Malcolm
A powerful open-source network analysis tool suite for industrial control systems.
Making Network Analysis Accessible
Idaho National Laboratory partners with the Department of Homeland Security’s Cybersecurity Infrastructure Security Agency (CISA) to defend against today’s cyber threats and build a more secure and resilient infrastructure for the future.
INL’s national security expertise and capabilities support CISA with research and development of technologies, tools, and training to stay ahead of evolving cyber and physical threats. Malcolm, an open-source network traffic analysis tool suite, is a product of this collaboration.
It provides a framework of interconnectivity that makes it more powerful than the tools it uses can individually. Other network traffic analysis solutions exist but Malcolm’s easy deployment and robust combination of tools fill a void in the network security space that will make network analysis accessible to any user.
Malcolm Virtual Training for New and Existing Users
General Orentation | October 14, 2026
Technical Orientation | October 28, 2026
Capabilities and Assets
Malcolm provides an easily deployable suite of tools for full packet capture artifacts (PCAP files) and Zeek logs. While Internet access is required to build it, it is not required to run.
- Easy to use – Malcolm accepts network traffic data in the form of full packet capture (PCAP) files and Zeek (formerly Bro) logs. These artifacts can be uploaded via a simple browser-based interface or captured live and forwarded to Malcolm using lightweight forwarders. In either case, the data is automatically normalized, enriched and correlated for analysis.
- Powerful traffic analysis – Visibility into network communications is provided through two intuitive interfaces: Kibana, a flexible data visualization plug-in with dozens of prebuilt dashboards providing an at-a-glance overview of network protocols; and Arkime (formerly Moloch), a powerful tool for finding and identifying the network sessions comprising suspected security incidents.
- Streamlined deployment – Malcolm operates as a cluster of Docker containers, isolated sandboxes that each serve a dedicated function of the system. This Docker-based deployment model, combined with a few simple scripts for setup and run-time management, makes Malcolm suitable to be deployed quickly across a variety of platforms and use cases, whether it be for long-term deployment on a Linux server in a security operations center or for incident response on a MacBook for an individual engagement.
- Secure communications – All communications with Malcolm, both from the user interface and from remote log forwarders, are secured with industry standard encryption protocols.
- Permissive license – Comprised of several widely used open-source tools, Malcolm is an attractive alternative to security solutions requiring paid licenses.
- Expanding control systems visibility – While Malcolm is great for general-purpose network traffic analysis, its creators see a particular need in the community for tools providing insight into protocols used in industrial control systems (ICS) environments. Ongoing Malcolm development will aim to provide additional parsers for common ICS protocols.
Malcolm Tutorials and Resources
Custom IT architecture design and software development for infrastructure applications serves to solve complex challenges in critical infrastructure protection. These innovative applications are developed using modeling and simulation, information system analytics, and host data. Subject matter experts administer these certified applications and safely handle protected critical infrastructure information, sensitive regulatory and proprietary data.
Sponsoring Organizations
CISA is the operational lead for federal cybersecurity and the national coordinator for critical infrastructure security and resilience. CISA works with partners to defend against today’s threats and collaborate to build a more secure and resilient infrastructure for the future.
Air Force Life Cycle Management Center is one of six centers reporting to the Air Force Materiel Command. Led by a 3-star general officer, AFLCMC is charged with life cycle management of Air Force weapon systems from their inception to retirement.
Connect with our Team
Questions about registration or course details?
Our team is available to answer questions about training options, schedules and enrollment.
Malcolm Program Team
OT Cybersecurity Hunt and Incident Response