Arkime
7.3#1 in digital forensics softwareFree planFree planWebAPILinuxSelf-hosted
VisitArkime vs Plaso
What both publish
| Fact | Arkime | Plaso |
|---|---|---|
| Docker | Official Docker images have been provided since version 5.5.0 and contain all Arkime applications. | Official instructions provide a Docker Hub image, Dockerfile build, bind mounts and commands for log2timeline, psort, pinfo and psteal. |
| Extensibility | The project documents capture rules, tagger plugins, command sockets, Python support, WISE sources and S3 storage. | The project supports adding parsers, parser plugins, analysis plugins, output modules, tagging rules and automation scripts. |
| Integrations | Arkime uses OpenSearch or Elasticsearch for indexed metadata and offers WISE threat-intelligence integration. | The documented analysis plug-ins include VirusTotal, NSRL server, and hash tagging. |
| Licence | Arkime is distributed under the permissive Apache License 2.0. | PyPI and GitHub identify the project as Apache-2.0 licensed. |
| Purpose | Arkime is an open-source network analysis and session search tool that passively watches network traffic and creates searchable session records. | Plaso is a Python-based engine used by tools to create super timelines or more targeted timelines for digital forensic analysis. |
| Self-hosting | Arkime is installed as Linux packages or official containers and runs its capture and viewer services on infrastructure you operate. | Plaso is distributed as a local command-line application and can be run in Docker or installed through Linux and macOS packaging paths. |
Arkime plans
- ArkimeFree
Plaso plans
- Open-source Plaso packageFree
- PlasoFree
Pick Arkime if…
Arkime suits teams that need to search and inspect network sessions and can provide OpenSearch or Elasticsearch for metadata storage. It is designed for self-hosted use, with Linux installation guidance and a container guide.
Pick Plaso if…
Plaso suits digital forensic practitioners who need to collect and analyze timelines from files, devices, logs, or storage images. Its parser and plug-in framework may also suit users extending forensic workflows.