{"adoption": {"forks": 442, "observed_at": "2026-08-28T04:06:56.775945+00:00", "stars": 2497}, "canonical_url": "https://ross.abutalabs.com/products/malcolm", "card": {"archived": false, "artifact_type": "application", "description": "Malcolm is a powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts (PCAP files), Zeek logs and Suricata alerts.", "domain": ["security", "networking", "developer-tools"], "enriched": true, "function": ["monitoring", "search-engine", "data-visualization", "security", "analytics"], "health_score": 100, "homepage": "https://cisagov.github.io/Malcolm/", "language": "Python", "license": "NOASSERTION", "license_family": "other", "maturity": "active", "member_repos": ["cisagov/Malcolm"], "name": "cisagov/Malcolm", "platform": ["self-hosted"], "pushed_at": "2026-08-25T22:26:12+00:00", "repo": "cisagov/Malcolm", "stars": 2497, "tags": ["network-traffic-analysis", "pcap-analysis", "zeek", "suricata", "arkime", "opensearch", "network-security-monitoring", "ids", "full-packet-capture", "incident-response", "ics-protocols", "linux", "docker", "macos", "web-server"], "topics": ["network-security", "pcap", "security", "arkime", "cybersecurity", "infosec", "network-traffic-analysis", "networksecurity", "opensearch", "opensearch-dashboards", "suricata", "zeek", "networktrafficanalysis"], "urls": [], "use_cases": ["analyze pcap files for network security incidents", "deploy a network security monitoring platform for a SOC", "hunt threats in zeek logs and suricata alerts", "investigate suspicious network sessions during incident response", "monitor industrial control system network protocols", "visualize network protocol traffic with prebuilt dashboards", "self-hosted alternative to paid network traffic analysis tools"], "what_it_is": "Malcolm is a containerized network traffic analysis tool suite that ingests full packet capture (PCAP) files, Zeek logs, and Suricata alerts, normalizing and correlating them for analysis. It provides visualization through OpenSearch Dashboards and session exploration through Arkime, deployable on Linux servers or laptops for SOC monitoring and incident response.", "when_to_avoid": ["you need lightweight host-based intrusion detection rather than network traffic analysis", "you lack the hardware resources to run a multi-container cluster", "you need real-time inline blocking rather than passive capture and analysis", "you want a simple single-binary packet parser instead of a full analysis suite"], "when_to_choose": ["you need an easily deployable, container-based NSM platform combining Zeek, Suricata, and Arkime", "you want prebuilt dashboards and session search over full packet capture data", "you need visibility into industrial control system (ICS) protocols", "you want a free open-source alternative to commercial network analysis solutions"]}, "data_as_of": "2026-08-30T08:39:29.467469+00:00", "members": [{"path": "/products/malcolm", "repo": "cisagov/Malcolm", "role": "main", "score": 99}], "provenance": {"archived": {"kind": "observed", "observed_at": "2026-08-28T04:06:56.775945+00:00", "source": "github"}, "artifact_type": {"confidence": null, "enriched_at": "2026-08-30T02:27:04.207842+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "62dfc0628eac3510efeaab6c2e67a4d5c9e40bb9d5c671b4e915d2aced02d259", "fetched_at": "2026-08-28T04:06:56.775945+00:00", "kind": "readme", "missing": false, "url": "https://github.com/cisagov/Malcolm"}, {"content_hash": "5d52f3b4ab809d3a02b8bd01c29978e8e0a5bee51241d3dbb0684c962808ee57", "fetched_at": "2026-08-29T10:09:35.123514+00:00", "kind": "homepage", "missing": false, "url": "https://cisagov.github.io/Malcolm/"}], "taxonomy_version": 1}, "description": {"kind": "observed", "observed_at": "2026-08-28T04:06:56.775945+00:00", "source": "github"}, "domain": {"confidence": null, "enriched_at": "2026-08-30T02:27:04.207842+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "62dfc0628eac3510efeaab6c2e67a4d5c9e40bb9d5c671b4e915d2aced02d259", "fetched_at": "2026-08-28T04:06:56.775945+00:00", "kind": "readme", "missing": false, "url": "https://github.com/cisagov/Malcolm"}, {"content_hash": "5d52f3b4ab809d3a02b8bd01c29978e8e0a5bee51241d3dbb0684c962808ee57", "fetched_at": "2026-08-29T10:09:35.123514+00:00", "kind": "homepage", "missing": false, "url": "https://cisagov.github.io/Malcolm/"}], "taxonomy_version": 1}, "enriched": {"inputs": [], "kind": "computed", "method": "enrichment_status"}, "function": {"confidence": null, "enriched_at": "2026-08-30T02:27:04.207842+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "62dfc0628eac3510efeaab6c2e67a4d5c9e40bb9d5c671b4e915d2aced02d259", "fetched_at": "2026-08-28T04:06:56.775945+00:00", "kind": "readme", "missing": false, "url": "https://github.com/cisagov/Malcolm"}, {"content_hash": "5d52f3b4ab809d3a02b8bd01c29978e8e0a5bee51241d3dbb0684c962808ee57", "fetched_at": "2026-08-29T10:09:35.123514+00:00", "kind": "homepage", "missing": false, "url": "https://cisagov.github.io/Malcolm/"}], "taxonomy_version": 1}, "health_score": {"inputs": ["days_since_push", "days_since_release", "archived"], "kind": "computed", "method": "health_v1"}, "homepage": {"kind": "observed", "observed_at": "2026-08-28T04:06:56.775945+00:00", "source": "github"}, "language": {"kind": "observed", "observed_at": "2026-08-28T04:06:56.775945+00:00", "source": "github"}, "license": {"kind": "observed", "observed_at": "2026-08-28T04:06:56.775945+00:00", "source": "github"}, "license_family": {"inputs": ["license"], "kind": "computed", "method": "license_family"}, "maturity": {"confidence": null, "enriched_at": "2026-08-30T02:27:04.207842+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "62dfc0628eac3510efeaab6c2e67a4d5c9e40bb9d5c671b4e915d2aced02d259", "fetched_at": "2026-08-28T04:06:56.775945+00:00", "kind": "readme", "missing": false, "url": "https://github.com/cisagov/Malcolm"}, {"content_hash": "5d52f3b4ab809d3a02b8bd01c29978e8e0a5bee51241d3dbb0684c962808ee57", "fetched_at": "2026-08-29T10:09:35.123514+00:00", "kind": "homepage", "missing": false, "url": "https://cisagov.github.io/Malcolm/"}], "taxonomy_version": 1}, "member_repos": {"kind": "observed", "observed_at": "2026-08-28T04:06:56.775945+00:00", "source": "github"}, "name": {"kind": "observed", "observed_at": "2026-08-28T04:06:56.775945+00:00", "source": "github"}, "platform": {"confidence": null, "enriched_at": "2026-08-30T02:27:04.207842+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "62dfc0628eac3510efeaab6c2e67a4d5c9e40bb9d5c671b4e915d2aced02d259", "fetched_at": "2026-08-28T04:06:56.775945+00:00", "kind": "readme", "missing": false, "url": "https://github.com/cisagov/Malcolm"}, {"content_hash": "5d52f3b4ab809d3a02b8bd01c29978e8e0a5bee51241d3dbb0684c962808ee57", "fetched_at": "2026-08-29T10:09:35.123514+00:00", "kind": "homepage", "missing": false, "url": "https://cisagov.github.io/Malcolm/"}], "taxonomy_version": 1}, "pushed_at": {"kind": "observed", "observed_at": "2026-08-28T04:06:56.775945+00:00", "source": "github"}, "repo": {"kind": "observed", "observed_at": "2026-08-28T04:06:56.775945+00:00", "source": "github"}, "stars": {"kind": "observed", "observed_at": "2026-08-28T04:06:56.775945+00:00", "source": "github"}, "tags": {"confidence": null, "enriched_at": "2026-08-30T02:27:04.207842+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "62dfc0628eac3510efeaab6c2e67a4d5c9e40bb9d5c671b4e915d2aced02d259", "fetched_at": "2026-08-28T04:06:56.775945+00:00", "kind": "readme", "missing": false, "url": "https://github.com/cisagov/Malcolm"}, {"content_hash": "5d52f3b4ab809d3a02b8bd01c29978e8e0a5bee51241d3dbb0684c962808ee57", "fetched_at": "2026-08-29T10:09:35.123514+00:00", "kind": "homepage", "missing": false, "url": "https://cisagov.github.io/Malcolm/"}], "taxonomy_version": 1}, "topics": {"kind": "observed", "observed_at": "2026-08-28T04:06:56.775945+00:00", "source": "github"}, "urls": {"kind": "observed", "observed_at": "2026-08-28T04:06:56.775945+00:00", "source": "github"}, "use_cases": {"confidence": null, "enriched_at": "2026-08-30T02:27:04.207842+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "62dfc0628eac3510efeaab6c2e67a4d5c9e40bb9d5c671b4e915d2aced02d259", "fetched_at": "2026-08-28T04:06:56.775945+00:00", "kind": "readme", "missing": false, "url": "https://github.com/cisagov/Malcolm"}, {"content_hash": "5d52f3b4ab809d3a02b8bd01c29978e8e0a5bee51241d3dbb0684c962808ee57", "fetched_at": "2026-08-29T10:09:35.123514+00:00", "kind": "homepage", "missing": false, "url": "https://cisagov.github.io/Malcolm/"}], "taxonomy_version": 1}, "what_it_is": {"confidence": null, "enriched_at": "2026-08-30T02:27:04.207842+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "62dfc0628eac3510efeaab6c2e67a4d5c9e40bb9d5c671b4e915d2aced02d259", "fetched_at": "2026-08-28T04:06:56.775945+00:00", "kind": "readme", "missing": false, "url": "https://github.com/cisagov/Malcolm"}, {"content_hash": "5d52f3b4ab809d3a02b8bd01c29978e8e0a5bee51241d3dbb0684c962808ee57", "fetched_at": "2026-08-29T10:09:35.123514+00:00", "kind": "homepage", "missing": false, "url": "https://cisagov.github.io/Malcolm/"}], "taxonomy_version": 1}, "when_to_avoid": {"confidence": null, "enriched_at": "2026-08-30T02:27:04.207842+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "62dfc0628eac3510efeaab6c2e67a4d5c9e40bb9d5c671b4e915d2aced02d259", "fetched_at": "2026-08-28T04:06:56.775945+00:00", "kind": "readme", "missing": false, "url": "https://github.com/cisagov/Malcolm"}, {"content_hash": "5d52f3b4ab809d3a02b8bd01c29978e8e0a5bee51241d3dbb0684c962808ee57", "fetched_at": "2026-08-29T10:09:35.123514+00:00", "kind": "homepage", "missing": false, "url": "https://cisagov.github.io/Malcolm/"}], "taxonomy_version": 1}, "when_to_choose": {"confidence": null, "enriched_at": "2026-08-30T02:27:04.207842+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "62dfc0628eac3510efeaab6c2e67a4d5c9e40bb9d5c671b4e915d2aced02d259", "fetched_at": "2026-08-28T04:06:56.775945+00:00", "kind": "readme", "missing": false, "url": "https://github.com/cisagov/Malcolm"}, {"content_hash": "5d52f3b4ab809d3a02b8bd01c29978e8e0a5bee51241d3dbb0684c962808ee57", "fetched_at": "2026-08-29T10:09:35.123514+00:00", "kind": "homepage", "missing": false, "url": "https://cisagov.github.io/Malcolm/"}], "taxonomy_version": 1}}, "score": {"components": {"activity": 99, "longevity": 100, "rhythm": 99}, "computed_at": "2026-09-03T02:20:16.233290+00:00", "flags": ["no_license"], "formula": "round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)", "inputs": {"age_days": 2669, "days_push": 8, "days_rel": 8, "gap_med": 21.0, "n_releases_24m": 31}, "score": 99, "version": 2}, "staleness": {"enrichment_outdated": false, "low_confidence": false, "scrape_days": 9, "stale_scrape": false}}