Arkime

Arkime is a distributed packet analysis platform and full packet capture system designed for recording raw network traffic, indexing metadata, and performing network forensics. It functions as a network traffic indexer and security tool that enables the monitoring, querying, and browsing of large-scale network traffic across multi-cluster architectures.

The platform distinguishes itself through its ability to manage distributed capture clusters from a centralized administrative dashboard. It integrates external data feeds with internal traffic logs to identify known threats and provides a programmatic interface for exporting raw traffic streams and session metadata to external analysis software.

The system covers broad capability areas including network security monitoring, multi-cluster health observability, and traffic data search. It incorporates role-based access control to protect sensitive packet data and provides a web-based interface for packet capture browsing and forensic investigation.

Features

Packet Capture Storage - Records raw network traffic across multiple nodes and stores the data in local packet files.

Network Forensics - Provides a web-based interface for querying indexed data and analyzing full network packets.

Network Session Indexing - Indexes network session metadata to enable rapid retrieval and analysis of specific communication events.

Network Traffic Queries - Enables querying indexed packet data to identify patterns or anomalies within large-scale network captures.

Distributed Capture Probes - Manages a distributed architecture of remote network sensors that forward traffic data to a central server.

Full Packet Capture Systems - Provides a complete system for recording raw network packets, indexing metadata, and storing traffic for forensics.

Packet Capture Utilities - Provides a web interface for browsing recorded raw network traffic and exporting data for external forensic analysis.

Packet Capture Engines - Implements a high-performance engine for intercepting and recording raw network traffic.

Packet Capture Utilities - Records and stores full raw network traffic for deep security analysis and detailed forensic investigations.

Metadata Indexing - Extracts session metadata from raw packets into searchable indexes for fast querying of large traffic volumes.

Role-Based Access Control - Restricts access to sensitive packet data and system configurations using role-based permissions.

Cluster Health Monitoring - Features a centralized health dashboard to track node connectivity and performance across distributed capture points.

Distributed Packet Analysis Platforms - Ships a multi-cluster architecture for centralized monitoring, querying, and browsing of large-scale network traffic.

Indicator Feed Ingestion - Integrates high-fidelity indicator feeds with internal logs to identify known network threats.

Traffic Stream APIs - Provides a programmatic interface to stream raw capture files and session metadata to third-party analysis software.

System Access Restrictions - Implements technical controls using passwords, API keys, and proxies to restrict unauthorized system access.

Dashboard Access Controls - Restricts the ability to modify system configurations and manage settings based on assigned user roles.

Interface Access Security - Protects captured packet data and management interfaces via API keys, passwords, and authentication proxies.

Session Metadata Exports - Allows downloading packet captures and session data in structured formats for external security tool integration.

Traffic Data Export - Provides utilities for saving and interoperating network capture data via programmatic interfaces.

Network Security Monitoring - Stores and indexes network traffic for fast forensic access.

arkimearkime

Features

Star history