Malcolm

—

CISA's deployable network traffic analysis suite for PCAP, Zeek and Suricata

Python

Network traffic analysis tool suite from CISA for full packet capture artifacts. It ingests PCAP files, Zeek logs and Suricata alerts, enriches and indexes them, and presents dashboards for threat hunting and incident investigation across captured traffic.

Does

Analyze Monitor

Networks

For

Blue team Forensics