arkime/arkime
Arkime
Arkime is a distributed packet analysis platform and full packet capture system designed for recording raw network traffic, indexing metadata, and performing network forensics. It functions as a network traffic indexer and security tool that enables the monitoring, querying, and browsing of large-scale network traffic across multi-cluster architectures.
The platform distinguishes itself through its ability to manage distributed capture clusters from a centralized administrative dashboard. It integrates external data feeds with internal traffic logs to identify known threats and provides a programmatic interface for exporting raw traffic streams and session metadata to external analysis software.
The system covers broad capability areas including network security monitoring, multi-cluster health observability, and traffic data search. It incorporates role-based access control to protect sensitive packet data and provides a web-based interface for packet capture browsing and forensic investigation.
Features
- Packet Capture Storage - Records raw network traffic across multiple nodes and stores the data in local packet files.
- Network Forensics - Provides a web-based interface for querying indexed data and analyzing full network packets.
- Network Session Indexing - Indexes network session metadata to enable rapid retrieval and analysis of specific communication events.
- Network Traffic Queries - Enables querying indexed packet data to identify patterns or anomalies within large-scale network captures.
- Distributed Capture Probes - Manages a distributed architecture of remote network sensors that forward traffic data to a central server.
- Full Packet Capture Systems - Provides a complete system for recording raw network packets, indexing metadata, and storing traffic for forensics.
- Packet Capture Utilities - Provides a web interface for browsing recorded raw network traffic and exporting data for external forensic analysis.
- Packet Capture Engines - Implements a high-performance engine for intercepting and recording raw network traffic.
- Packet Capture Utilities - Records and stores full raw network traffic for deep security analysis and detailed forensic investigations.
- Metadata Indexing - Extracts session metadata from raw packets into searchable indexes for fast querying of large traffic volumes.
- Role-Based Access Control - Restricts access to sensitive packet data and system configurations using role-based permissions.
- Cluster Health Monitoring - Features a centralized health dashboard to track node connectivity and performance across distributed capture points.
- Distributed Packet Analysis Platforms - Ships a multi-cluster architecture for centralized monitoring, querying, and browsing of large-scale network traffic.
- Indicator Feed Ingestion - Integrates high-fidelity indicator feeds with internal logs to identify known network threats.
- Traffic Stream APIs - Provides a programmatic interface to stream raw capture files and session metadata to third-party analysis software.
- System Access Restrictions - Implements technical controls using passwords, API keys, and proxies to restrict unauthorized system access.
- Dashboard Access Controls - Restricts the ability to modify system configurations and manage settings based on assigned user roles.
- Interface Access Security - Protects captured packet data and management interfaces via API keys, passwords, and authentication proxies.
- Session Metadata Exports - Allows downloading packet captures and session data in structured formats for external security tool integration.
- Traffic Data Export - Provides utilities for saving and interoperating network capture data via programmatic interfaces.
- Network Monitoring Tools - Large-scale full packet capture and search tool.
- Network Security Monitoring - Stores and indexes network traffic for fast forensic access.
