Malcolm is a powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts (PCAP files), Zeek logs and Suricata alerts.

This project is a SIEM with SIRP and Threat Intel, all in one.

Malcolm is a powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts (PCAP files), Zeek logs and Suricata alerts.

Cyber Defence Monitoring Course Suite :: Suricata, Arkime (and others in the past)

The website for arkime.com

DShield Sensor Log Collection with ELK

Malcolm is a powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts (PCAP files), Zeek logs and Suricata alerts.

Splunk add-on to perform basic searches against the back end of Arkime using the Elasticsearch REST API.