arkime/arkime
Arkime
Arkime is a distributed packet analysis platform and full packet capture system designed for recording raw network traffic, indexing metadata, and performing network forensics. It functions as a network traffic indexer and security tool that enables the monitoring, querying, and browsing of large-scale network traffic across multi-cluster architectures.
The platform distinguishes itself through its ability to manage distributed capture clusters from a centralized administrative dashboard. It integrates external data feeds with internal traffic logs to identify known threats and provides a programmatic interface for exporting raw traffic streams and session metadata to external analysis software.
The system covers broad capability areas including network security monitoring, multi-cluster health observability, and traffic data search. It incorporates role-based access control to protect sensitive packet data and provides a web-based interface for packet capture browsing and forensic investigation.
Features
- Packet Capture Storage - Records raw network traffic across multiple nodes and stores the data in local packet files.
- Network Forensics - Provides a web-based interface for querying indexed data and analyzing full network packets.
- Network Session Indexing - Indexes network session metadata to enable rapid retrieval and analysis of specific communication events.
- Network Traffic Queries - Enables querying indexed packet data to identify patterns or anomalies within large-scale network captures.
- Distributed Capture Probes - Manages a distributed architecture of remote network sensors that forward traffic data to a central server.
- Full Packet Capture Systems - Provides a complete system for recording raw network packets, indexing metadata, and storing traffic for forensics.
- Packet Capture Utilities - Provides a web interface for browsing recorded raw network traffic and exporting data for external forensic analysis.
- Packet Capture Engines - Implements a high-performance engine for intercepting and recording raw network traffic.
- Packet Capture Utilities - Records and stores full raw network traffic for deep security analysis and detailed forensic investigations.
- Metadata Indexing - Extracts session metadata from raw packets into searchable indexes for fast querying of large traffic volumes.
- Role-Based Access Control - Restricts access to sensitive packet data and system configurations using role-based permissions.
- Cluster Health Monitoring - Features a centralized health dashboard to track node connectivity and performance across distributed capture points.
- Distributed Packet Analysis Platforms - Ships a multi-cluster architecture for centralized monitoring, querying, and browsing of large-scale network traffic.
- Indicator Feed Ingestion - Integrates high-fidelity indicator feeds with internal logs to identify known network threats.
- Traffic Stream APIs - Provides a programmatic interface to stream raw capture files and session metadata to third-party analysis software.
- System Access Restrictions - Implements technical controls using passwords, API keys, and proxies to restrict unauthorized system access.
- Dashboard Access Controls - Restricts the ability to modify system configurations and manage settings based on assigned user roles.
- Interface Access Security - Protects captured packet data and management interfaces via API keys, passwords, and authentication proxies.
- Session Metadata Exports - Allows downloading packet captures and session data in structured formats for external security tool integration.
- Traffic Data Export - Provides utilities for saving and interoperating network capture data via programmatic interfaces.
- Network Monitoring Tools - Large-scale full packet capture and search tool.
- Network Security Monitoring - Stores and indexes network traffic for fast forensic access.
Star history
How this analysis was created: This summary and feature list are AI-generated from collected project material and can contain mistakes. Stars, license and language are imported from GitHub. Inclusion does not mean that we have tested or audited this project. Check the source documentation for any feature you depend on. Learn more on our About page.
