Malcolm
What it is
Malcolm is a network traffic analysis suite for security monitoring. It accepts PCAP files, Zeek logs, and Suricata alerts through a browser interface, or live captures forwarded by lightweight sensors. OpenSearch Dashboards provides visualizations, while Arkime helps find and identify network sessions. Malcolm adds context to session data with GeoIP, hardware manufacturer lookups, asset inventory mappings, and JA4 fingerprinting. Its documented components include Zeek, Suricata, Arkime, OpenSearch, NetBox, MISP, TAXII, and Google and Mandiant threat intelligence sources. It analyzes protocols including DNS, HTTP, Modbus, and BACnet. Malcolm runs in Docker or Podman containers, with Kubernetes deployment described for on-premises environments or AWS. A dedicated server requires at least 8 CPU cores and 24 GB of RAM; 16 or more cores and 32 GB or more are recommended for an optimal experience. The interface requires authentication, with local TLS-encrypted basic authentication, LDAP, and Keycloak options. Malcolm is free under the Apache License 2.0.
For and against
For
- Accepts PCAP files, Zeek logs, and Suricata alerts
- Supports live capture forwarded by lightweight sensors
- Combines OpenSearch Dashboards and Arkime analysis interfaces
- Enriches sessions with GeoIP and asset mappings
- Free under the Apache License 2.0
Against
- Dedicated server requires at least 8 CPU cores and 24 GB RAM
- Deployment uses Docker or Podman containers
- The interface requires authentication
The verdict
Malcolm brings offline traces and forwarded live captures into a suite with visualization, session search, and enrichment. Its stated server requirements and container deployment are important considerations.
Who it suits
Malcolm suits security teams that need to inspect network traffic and enrich session data. It is intended for users able to deploy and operate containerized software with substantial server resources.
Plans and prices
Malcolm
Apache License 2.0 · Self-hosted software
Read 29 Sep 2026 · cisagov.github.io
On the record
- Access control
- The documentation describes role-based access control and Keycloak group and realm role restrictions for limiting which users can authenticate.cisagov.github.io · read 29 Sep 2026
- Analysis interfaces
- It provides OpenSearch Dashboards for visualizations and Arkime for finding and identifying network sessions.cisagov.github.io · read 29 Sep 2026
- Data enrichment
- Malcolm enriches network session data with GeoIP, hardware manufacturer lookups, asset inventory mappings, and JA4 fingerprinting.cisagov.github.io · read 29 Sep 2026
- Deployment
- Malcolm runs in containers using Docker or Podman, and documentation also describes Kubernetes deployment on premises or in AWS.cisagov.github.io · read 29 Sep 2026
- Host platforms
- The recommended requirements page says Malcolm runs on Docker on recent Linux and macOS releases and Windows 10 or later.cisagov.github.io · read 29 Sep 2026
- Input data
- It accepts PCAP files, Zeek logs, and Suricata alerts through a browser interface or from live capture forwarded by lightweight sensors.cisagov.github.io · read 29 Sep 2026
- Integrations
- Its documented components include Zeek, Suricata, Arkime, OpenSearch, NetBox, MISP, TAXII, Google, and Mandiant threat intelligence sources.cisagov.github.io · read 29 Sep 2026
- License
- The project says it is licensed under the Apache License, version 2.0.cisagov.github.io · read 29 Sep 2026
- Protocol coverage
- Malcolm uses Zeek and Arkime to analyze traffic across documented protocols including DNS, HTTP, Modbus, and BACnet.cisagov.github.io · read 29 Sep 2026
- Purpose
- Malcolm is a network traffic analysis tool suite for network security monitoring.cisagov.github.io · read 29 Sep 2026
- Security
- Malcolm requires authentication for its user interface and supports local TLS-encrypted basic authentication, LDAP, and Keycloak authentication.cisagov.github.io · read 29 Sep 2026
- System requirements
- A dedicated server requires at least 8 CPU cores and 24 GB of RAM; the developers recommend 16 or more cores and 32 GB or more RAM for an optimal experience.cisagov.github.io · read 29 Sep 2026
