Malcolm vs SentryWire
Malcolm
cisagov.github.ioSentryWire
sentrywire.comSide by side
| Figure | Malcolm | SentryWire |
|---|---|---|
| Price from | Free | — |
| Free plan | Yes | — |
| Free trial | — | — |
| Open source | — | — |
| Web | Yes | Yes |
| Windows | Yes | — |
| macOS | Yes | — |
| Linux | Yes | — |
| API | Yes | — |
| Self-hosted | Yes | Yes |
| Plans published | 1 | 0 |
| Spec score · Network Packet Capture Software | 7.9 (#9) | 6.9 (#20) |
| Deployment | Malcolm runs in containers using Docker or Podman, and documentation also describes Kubernetes deployment on premises or in AWS. | Offerings include virtual machines, hardware appliances, portable systems, and cluster nodes; virtual machines capture from 1 Mbps to 500 Mbps. |
| Integrations | Its documented components include Zeek, Suricata, Arkime, OpenSearch, NetBox, MISP, TAXII, Google, and Mandiant threat intelligence sources. | SentryWire names Splunk, Elastic, Cisco, Palo Alto Networks, Fortinet, IBM, and Dell among its integrations and says it works with 25+ others. |
Plans
In their own words
Malcolm
Malcolm is a network traffic analysis suite for security monitoring. It accepts PCAP files, Zeek logs, and Suricata alerts through a browser interface, and can also process live captures forwarded by lightweight sensors. OpenSearch Dashboards provides visualizations, while Arkime helps locate and identify network sessions. Malcolm adds context to session data with GeoIP, hardware manufacturer lookups, asset inventory mappings, and JA4 fingerprints. It analyzes documented protocols including DNS, HTTP, Modbus, and BACnet. Deployment uses Docker or Podman containers, with Kubernetes instructions for on-premises or AWS environments. A dedicated server requires at least 8 CPU cores and 24 GB of RAM; the developers recommend 16 or more cores and at least 32 GB for an optimal experience. The interface requires authentication, with TLS-encrypted local basic authentication, LDAP, and Keycloak options. Malcolm is self-hosted and free under the Apache License 2.0.
SentryWire
SentryWire is a packet-capture appliance and network security monitoring platform for retaining and examining network traffic. It captures from 1 Mbps to above 1 Tbps and supports retention measured in weeks, months, or years. Distributed storage and compute enable searches across historical packet data, while forensic replay helps investigate traffic. Integrated Suricata IDS provides real-time detection and retrospective review. Analysis includes IDS search-back, BPF-syntax filtering, file-artifact extraction, JA3 hashing, GeoIP and ASN enrichment, Kibana dashboards, and display filters. Integrations named by the maker include Splunk, Elastic, Cisco, Palo Alto Networks, Fortinet, IBM, and Dell, with 25+ others supported. Deployment options include virtual machines, hardware appliances, portable systems, and cluster nodes; virtual machines capture up to 500 Mbps. SentryWire supports live capture, offline trace analysis, and PCAP files, and can retrieve packets from Splunk SOAR or Cortex XSOAR playbooks. Pricing is provided through sales contact.