Malcolm
What it is
Malcolm is a network traffic analysis suite for security monitoring. It accepts PCAP files, Zeek logs and Suricata alerts through a browser interface, or it can receive live traffic from lightweight forwarders. Session data can be enriched with GeoIP, hardware-vendor, asset-inventory and JA4 fingerprinting information. Analysts can review data in OpenSearch Dashboards using prebuilt dashboards, or search and identify sessions with Arkime. Malcolm runs in containers and can be deployed with Docker, Podman or Kubernetes; a standalone Debian-based installer ISO is also available. Its interfaces are accessed in a browser from analyst workstations or SOC displays, and its documentation covers Linux, macOS and Windows hosts. Authentication options include local accounts, LDAP, TLS certificates and Keycloak. Malcolm includes a REST API and is released under the Apache License, Version 2.0. It is free. One deployment constraint is that rootless Podman cannot capture traffic directly from local network interfaces, though forwarded metadata from a network sensor appliance can be accepted.
For and against
For
- Accepts PCAP files, Zeek logs and Suricata alerts.
- Can receive live traffic through lightweight forwarders.
- Enriches sessions with GeoIP, asset and JA4 data.
- Offers OpenSearch Dashboards and Arkime for analysis.
- Free and released under Apache License 2.0.
Against
- Rootless Podman cannot capture local interface traffic.
- The installer formats non-removable storage without warning.
The verdict
Malcolm combines network-session analysis, enrichment and multiple deployment options in a free suite. Review the rootless Podman limitation and installer behavior when choosing how to deploy it.
Who it suits
Malcolm is suited to security operations teams, incident responders, and people monitoring smaller networks or home environments. It also supports long-term SOC deployments and field incident-response engagements.
On the record
- Analysis interfaces
- Enriched data is analyzed through OpenSearch Dashboards and Arkime, with prebuilt dashboards and network-session search.idaholab.github.io · read 1 Oct 2026
- API
- Malcolm provides a REST API and forwards requests to Logstash, OpenSearch, NetBox and Arkime APIs.idaholab.github.io · read 30 Sep 2026
- Authentication
- The documentation includes local accounts, LDAP authentication, TLS certificates and Keycloak-based authentication and roles.idaholab.github.io · read 30 Sep 2026
- Data enrichment
- Malcolm adds GeoIP, hardware-manufacturer, asset-inventory and JA4 fingerprinting enrichments.idaholab.github.io · read 1 Oct 2026
- Deployment
- Malcolm runs as isolated software containers and can be deployed with Docker, Podman or Kubernetes, including AWS Kubernetes deployments.idaholab.github.io · read 1 Oct 2026
- Deployment limitation
- Rootless Podman cannot capture traffic on local network interfaces, although it can accept metadata forwarded from a network sensor appliance.idaholab.github.io · read 1 Oct 2026
- Deployment model
- Malcolm runs as a cluster of containers and can also be packaged as a standalone Debian-based installer ISO.idaholab.github.io · read 30 Sep 2026
- Hardening
- The ISO-installed aggregator environment uses hardening scripts targeting CIS recommendations and adapted DISA STIG checks.idaholab.github.io · read 1 Oct 2026
- ICS focus
- Its creators are developing additional parsers for protocols used in industrial-control-system environments.idaholab.github.io · read 1 Oct 2026
- Input data
- It processes PCAP files and Zeek logs, including locally generated, locally captured and offline artifacts.idaholab.github.io · read 1 Oct 2026
- Installer warning
- The installer has no partitioning confirmations and will partition and format all non-removable storage media without warning.idaholab.github.io · read 30 Sep 2026
- Integrations
- Components include NetBox for asset-inventory enrichment, Keycloak for identity and access management, and nginx-auth-ldap for LDAP authentication.idaholab.github.io · read 1 Oct 2026
- License
- Malcolm source code is released under the Apache License, version 2.0.idaholab.github.io · read 1 Oct 2026
- Podman limitation
- With rootless Podman, Malcolm cannot capture traffic on local network interfaces, although it can accept metadata forwarded from a network sensor appliance.idaholab.github.io · read 30 Sep 2026
- Purpose
- Malcolm is an easily deployable network traffic analysis tool suite for security monitoring.idaholab.github.io · read 1 Oct 2026
- Security
- Communications between Malcolm interfaces and remote log forwarders use industry-standard encryption protocols.idaholab.github.io · read 1 Oct 2026
- Supply-chain security
- Official Malcolm container images are automatically scanned with Trivy for vulnerabilities and misconfigurations.idaholab.github.io · read 1 Oct 2026
- Support and training
- The Malcolm program team provides contact through [email protected] and lists general and technical virtual orientations.inl.gov · read 1 Oct 2026
