EndaceVision vs Malcolm

EndaceVision is a browser-based application for investigating security threats and network or application performance issues from historical packet data. Analysts can search and filter recorded traffic by link name, application classification, IP or MAC address, port, timestamp, and other parameters. EndaceProbes use built-in deep packet inspection to classify captured traffic by application. Visualizations cover bandwidth over time, conversations, traffic over time, and top talkers. MicroVision uses packet timestamps to show short events at microsecond detail, including average and maximum values for each sample point. A hosted Wireshark instance lets analysts decode packets on EndaceProbes or InvestigationManager without downloading large captures. The datasheet lists role-based access control and TACACS security. Access runs in modern desktop or tablet browsers with appropriate credentials. EndaceVision is included on EndaceProbe Analytics Platforms and InvestigationManager, with pcap and ERF capture formats listed. It is aimed at security, network, and IT teams. Endace was founded in 2001 and is headquartered in Auckland, New Zealand. Pricing is available on request.

Malcolm is a network traffic analysis suite for security monitoring. It accepts PCAP files, Zeek logs, and Suricata alerts through a browser interface, and can also process live captures forwarded by lightweight sensors. OpenSearch Dashboards provides visualizations, while Arkime helps locate and identify network sessions. Malcolm adds context to session data with GeoIP, hardware manufacturer lookups, asset inventory mappings, and JA4 fingerprints. It analyzes documented protocols including DNS, HTTP, Modbus, and BACnet. Deployment uses Docker or Podman containers, with Kubernetes instructions for on-premises or AWS environments. A dedicated server requires at least 8 CPU cores and 24 GB of RAM; the developers recommend 16 or more cores and at least 32 GB for an optimal experience. The interface requires authentication, with TLS-encrypted local basic authentication, LDAP, and Keycloak options. Malcolm is self-hosted and free under the Apache License 2.0.