arkime

Malcolm is a powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts (PCAP files), Zeek logs and Suricata alerts.

Malcolm is a powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts (PCAP files), Zeek logs and Suricata alerts.

This project is a SIEM with SIRP and Threat Intel, all in one.

Cyber Defence Monitoring Course Suite :: Suricata, Arkime (and others in the past)

DShield Sensor Log Collection with ELK

Malcolm is a powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts (PCAP files), Zeek logs and Suricata alerts.

The website for arkime.com

Splunk add-on to perform basic searches against the back end of Arkime using the Elasticsearch REST API.

MCP server for Malcolm: full read surface plus opt-in, audited write tools

This project aims to simplify the process of setting up Arkime, which can be daunting for brand-neww network analysts. Unlike the traditional Arkime build, this repository provides a streamlined approach using Docker Compose and environment variables.

Arkime MCP transforms your Arkime setup to a full blown AI-assisted investigator by giving your agentic workflow access to Arkime.

Advanced Threat Detection Lab - Zeek, RITA, Arkime, Velociraptor, OSQuery, MISP, TheHive, Shuffle

Deploy Arkime with GPU-accelerated Rust/Python parsers and custom plugins using Docker Compose.

Deterministic Rust pcap slimmer. Stream-truncates encrypted L4 payloads (TLS, QUIC, IPsec, SSH post-banner) to 24 bytes; preserves headers, timestamps, TLS handshakes (SNI/certs/JA3), and cleartext protocols. 200–500 MB/s single-worker. For long-retention forensic capture (Arkime/Zeek/Suricata).

Full-packet network monitoring: EdgeRouter as capture sensor, Malcolm (Arkime+Zeek+Suricata+OpenSearch) as collector. Reproducible install scripts.

Real-time network packet capture and analysis using Moloch (Arkime), Wireshark, and Elastic Stack to detect anomalies, visualize patterns, and enhance cybersecurity.