Malcolm
CISA/Idaho National Laboratory network traffic analysis tool suite
Malcolm has no official, structured tool listing we can auto-sync (unlike Kali, BlackArch, REMnux, and Tails). The tools below are maintained by hand and may be incomplete or outdated — check the official docs for the current tool set.
Last verified September 5, 2026
Malcolm is a joint CISA/Idaho National Laboratory project for deployable network traffic analysis, particularly aimed at industrial-control-system (ICS) environments. It bundles Zeek and Suricata for parsing and detection, Arkime for full-packet search, and CyberChef for ad-hoc data manipulation, all fronted by a unified OpenSearch/Kibana-based interface — similar in spirit to Security Onion, but container-based and host-OS-agnostic rather than a bootable distro of its own.
Use it only against networks you own or are explicitly authorized to monitor — see the disclaimer.
Notable bundled toolsmanually maintained
CyberChef
Decode and otherwise analyze data using this browser app.
suricata
An Open Source Next Generation Intrusion Detection and Prevention Engine.
zeek
A powerful network analysis framework that is much different from the typical IDS you may know.
Getting started
Malcolm isn't installed as a distro — it's a cluster of Docker containers deployed via `docker compose up`, ingesting full packet captures (PCAP), Zeek logs, and Suricata alerts through a browser-based upload interface or lightweight forwarders. The official docs (linked above) cover the container-by-container architecture, first-run configuration, and its Kibana-based dashboard for hunting and visualization.