Malcolm

Visit site Alternatives

Score7.2

Rank#2 of 20

PriceFree

Free planYes

Runs onAPI, Linux, macOS, Self-hosted, Web, Windows

Summary

Malcolm is a network traffic analysis suite for security monitoring. It accepts PCAP files, Zeek logs, and Suricata alerts through a browser interface, or live captures forwarded by lightweight sensors. OpenSearch Dashboards provides visualizations, while Arkime helps users find and identify network sessions. Malcolm adds context to session data through GeoIP, hardware manufacturer lookups, asset inventory mappings, and JA4 fingerprinting. Its documented components include Zeek, Suricata, OpenSearch, NetBox, MISP, TAXII, and Google and Mandiant threat intelligence sources. Analysis covers protocols such as DNS, HTTP, Modbus, and BACnet. Deployment uses Docker or Podman, with Kubernetes instructions for on-premises or AWS environments. A dedicated server requires at least 8 CPU cores and 24 GB of RAM; 16 or more cores and at least 32 GB are recommended for an optimal experience. The interface requires authentication, with local TLS-encrypted basic authentication, LDAP, and Keycloak options. Malcolm is free under the Apache License 2.0.

Who it is for

Malcolm suits security teams that need to inspect network captures or live traffic and enrich session data. It fits users able to deploy and operate containerized software on a capable server.

What is good

Accepts PCAP files, Zeek logs, and Suricata alerts
Supports live capture through lightweight sensors
Includes OpenSearch Dashboards and Arkime interfaces
Adds GeoIP, asset mappings, and JA4 fingerprints
Free, self-hosted software under Apache License 2.0

What to know first

Dedicated server minimum is 8 CPU cores and 24 GB RAM
Deployment requires Docker, Podman, or Kubernetes
User interface requires authentication

Verdict

Malcolm combines capture analysis, session search, and data enrichment in a self-hosted security monitoring suite. Its server requirements and container-based deployment make capacity and infrastructure important considerations.

Malcolm plans and pricing

All plans

Malcolm Free Apache License 2.0 · Self-hosted software cisagov.github.io · 29 Sept 2026

Compared on network packet capture software

Free plan: Yescisagov.github.io
Live capture: Yescisagov.github.io
Offline trace analysis: Yescisagov.github.io
Display filters: Yescisagov.github.io
Capture file formats: PCAP, PCAPNGcisagov.github.io
Command-line capture: Yescisagov.github.io
Supported platforms: Linux, Windows, macOS, web browser, REST APIcisagov.github.io

Facts

Purpose: Malcolm is a network traffic analysis tool suite for network security monitoring.cisagov.github.io · 29 Sept 2026
Input data: It accepts PCAP files, Zeek logs, and Suricata alerts through a browser interface or from live capture forwarded by lightweight sensors.cisagov.github.io · 29 Sept 2026
Analysis interfaces: It provides OpenSearch Dashboards for visualizations and Arkime for finding and identifying network sessions.cisagov.github.io · 29 Sept 2026
Data enrichment: Malcolm enriches network session data with GeoIP, hardware manufacturer lookups, asset inventory mappings, and JA4 fingerprinting.cisagov.github.io · 29 Sept 2026
Integrations: Its documented components include Zeek, Suricata, Arkime, OpenSearch, NetBox, MISP, TAXII, Google, and Mandiant threat intelligence sources.cisagov.github.io · 29 Sept 2026
Deployment: Malcolm runs in containers using Docker or Podman, and documentation also describes Kubernetes deployment on premises or in AWS.cisagov.github.io · 29 Sept 2026
Host platforms: The recommended requirements page says Malcolm runs on Docker on recent Linux and macOS releases and Windows 10 or later.cisagov.github.io · 29 Sept 2026
System requirements: A dedicated server requires at least 8 CPU cores and 24 GB of RAM; the developers recommend 16 or more cores and 32 GB or more RAM for an optimal experience.cisagov.github.io · 29 Sept 2026
Security: Malcolm requires authentication for its user interface and supports local TLS-encrypted basic authentication, LDAP, and Keycloak authentication.cisagov.github.io · 29 Sept 2026
Access control: The documentation describes role-based access control and Keycloak group and realm role restrictions for limiting which users can authenticate.cisagov.github.io · 29 Sept 2026
Protocol coverage: Malcolm uses Zeek and Arkime to analyze traffic across documented protocols including DNS, HTTP, Modbus, and BACnet.cisagov.github.io · 29 Sept 2026
License: The project says it is licensed under the Apache License, version 2.0.cisagov.github.io · 29 Sept 2026