Compare software

Arkime vs Malcolm: catalog facts
Arkime	Malcolm
Free The open-source software is available without a license fee. Hosting, hardware and…	Free Free to use; the source is published on GitHub by CISA.
Linux, Self-hosted, Web	Linux, Self-hosted
Indexes sessions while retaining packet data in PCAP format.	Brings PCAP, Zeek and Suricata data together in one searchable interface Deployable with Docker, Kubernetes or an installable ISO
Large captures require substantial storage and careful retention settings.	A large multi-container stack that needs substantial server resources Aimed at trained analysts rather than casual home users
Self-hosted	Self-hosted
Open source	Open source
License: Apache-2.0	License not stated
Not stated if an account is needed	Not stated if an account is needed
Not stated if it works offline	Works offline
Official website Full listing and sources Checked September 22, 2026	Official website Full listing and sources Checked September 23, 2026

Catalog facts only. Anything “not stated” is unconfirmed. Check full listings for details.