Malcolm

What it is

A container-based traffic analysis platform from CISA and Idaho National Laboratory collaborators. It enriches PCAP files, Zeek logs, and Suricata alerts, then presents them in OpenSearch Dashboards and Arkime.

What it helps with

- Ingesting uploaded or live-forwarded PCAP, Zeek, and Suricata artifacts
- Enriching sessions with GeoIP, OUI lookups, asset names, and JA4 fingerprints
- Hunting via OpenSearch dashboards and Arkime session search

Who it's for

SOC analysts and incident responders examining traffic on networks they own or are authorized to monitor.

Worth knowing

You can forward from a SPAN or TAP sensor or process offline PCAPs without one. Its Apache-2.0 license notes separate FoxIO terms for JA4+ used by bundled Zeek and Arkime components.

Do I need separate Zeek, Suricata, and Arkime installs first?
No, Malcolm packages those roles in its containers, and you can still forward logs from external sensors.

Can it run on a laptop for a short engagement?
Yes, local workstation and macOS deployments are documented for smaller networks and field work.

How does it compare with Zeek, Suricata, and Arkime?
In our view each is a focused engine for logs, IDS alerts, or session search, while Malcolm combines them with OpenSearch dashboards into one suite.