAP or CSV. Cont3xt enriches supported indicators using commercial and OSINT sources, including VirusTotal, Censys, and Shodan; phone enrichment is limited to the U.S. Parliament groups clusters and displays cluster issues and Elasticsearch health. Capture can scale by adding machines or increasing CPU and disk. Arkime has no license fees or paid-only features. Installation guidance covers Linux, recommends Debian or Ubuntu LTS, and links to a container guide. OpenSearch or Elasticsearch is required for session metadata. Authentication options include basic, form, digest, header, and OIDC, while the project advises against anonymous authentication.
Timesketch
Timesketch is a free, open-source tool for collaborative forensic timeline analysis. A sketch normally represents one case and can contain multiple timelines, views, comments and stories. Investigators can search and filter timelines, inspect data in charts and save discoveries as views. Sketches may be private or shared with individuals, groups or all system users. Supported imports include Plaso storage files, CSV, JSON, JSONL, Pandas DataFrames, Python dictionaries and spreadsheet files. Python analyzers run in background workers to enrich events, add tags or create saved views; documented integrations include Sigma, Google Safe Browsing, BigQuery, Yeti and HashR. Sigma support is marked alpha with known performance and functionality issues. Timesketch offers a web interface, REST API and command-line client. Docker is the only tested and actively maintained installation method; documentation calls for Ubuntu 22.04 and at least 8 GB of RAM. Indexes depend on physical disk space, and searches may fail above 150 indices in a timeline. The self-hosted plan is free.