What it does
Malcolm is a network-traffic analysis suite that normalizes and correlates packet captures, Zeek logs and Suricata alerts for defensive investigations.
Malcolm accepts existing PCAP files and network logs as well as live-forwarded data. Its documented interfaces combine dashboards with Arkime session analysis, making it useful when an incident team receives several kinds of network evidence. Prepare an authorized sample dataset and decide which timestamps and segments belong to the case before importing it. The suite runs as a container cluster, so storage and service operation remain part of the deployment. Its integrated analysis workflow is distinct from the individual tools it includes.
Strengths
- Accepts several common network-evidence formats
- Correlated dashboard and session-analysis interfaces
Best for
- Incident responders working with network evidence collections