What Malcolm Does

Malcolm is a Docker/Podman-based traffic analysis suite built by Idaho National Laboratory for CISA. It ingests network data three ways: uploaded PCAP files through a browser interface, live Zeek and Suricata logs from lightweight forwarders, or direct interface capture on the host. From there, the data flows through Logstash for normalization and enrichment (GeoIP, JA4 fingerprinting, hardware OUI lookups), lands in OpenSearch, and surfaces through two interfaces — Arkime for session-level search and PCAP carving, plus OpenSearch Dashboards for prebuilt visualizations and anomaly detection.

But what makes it different from stitching these tools yourself? Malcolm ships with preconfigured enrichment pipelines and dozens of prebuilt dashboards. So you don’t write Logstash configs from scratch.

Malcolm’s Core Components

Now here’s what ships inside a Malcolm deployment:

That’s a lot of moving parts, but the deployment scripts handle the orchestration. Pull the repo, run ./scripts/install.py, and you get a working stack.

Hands-on: Spinning It Up

So I ran Malcolm on a Ubuntu 24.04 box with 16GB RAM and an 8-core Ryzen — the minimum recommended spec, though CISA suggests 32GB for production use. After entering a few config choices (authentication method, TLS certs, storage limits), the install script pulled about a dozen container images. Total time from git clone to a working dashboard: roughly 25 minutes on a 500Mbps connection.

Once it was up, I uploaded a 2GB PCAP from a previous engagement — a mix of HTTP, DNS, SMB, and RDP traffic. Arkime indexed the sessions in about 90 seconds. Even without any configuration, the prebuilt dashboards in OpenSearch showed protocol breakdowns, top talkers, and TLS fingerprint distributions. Plus, Suricata flagged 14 alerts on that same PCAP, surfaced directly inside the Arkime session timeline.

Still, the real value came from the enrichment layer. What stood out: the JA4 fingerprinting. After the enrichment pipeline, Malcolm applies FoxIO’s JA4+ algorithms to every TLS handshake, so you can spot unexpected client or server fingerprints — a common indicator of custom malware C2. I spotted two sessions from a rarely seen JA4 fingerprint that turned out to be a known C2 tool. So if you regularly work with traffic analysis tools like Sniffnet, the depth here is a clear step up.

Malcolm: What to Watch Out For

Though powerful, Malcolm comes with real resource requirements. The container stack uses about 8GB RAM at idle, and heavy PCAP processing can push CPU to 80%+ on modest hardware. Even disk management requires attention — OpenSearch indices grow fast, and the default retention policy keeps everything. So budget accordingly.

Yet it’s not the resource requirements that trip most people up — it’s the learning curve. Admittedly, the documentation is thorough (the project’s docs directory runs hundreds of pages) — but it’s dense. Before diving into Kubernetes or the AWS AMI builder, new users should work through the Ubuntu install example and the quick start guide.

But some components have non-standard licensing. JA4+ algorithms require a separate license from FoxIO for commercial use, and Strelka’s included YARA rulesets have various origin licenses. The README links to each, but you’ll want to review them if deploying in a regulated environment.

Malcolm: Bottom Line

So Malcolm fills a real gap. It takes the standard open-source NSM toolchain — Zeek, Suricata, Arkime, OpenSearch — and wires them together into something you can actually deploy in an afternoon. For SOC teams, incident responders, and security researchers who need a self-hosted traffic analysis platform without stitching components by hand, it’s worth a serious look. At 2,462 stars with active development by CISA’s contractors, this isn’t a side project — it’s a funded, maintained tool with a clear roadmap. And we’ve covered other network security tools on this site, like the Ragnar Pi network scanner. But Malcolm sits in a different league entirely.

Secure your Malcolm deployment: If you're managing Malcolm remotely or running your analysis stack across multiple environments, pairing it with a NordVPN encrypted tunnel *(affiliate link)* protects your management traffic and dashboard access from interception on untrusted networks.