{"repo":"cisagov/Malcolm","free":true,"listed":false,"github":"https://github.com/cisagov/Malcolm","clone":"git clone https://github.com/cisagov/Malcolm.git","description":"Malcolm is a powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts (PCAP files), Zeek logs and Suricata alerts.","language":"Python","stars":2488,"topics":["network-security","pcap","security","arkime","cybersecurity","infosec","network-traffic-analysis","networksecurity","opensearch","opensearch-dashboards"],"license":null,"category":"security-tools","readme_excerpt":"Malcolm Malcolm is a powerful network traffic analysis tool suite designed with the following goals in mind: Easy to use – Malcolm accepts network traffic data in the form of full packet capture (PCAP) files, Zeek logs, and Suricata alerts. These artifacts can be uploaded via a simple browser-based interface or passively captured live and forwarded to Malcolm using lightweight forwarders. In either case, the data is automatically normalized, enriched, and correlated for analysis. Powerful traffic analysis – Visibility into network communications is provided through two intuitive interfaces: OpenSearch Dashboards, a flexible data visualization plugin with dozens of prebuilt dashboards providing an at-a-glance overview of network protocols; and Arkime, a powerful tool for finding and identifying the network sessions comprising suspected security incidents. Streamlined deployment – Malcolm operates as a cluster of software containers – isolated sandboxes that each serve a dedicated function of the system. This container-based deployment model, combined with a few simple scripts for setup and run-time management, makes Malcolm suitable to be deployed quickly across a variety of platforms and use cases; whether it be for long-term deployment on a Linux server in a security operations center (SOC) or for incident response on a MacBook for an individual engagement. Secure communications – All communications with Malcolm, both from the user interface and from remote log forwarders, a","default_branch":null,"files":null,"tree":[],"storefront":"/r/cisagov","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/cisagov/Malcolm/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}