EndaceProbe vs Malcolm
EndaceProbe
endace.com
Malcolm
cisagov.github.ioSide by side
| Figure | EndaceProbe | Malcolm |
|---|---|---|
| Price from | — | Free |
| Free plan | — | Yes |
| Free trial | — | — |
| Open source | — | — |
| Web | Yes | Yes |
| Windows | — | Yes |
| macOS | — | Yes |
| Linux | Yes | Yes |
| API | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 1 | 1 |
| Spec score · Network Packet Capture Software | 7.8 (#10) | 7.9 (#9) |
| Deployment | The product is available as physical appliances and as cloud or virtual deployments, including AWS, Microsoft Azure, VMware, KVM, and Nutanix options. | Malcolm runs in containers using Docker or Podman, and documentation also describes Kubernetes deployment on premises or in AWS. |
| Integrations | Its APIs and Fusion Partner integrations connect packet history to security and performance monitoring tools, including commercial, open-source, and custom applications. | Its documented components include Zeek, Suricata, Arkime, OpenSearch, NetBox, MISP, TAXII, Google, and Mandiant threat intelligence sources. |
| Purpose | EndaceProbe provides continuous full packet capture and recorded network history for investigating security threats, performance issues, and outages. | Malcolm is a network traffic analysis tool suite for network security monitoring. |
| Security | Endace states that its probes use a cryptographic module for encrypted communications and have FIPS 140-3 validation, Common Criteria NDcPP v2.2e certification, and DoDIN APL listing. | Malcolm requires authentication for its user interface and supports local TLS-encrypted basic authentication, LDAP, and Keycloak authentication. |
Plans
In their own words
EndaceProbe
EndaceProbe continuously records complete network packets, preserving network history for investigations into security threats, performance issues, and outages. It is offered as physical appliances and cloud or virtual deployments on AWS, Microsoft Azure, VMware, KVM, and Nutanix. Listed models sustain recording from 500 Mbps to 100 Gbps, with packet storage ranging from 1 TB to more than 3 PB. InvestigationManager provides centralized search and data mining, while EndaceCMS manages physical and cloud probes. Browser-based EndaceVision searches historical packets and includes hosted Wireshark decoding without downloading large PCAP files. The platform supports live capture, offline trace analysis, display filters, protocol decryption, and pcap, pcapng, and ERF formats. Endace lists Elastic integrations and an API for open-source, custom, and Fusion Partner tools. Appliances can host applications such as EndaceFlow. Security controls include hardened Linux, disabled shell access, authentication options, role-based access, and stated certifications. Pricing is available on request.
Malcolm
Malcolm is a network traffic analysis suite for security monitoring. It accepts PCAP files, Zeek logs, and Suricata alerts through a browser interface, and can also process live captures forwarded by lightweight sensors. OpenSearch Dashboards provides visualizations, while Arkime helps locate and identify network sessions. Malcolm adds context to session data with GeoIP, hardware manufacturer lookups, asset inventory mappings, and JA4 fingerprints. It analyzes documented protocols including DNS, HTTP, Modbus, and BACnet. Deployment uses Docker or Podman containers, with Kubernetes instructions for on-premises or AWS environments. A dedicated server requires at least 8 CPU cores and 24 GB of RAM; the developers recommend 16 or more cores and at least 32 GB for an optimal experience. The interface requires authentication, with TLS-encrypted local basic authentication, LDAP, and Keycloak options. Malcolm is self-hosted and free under the Apache License 2.0.