Compare software

Malcolm vs Zeek: catalog facts
Malcolm	Zeek
Free Free to use; the source is published on GitHub by CISA.	Free The software is free under its open-source licence. Hosting, hardware and external…
Linux, Self-hosted	macOS, Linux
Brings PCAP, Zeek and Suricata data together in one searchable interface Deployable with Docker, Kubernetes or an installable ISO	Protocol analysers produce semantic logs of what happened on the network rather than raw packets, and its scripting…
A large multi-container stack that needs substantial server resources Aimed at trained analysts rather than casual home users	It produces a large volume of logs that need somewhere to go, and writing custom detections means learning…
Self-hosted	Downloadable app
Open source	Open source
License not stated	License: BSD-3-Clause
Not stated if an account is needed	Not stated if an account is needed
Works offline	Not stated if it works offline
Official website Full listing and sources Checked September 23, 2026	Official website Full listing and sources Checked September 22, 2026

Catalog facts only. Anything “not stated” is unconfirmed. Check full listings for details.