Arkime
7.3#1 in digital forensics softwareFree planFree planWebAPILinuxSelf-hosted
VisitArkime vs Malcolm
What both publish
| Fact | Arkime | Malcolm |
|---|---|---|
| Deployment | The installation guide covers Linux, recommends Debian or Ubuntu LTS, and also links to a container installation guide. | Malcolm runs in containers using Docker or Podman, and documentation also describes Kubernetes deployment on premises or in AWS. |
| Integrations | Arkime uses OpenSearch or Elasticsearch for indexed metadata and offers WISE threat-intelligence integration. | Its documented components include Zeek, Suricata, Arkime, OpenSearch, NetBox, MISP, TAXII, Google, and Mandiant threat intelligence sources. |
| Purpose | Arkime is an open-source network analysis and session search tool that passively watches network traffic and creates searchable session records. | Malcolm is a network traffic analysis tool suite for network security monitoring. |
| Security | The architecture guide recommends restricting database and viewer ports with firewall rules and routing operator access through a central viewer, potentially behind a reverse proxy. | Malcolm requires authentication for its user interface and supports local TLS-encrypted basic authentication, LDAP, and Keycloak authentication. |
Arkime plans
- ArkimeFree
Malcolm plans
- MalcolmFree
Pick Arkime if…
Arkime suits teams that need to search and inspect network sessions and can provide OpenSearch or Elasticsearch for metadata storage. It is designed for self-hosted use, with Linux installation guidance and a container guide.
Pick Malcolm if…
Malcolm suits security teams that need to inspect network captures or live traffic and enrich session data. It fits users able to deploy and operate containerized software on a capable server.