Cisco Catalyst Center vs DRAKVUF Sandbox
Cisco Catalyst Center
cisco.comDRAKVUF Sandbox
github.comSide by side
| Figure | Cisco Catalyst Center | DRAKVUF Sandbox |
|---|---|---|
| Price from | — | — |
| Free plan | — | — |
| Free trial | — | — |
| Open source | — | — |
| Web | Yes | Yes |
| Windows | Yes | — |
| macOS | Yes | — |
| Linux | Yes | Yes |
| API | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 2 | 0 |
| Spec score · Malware Analysis Sandboxes | 7.8 (#8) | 7.7 (#9) |
| API | The platform exposes northbound REST APIs for discovery, inventory, topology, provisioning, assurance, and other network operations. | The documentation describes an API as part of the core workflow, alongside the analysis queue and dashboard. |
| Headquarters | San Jose, California, United States | Warsaw, Poland |
| Integrations | Cisco documents integrations with ISE, ThousandEyes, Webex, Microsoft Teams, ServiceNow, Infoblox, and BlueCat, plus generic APIs for other ITSM and IPAM systems. | Optional integrations include S3 for analysis storage and an experimental Karton integration plugin in release v0.21.0. |
| Purpose | Cisco Catalyst Center is a centralized network controller and management dashboard for enterprise network operations. | DRAKVUF Sandbox is an automated black-box malware analysis system powered by the DRAKVUF engine. |
| Support | Cisco says Catalyst and Cisco DNA software subscriptions include embedded software support and downloads; opening a support case requires a Cisco Service Contract. | The maintainers list [email protected] as the fastest general contact and provide a Discord community link. |
Plans
Cisco Catalyst Center
- Cisco DNA AdvantagePriced on request
- Cisco DNA EssentialsPriced on request
In their own words
Cisco Catalyst Center
Cisco Catalyst Center has no write-up on Specifiction yet; its figures are above.
DRAKVUF Sandbox
DRAKVUF Sandbox is a free, GPL version 2 software project from CERT Polska for automated, black-box malware analysis. It uses the DRAKVUF engine and examines suspicious files without installing an agent inside the guest operating system. Files can be uploaded through a web interface, while an API, analysis queue, dashboard, Flask web application, rq worker and Redis support the workflow. Default plugins monitor WinAPI calls, file activity, memory regions, processes, network connections, DNS queries and TLS master keys. Reports show process trees, network and domain activity, modified or deleted files and high-level TTP indicators. Available downloads can include PCAP traffic, intercepted TLS keys and memory dumps. Uploads can disable guest internet access. On-premises deployment uses Xen 4.17 or later, with 4.19 recommended, on Debian 12 or Ubuntu 22.04 Intel hosts. Supported guests are Windows 10 x64 and Windows 7 x64.