Alternatives to Arkime
Compare Arkime alternatives for your business or organization using the curated list below. SourceForge ranks the best alternatives to Arkime in 2026. Compare features, ratings, user reviews, pricing, and more from Arkime competitors and alternatives in order to make an informed decision for your business.
-
1
Paessler PRTG
Paessler GmbH
Paessler PRTG is an all-inclusive monitoring software solution developed by Paessler. Equipped with an easy-to-use, intuitive interface with a cutting-edge monitoring engine, PRTG optimizes connections and workloads as well as reduces operational costs by avoiding outages while saving time and controlling service level agreements (SLAs). The solution is packed with specialized monitoring features that include flexible alerting, cluster failover solution, distributed monitoring, in-depth reporting, maps and dashboards, and more. PRTG monitors your entire IT infrastructure. All important technologies are supported: • SNMP: ready-to-use and custom options • WMI and Windows Performance Counters • SSH: for Linux/Unix and macOS systems • Traffic analysis using flow protocols or packet sniffing • HTTP requests • REST APIs returning XML or JSON • Ping, SQL, and many moreStarting Price: $2149 for PRTG 500 -
2
NetworkMiner
Netresec
NetworkMiner is a network forensics tool that extracts artifacts such as files, images, emails, and passwords from captured network traffic in PCAP files. It can also capture live network traffic by sniffing a network interface. Detailed information about each IP address in the analyzed network traffic is aggregated into a network host inventory, which can be used for passive asset discovery and to get an overview of communicating devices. NetworkMiner is primarily designed to run on Windows but can also be used on Linux. Since its first release in 2007, it has become a popular tool among incident response teams and law enforcement and is used by companies and organizations worldwide.Starting Price: $1,300 one-time payment -
3
Riverbed Packet Analyzer
Riverbed
Riverbed Packet Analyzer accelerates real-time network packet analysis and reporting of large trace files through an intuitive graphical user interface and a broad selection of pre-defined analysis views. It enables users to quickly identify and troubleshoot complex network and application performance issues down to the bit level, with full integration with Wireshark. By simply dragging and dropping preconfigured analysis views onto a group of virtual interfaces or a packet trace file, users can see results immediately, transforming hours of work into seconds. The tool facilitates the capture and merging of multiple trace files, allowing for precise pinpointing of problems across multiple segments. Additionally, it provides the capability to zoom into a 100-microsecond view of the network to identify utilization spikes or microbursts that can saturate a gigabit network and cause significant issues. -
4
Sniffnet
Sniffnet
Sniffnet is a network monitoring tool designed to help users easily keep track of their Internet traffic. Whether gathering statistics or inspecting in-depth network activities, Sniffnet provides comprehensive coverage. It emphasizes user experience, ensuring ease of use compared to other cumbersome network analyzers. Completely free and open source, Sniffnet is dual-licensed under MIT or Apache-2.0, with the full source code available on GitHub. Developed entirely in Rust, it leverages this modern programming language to build efficient and reliable software, emphasizing performance and safety. Key features include selecting a network adapter to inspect, applying filters to observed traffic, viewing overall statistics and real-time charts of Internet traffic, exporting comprehensive capture reports as PCAP files, identifying over 6,000 upper-layer services, protocols, trojans, and worms, discovering domain names and ASNs of hosts, pinpointing connections in the local network.Starting Price: Free -
5
Azure Network Watcher
Microsoft
Monitor and diagnose networking issues without logging in to your virtual machines (VMs) using Network Watcher. Trigger packet capture by setting alerts, and gain access to real-time performance information at the packet level. When you see an issue, you can investigate in detail for better diagnoses. Build a deeper understanding of your network traffic pattern using network security group flow logs and virtual network flow logs. Information provided by flow logs helps you gather data for compliance, auditing and monitoring your network security profile. Network Watcher provides you the ability to diagnose your most common VPN gateway and connections issues. Allowing you, not only, to identify the issue but also to use the detailed logs created to help further investigate.Starting Price: $0.50 per GB -
6
Omnipeek
LiveAction
Omnipeek is a network protocol analyzer from LiveAction designed to deliver deep packet analysis and rapid troubleshooting on Windows systems. It captures and analyzes packet data in real time to help identify network, application, and security issues. Omnipeek provides intuitive visualizations that make complex network data easy to understand and act on. The platform records exactly what happened on the network, enabling detailed forensic analysis after incidents occur. Built-in expert analysis automatically detects hundreds of common network problems and triggers alerts when policies are violated. Omnipeek supports voice, video, wireless, and high-speed networks, including multi-gigabit environments. It is designed to significantly reduce mean time to resolution for even the most complex network issues. -
7
Xplico
Xplico
Xplico is installed in the major distributions of digital forensics and penetration testing: Kali Linix, BackTrack, DEFT, Security Onion, Matriux, BackBox, CERT Forensics Tools, Pentoo and CERT-Toolkit. Xplico allows concurrent access by multiple users. Any user can manage one or more Cases. The UI is a Web User Interface and its backend DB can be SQLite, MySQL or PostgreSQL. Xplico can be used as a Cloud Network Forensic Analysis Tool. The goal of Xplico is extract from an internet traffic capture the applications data contained. For example, from a pcap file Xplico extracts each email (POP, IMAP, and SMTP protocols), all HTTP contents, each VoIP call (SIP), FTP, TFTP, and so on. Xplico isn’t a network protocol analyzer. Xplico is an open source Network Forensic Analysis Tool (NFAT). At each data reassembled by Xplico is associated a XML file that uniquely identifies the flows and the pcap containing the data reassembled. -
8
WinDump
WinPcap
WinDump is the Windows version of tcpdump, the command line network analyzer for UNIX. WinDump is fully compatible with tcpdump and can be used to watch, diagnose and save to disk network traffic according to various complex rules. It can run under Windows 95, 98, ME, NT, 2000, XP, 2003 and Vista. WinDump captures using the WinPcap library and drivers, which are freely downloadable from the WinPcap website. WinDump supports 802.11b/g wireless capture and troubleshooting through the Riverbed AirPcap adapter. WinDump is free and is released under a BSD-style license. WinDump is able to use the interfaces exported by WinPcap. WinDump can run on all the operating systems supported by WinPcap. WinDump is the porting of tcpdump. It is possible to launch more than one session (on the same network adapter or on different adapters). Except for the increased CPU load, there are no drawbacks in using multiple applications at the same time.Starting Price: Free -
9
Snort
Cisco
Snort is the foremost Open Source Intrusion Prevention System (IPS) in the world. Snort IPS uses a series of rules that help define malicious network activity and uses those rules to find packets that match against them and generates alerts for users. Snort can be deployed inline to stop these packets, as well. Snort has three primary uses: As a packet sniffer like tcpdump, as a packet logger — which is useful for network traffic debugging, or it can be used as a full-blown network intrusion prevention system. Snort can be downloaded and configured for personal and business use alike. Once downloaded and configured, Snort rules are distributed in two sets: The “Community Ruleset” and the “Snort Subscriber Ruleset.” The Snort Subscriber Ruleset is developed, tested, and approved by Cisco Talos. Subscribers to the Snort Subscriber Ruleset will receive the ruleset in real-time as they are released to Cisco customers. -
10
CommView
TamoSoft
CommView is a powerful network monitor and analyzer designed for LAN administrators, security professionals, network programmers, home users…virtually anyone who wants a full picture of the traffic flowing through a PC or LAN segment. Loaded with many user-friendly features, CommView combines performance and flexibility with an ease of use unmatched in the industry. This application captures every packet on the wire to display important information such as a list of packets and network connections, vital statistics, protocol distribution charts, and so on. You can examine, save, filter, import and export captured packets, view protocol decodes down to the lowest layer with full analysis of over 100 supported protocols. With this information, CommView can help you pinpoint network problems and troubleshoot software and hardware. The newest CommView version 7.0 introduced SSL/TLS traffic decryption on the fly. -
11
tcpdump
tcpdump
Tcpdump is a powerful command-line packet analyzer that allows users to display the contents of network packets transmitted or received over a network to which the computer is attached. It operates on most Unix-like systems, including Linux, Solaris, FreeBSD, NetBSD, OpenBSD, and macOS, utilizing the libpcap library for network traffic capture. Tcpdump can read packets from a network interface card or from a previously created saved packet file, and it provides options to write packets to standard output or a file. Users can apply BPF-based filters to limit the number of packets processed, enhancing usability on networks with high traffic volumes. The tool is distributed under the BSD license, making it free software. In many operating systems tcpdump is available as a native package or port, which simplifies installation of updates and long-term maintenance.Starting Price: Free -
12
Capsa
Colasoft
Capsa, a portable network performance analysis and diagnostics tool, provides tremendously powerful and comprehensive packet capture and analysis solution with an easy to use interface allowing both veteran and novice users the ability to protect and monitor networks in a critical business environment. Capsa aids in keeping you assessed of threats that may cause significant business outage. Capsa is a portable network analyzer application for both LANs and WLANs which performs real-time packet capturing capability, 24x7 network monitoring, advanced protocol analysis, in-depth packet decoding, and automatic expert diagnosis. Capsa's comprehensive high-level window view of entire network, gives quick insight to network administrators or network engineers allowing them to rapidly pinpoint and resolve application problems. With the most user-friendly interface and the most powerful data packet capture and analysis engine in the industry, Capsa is a necessary tool for network monitoring. -
13
Corvil Analytics
Pico
The Intelligence Hub is a real-time trade analytics solution that models and correlates client trading behavior, plant performance and venue counterparty execution to enable proactive business management and operations. Corvil is an open data system providing API access to all analytics, trading and market data messages and the underlying packets. The Streaming Data API supports a growing library of Corvil Connectors enabling streaming Corvil data directly from the network packets into your chosen big data solution. Corvil Center provides a single point of access to all analytics and reporting with a couple of clicks to visualize any of the petabytes of granular packet data captured by Corvil. Corvil Instrumentation offers superior price/performance packet analysis and capture Appliances, software defined packet sniffers (Corvil Sensor) to extend the reach to virtual and cloud environments, and the Corvil AppAgent for internal multi-hop software instrumentation. -
14
Wireshark
Wireshark
Wireshark is the world’s foremost and widely-used network protocol analyzer. It lets you see what’s happening on your network at a microscopic level and is the de facto (and often de jure) standard across many commercial and non-profit enterprises, government agencies, and educational institutions. Wireshark development thrives thanks to the volunteer contributions of networking experts around the globe and is the continuation of a project started by Gerald Combs in 1998. Wireshark® is a network protocol analyzer. It lets you capture and interactively browse the traffic running on a computer network. It has a rich and powerful feature set and is world’s most popular tool of its kind. It runs on most computing platforms including Windows, macOS, Linux, and UNIX. Network professionals, security experts, developers, and educators around the world use it regularly. It is freely available as open source, and is released under the GNU General Public License version 2. -
15
MixMode
MixMode
Unparalleled network visibility, automated threat detection, and comprehensive network investigation powered by Unsupervised Third-wave AI. MixMode's Network Security Monitoring platform provides comprehensive visibility allowing users to easily identify threats in real time with Full Packet Capture and Metadata for longer term storage. Intuitive UI and easy to use query language help any security analyst perform deep investigations and understand the full lifecycle of threats and network anomalies. Using our best-in-class Third-Wave AI, MixMode intelligently identifies Zero-Day Attacks in real time by understanding normal network behavior and intelligently surfacing any anomalous activity outside of the norm. Developed for projects at DARPA and the DoD, MixMode's Third-Wave AI needs no human training and can baseline your network in only 7 days, enabling 95% alert precision and reduction and identification of zero-day attacks. -
16
Omnis Cyber Intelligence
NETSCOUT
Omnis CyberStream and Omnis Cyber Intelligence form NETSCOUT’s advanced Network Detection and Response (NDR) platform built on deep packet inspection. The platform delivers pervasive, packet-level visibility to eliminate blind spots across data centers, cloud environments, remote users, and network edges. By combining real-time adaptive threat detection with continuous packet capture, it enables faster and more accurate incident response. Omnis Cyber Intelligence identifies and prioritizes threats at the source using layered machine learning, threat intelligence, and deterministic analysis. Always-on packet and metadata collection ensures security teams have full context before, during, and after an incident. Integrated investigation workflows reduce alert noise and shorten the gap between detection and response. The platform empowers SOC teams to investigate, respond, and prevent threats with confidence and precision. -
17
EtherApe
EtherApe
EtherApe is a graphical network monitor for Unix systems, modeled after Etherman, that displays network activity graphically, with hosts and links changing in size based on traffic volume and color-coded protocols. It supports various devices, including FDDI, ISDN, PPP, SLIP, and WLAN, as well as several encapsulation formats. Users can filter displayed traffic and capture data live from the network or read from a file. Node statistics can be exported for further analysis. The tool offers link layer, IP, and TCP modes, allowing users to focus on specific protocol stack levels. It provides detailed information on each node and link, including protocol breakdown and traffic statistics. EtherApe is open source software released under the GNU General Public License. A single node can be centered on the display and several user-chosen nodes can be arranged in an inner circle with other nodes around. An alternative display mode arranges nodes in "columns".Starting Price: Free -
18
VIAVI Observer Platform
VIAVI Solutions
The Observer Platform is a comprehensive network performance monitoring and diagnostics (NPMD) solution ideal for maintaining peak performance of all IT services. Designed as an integrated offering, the Observer Platform provides visibility into critical KPIs through pre-defined workflows from high-level dashboards to service anomaly root cause. Ideally suited to satisfying business goals and overcoming challenges across the entire IT enterprise life cycle whether deploying new technologies, managing current resources, solving service anomalies, or optimizing IT asset usage. The Observer Management Server (OMS) UI is a cyber security tool that features simple navigation to easily authenticate security threats, control user access and password data, administer web application upgrades, and streamline management tools from a single, centralized location. -
19
Booz Allen MDR
Booz Allen Hamilton
Protect your network with complete visibility and layered detection. Our customized managed detection and response (MDR) service gives you advanced threat detection, investigation, and response delivered via out-of-band network sensors which provide full visibility to network communications. We focus on malicious activity happening inside and around your environment to protect you from known and unknown threats. Receive instant detection using full packet capture, blended detection tools, SSL decryption, and the advantages of Booz Allen’s Cyber Threat Intelligence service. Industry-leading threat analysts will investigate and contain your network’s security events, giving you more accurate and applicable intelligence. The Booz Allen team provides threat investigation services, contextual intelligence, reverse engineering, and the ability to write rules and custom signatures to stop attacks in real time. -
20
SolarWinds Network Performance Monitor (NPM)
SolarWinds
Network Performance Monitor (NPM) by SolarWinds delivers advanced network troubleshooting for on-premises, hybrid, and cloud services using critical path hop-by-hop analysis. Powerful and affordable, this modern network monitoring software enables IT organizations to quickly detect, diagnose, and resolve network issues and outages, thereby improving network performance. SolarWinds’ Network Performance Monitor offers a host of features such as Performance analysis dashboard, NetPath critical path visualization, Intelligent alerts, Multi-vendor network monitoring, Network Insight for Cisco ASA and F5 BIG-IP.Starting Price: $2895.00/one-time -
21
NetWitness
NetWitness
NetWitness Platform brings together evolved SIEM and threat defense solutions that deliver unsurpassed visibility, analytics and automated response capabilities. These combined capabilities help security teams work more efficiently and effectively, up-leveling their threat hunting skills and enabling them to investigate and respond to threats faster, across their organization’s entire infrastructure—whether in the cloud, on premises or virtual. Gives security teams the visibility they need to detect sophisticated threats hiding in today’s complex, hybrid IT infrastructures. Analytics, machine learning, and orchestration and automation capabilities make it easier for analysts to prioritize and investigate threats faster. Detects attacks in a fraction of the time of other platforms and connects incidents to expose the full attack scope. NetWitness Platform accelerates threat detection and response by collecting and analyzing data across more capture points. -
22
Ekahau
Ekahau
Precise Wi-Fi diagnostics paired with mobile-optimized apps deliver significantly faster site surveys, faster spectrum analysis, and more accurate and reliable data. Robust, professional gear that anyone can use, developed by Wi-Fi enthusiasts who consistently innovate and redefine what it means to be industry-standard. Well-designed and optimized networks reduce business-stopping downtime, giving you the assurance that your Wi-Fi is always high-performing. Ditch the dongles and upgrade to the most precise Wi-Fi diagnostics and measurement device for faster, more accurate Wi-Fi site surveys and spectrum analysis. Everything you need to design, validate, optimize, troubleshoot, and collaborate on your wireless network is included with Connect. -
23
Elastic Security
Elastic
Elastic Security equips analysts to prevent, detect, and respond to threats. The free and open solution delivers SIEM, endpoint security, threat hunting, cloud monitoring, and more. Elastic makes it simple to search, visualize, and analyze all of your data — cloud, user, endpoint, network, you name it — in just seconds. Hunt and investigate across years of data made accessible by searchable snapshots. With flexible licensing, leverage information from across your ecosystem, no matter its volume, variety, or age. Avoid damage and loss with environment-wide malware and ransomware prevention. Quickly implement analytics content developed by Elastic and the global security community for protection across MITRE ATT&CK®. Detect complex threats with analyst-driven, cross-index correlation, ML jobs, and technique-based methods. Empower practitioners with an intuitive UI and partner integrations that streamline incident management. -
24
Trisul Network Analytics
Trisul Network Analytics
In today's bandwidth unconstrained, encrypted, cloud-centric networks you can no longer separate traffic analytics from security and investigation activities. Trisul helps organizations of all sizes deploy full-spectrum deep network monitoring which can serve as a single goto source of truth for performance monitoring, network design, security analytics, threat detection, and compliance. Traditional approaches based on SNMP, Netflow, Agents, or Packet Capture have a narrow focus and rigid vendor-supplied analytics. Trisul is the only platform that provides a rich and open platform you can innovate upon. Includes a tightly integrated backend datastore and a web UI. Yet, open enough to plug into a different backend or to drive Kibana, Grafana UIs. Our design goal is to pack as much performance as we can in a single node. For larger networks scale out by adding more probes and hubs.Starting Price: $950 one-time payment -
25
FortiNDR
Fortinet
FortiNDR identifies cybersecurity incidents in-progress based on anomalous network activity, speeding incident investigation and response. FortiNDR enables full-lifecycle network protection, detection, and response. It leverages AI, ML, behavioral, and human analysis to analyze network traffic so security teams can spot attacker behavior and remediate the threat. FortiNDR provides network-traffic and file-based analysis, root-cause identification, scope of incidents, and the tools to remediate incidents quickly. FortiNDR includes our Virtual Security Analyst that can identify malicious network activity and files, resulting in real-time identification of advanced threats, including zero-day attacks. FortiNDR Cloud combines ML/AI with human analysis and expertise to improve your security posture and reduce false positives. Seasoned, advanced threat researchers from FortiGuard Labs monitor cybercriminal activity, perform reverse engineering, and continuously update detection rules. -
26
NextRay NDR
NextRay AI
NextRay NDR is a Network Detection & Response (NDR) solution that automates incident response, provides comprehensive visibility across North/South & East/West traffic, easily integrated with legacy platforms and other security solutions, offers detailed investigations of your network vulnerabilities, in addition to its advanced threat hunting, swift deployment, real-time correlation across all ports and protocols, and advanced file extraction and analysis. With NextRay NDR, SOC teams can detect and respond to cyberattacks across all network environments with ease. -
27
Fiddler
Progress Software
Capture all HTTP(S) traffic between your computer and the Internet with Telerik Fiddler HTTP(S) proxy. Inspect traffic, set breakpoints, and fiddle with requests & responses. Fiddler Everywhere is a web debugging proxy for macOS, Windows, and Linux. Capture, inspect, monitor all HTTP(S) traffic between your computer and the Internet, mock requests, and diagnose network issues. Fiddler Everywhere can be used for any browser, application, process. Debug traffic from macOS, Windows, or Linux systems and iOS or Android mobile devices. Ensure the proper cookies, headers, and cache directives are transferred between the client and server. Supports any framework, including .NET, Java, Ruby, etc. Mock or modify requests and responses on any website. It’s a quick and easy way to change the request and responses to test websites without changing code. Use Fiddler Everywhere to log all HTTP/S traffic between your computer and the Internet.Starting Price: $12 per user per month -
28
NETSCOUT Omnis Security
Netscout
Doing business in a digital economy requires agility, and corporate digital structures have changed significantly to provide it. However, as companies rush to transition to the cloud and expand activities in a globally distributed digital ecosystem, they must also reinvent cybersecurity to defend against emerging threats. NETSCOUT Omnis Security is an advanced attack analysis and response platform that provides the scale, scope, and consistency needed to protect today's digital infrastructure. Highly scalable network instrumentation that offers a comprehensive view of all distributed digital infrastructures. Threat detection with selected intelligence, behavioral analytics, open source data, and advanced statistics. Contextual threat detection and investigation using a robust source of metadata and packages. Automated edge blocking with the best stateless packet processing technology, or third-party blocking devices. -
29
SmartEvent
Check Point Software Technologies
SmartEvent event management provides full threat visibility with a single view into security risks. Take control and command the security event through real-time forensic and event investigation, compliance, and reporting. Respond to security incidents immediately and gain network true insights. SmartEvent provides a single view into security risks. Take control and understand your security status and trends. Respond to security incidents immediately and gain network true insights. Always the latest security management keeps you automatically up-to-date. On-demand expansion to seamlessly onboard more gateways. Zero maintenance makes your environments more secure, manageable and compliant. -
30
The Respond Analyst
Respond
Accelerate investigations and improve analyst productivity with a XDR Cybersecurity Solution. The Respond Analyst™, an XDR Engine, automates the discovery of security incidents by turning resource-intensive monitoring and initial analysis into thorough and consistent investigations. Unlike other XDR solutions, the Respond Analyst connects disparate evidence using probabilistic mathematics and integrated reasoning to determine the likelihood that events are malicious and actionable. The Respond Analyst augments security operations teams by significantly reducing the need to chase false positives resulting in more time for threat hunting. The Respond Analyst allows you to choose best-of-breed controls to modernize your sensor grid. The Respond Analyst integrates with the leading security vendor offerings across important categories such as EDR, IPS, Web Filtering, EPP, Vulnerability Scanning, Authentication, and more. -
31
Riverbed NetProfiler
Riverbed Technology
Cybercriminals are constantly looking for new ways to beat your defenses. You build them; they find the cracks. That’s why you need a network security solution that keeps your network secure and available. Riverbed NetProfiler transforms network data into security intelligence, providing essential visibility and forensics for broad threat detection, investigation, and mitigation. By capturing and storing all network flow and packet data across your enterprise, it delivers the crucial insights to detect and investigate advanced persistent threats that bypass typical preventative measures, as well as those that originate inside the network. DDoS attacks are a leading cause of business disruption. They frequently target critical infrastructures like power plants, healthcare facilities, education institutions and government entities. -
32
Elastiflow
Elastiflow
The most complete network observability solution for use with modern data platforms, providing unprecedented insights at any scale. ElastiFlow allows organizations to achieve unprecedented levels of network performance, availability, and security. ElastiFlow provides granular information about network traffic flows, including source and destination IP addresses, ports, protocols, and the amount of data transmitted. This information allows network administrators to gain deep insights into the network's performance and identify potential issues. ElastiFlow is highly valuable for diagnosing and troubleshooting network issues such as congestion, high latency, or packet loss. By analyzing the network traffic, administrators can pinpoint the cause of the problem and take appropriate action to resolve it. By leveraging ElastiFlow, organizations can improve their security posture, detect and respond to threats more effectively, and maintain compliance with regulatory requirements.Starting Price: Free -
33
Hacker Target
Hacker Target
Simplify the security assessment process with hosted vulnerability scanners. From attack surface discovery to vulnerability identification, actionable network intelligence for IT & security operations. Proactively hunt for security weakness. Pivot from attack surface discovery to vulnerability identification. Find security holes with trusted open source tools. Get access to tools used by penetration testers and security professionals around the world. Hunt vulnerabilities from the attackers perspective. Simulating real world security events, testing vulnerabilities and incident response. Discover the attack surface with tools and open source intelligence. Protect your network with improved visibility. Over 1 million scans performed last year. Our vulnerability scanners have been launching packets since 2007. Fixing security issues requires you find them. Identify the issue, re-mediate the risk and test again to be sure.Starting Price: $10 per month -
34
SCADAfence
SCADAfence
SCADAfence is the global technology leader in OT & IoT cyber security. SCADAfence offers a full suite of industrial cybersecurity products that provides full coverage of large-scale networks, offering best-in-class network monitoring, asset discovery, governance, remote access and IoT device security. SCADAfence offers a full suite of industrial cybersecurity products that provides full coverage of large-scale networks, offering best-in-class network monitoring, asset discovery, governance, remote access and IoT device security. Reduce your organization's mean time to detect (MTTD) and mean time to recovery (MTTR) by working with a team of seasoned veterans who are OT security subject matter experts. In your monthly OT security report, you will have a better understanding of each OT asset in your network while providing you with proper remediation of threats before the vulnerabilities can be exposed. -
35
WireEdit
Omnipacket
WireEdit allows WYSIWYG editing of Pcap data in situ for any network stack at any stack layer while preserving the binary integrity of the data. Data editing is done in a break-proof manner with the lengths, checksums, offsets, and other inter and intra-packet dependencies recalculated on-the-fly for all affected packets and protocol layers. One could think of WireEdit as a Microsoft Word™ for captured network data. All other packet editing tools are very limited in their ability to edit binary encoded stack layers above TCP/UDP without breaking packets' integrity. WireEdit is a full-stack packet editor by design. It doesn't break packets' integrity at any layer. WireEdit with IETF protocols support is $95/day (24 hours). Other packages/durations as well as site licenses are available. WireEdit is a proprietary, enterprise level captured network traffic editor. Full support for all 4G/LTE 3GPP Mobile Core protocols and interfaces including SS7, RANAP, DIAMETER, and VoLTE.Starting Price: $95 per day -
36
Telesoft CERNE
Telesoft
With the rise in the global datasphere only set to accelerate with the advances in IoT and 5G technology, the cyber threat landscape will also continue to grow. Our intrusion detection system, the CERNE, helps protect, secure and guard our customers from attack. The CERNE provides real-time monitoring and historical intrusion detection capabilities helping security analysts detect intrusions, identify suspicious activity and monitor network security by storing IDS alert traffic while reducing unnecessary storage. The Telesoft CERNE combines a high rate 100Gbps IDS engine with an automated record of relevant network traffic for real-time and historical threat investigation and digital forensics. CERNE continuously scans and captures network packets and only stores traffic associated with an IDS alert, discarding all other traffic, giving an analyst rapid access to critical packets up to 2.4 seconds before an event. -
37
Cydarm
Cydarm
Cydarm is a cybersecurity incident response management platform designed to help security operations teams coordinate and manage cyber incidents more effectively across an organization. It supports the full lifecycle of incident response, enabling teams to detect, analyze, investigate, respond to, and report on cybersecurity events within a unified environment. It functions as a secure case management system where alerts from different security tools can be consolidated, investigated, and tracked as incidents, providing visibility into threats occurring across a network. Cydarm integrates with existing security infrastructure such as SIEM systems, messaging tools, authentication platforms, and IT service management solutions, allowing alerts and cases to be created automatically and enabling teams to collaborate through their existing operational tools. -
38
Radiant Security
Radiant Security
Sets up in minutes and works day one to boost analyst productivity, detect real incidents, and enable rapid response. Radiant’s AI-powered SOC co-pilot streamlines and automates tedious tasks in the SOC to boost analyst productivity, uncover real attacks through investigation, and enable analysts to respond more rapidly. Automatically inspect all elements of suspicious alerts using AI, then dynamically selects & performs dozens to hundreds of tests to determine if an alert is malicious. Analyze all malicious alerts to understand detected issues’ root causes and complete incident scope with all affected users, machines, applications, and more. Stitch together data sources like email, endpoint, network, and identity to follow attacks wherever they go, so nothing gets missed. Radiant dynamically builds a response plan for analysts based on the specific containment and remediation needs of the security issues uncovered during incident impact analysis. -
39
EndaceProbe
Endace
EndaceProbes record 100% accurate Network History to solve Cybersecurity, Network and Application issues. Bring clarity to every incident, alert or issue with an open packet capture platform that integrates with all your commercial, open source or custom-built tools. See exactly what’s happening on the network so you can investigate and defend against even the toughest Security Threats. Capture vital network evidence, so you can quickly resolve Network and Application Performance issues or outages. The open EndaceProbe Platform brings tools, teams and workflows together into an integrated Ecosystem. Network History available at your fingertips from all your tools. Built into existing workflows so teams don’t have to learn more tools. A powerful open platform to deploy your favorite security or monitoring tools on. Record weeks or months of rapidly searchable, accurate network history across your entire network. -
40
InterceptSuite
InterceptSuite
InterceptSuite is a comprehensive MITM proxy and TLS interception tool designed for security professionals, developers, system administrators, and network engineers. It features advanced SOCKS5 proxy capabilities with Python extension support, allowing users to write custom protocol dissectors and analysers for any TLS-encrypted protocol. The platform offers cross-platform compatibility across Windows, macOS, and Linux, with both free open-source and professional editions available. Key features include TLS packet interception, Universal TLS Upgrade Detection for protocols like SMTPS, IMAP, PostgreSQL TLS, and STARTTLS, plus PCAP file export for analysis with external tools like Wireshark.Starting Price: $10/month -
41
Pivot.GG
Pivot.GG
Pivot.GG is a cybersecurity investigation platform that helps security analysts go from a single indicator of compromise (IOC) to actionable answers faster and with less guesswork. It provides guided, context-aware investigation workflows that automate IOC triage, threat analysis, scoping, and detection engineering. Pivot.GG is delivered as a browser-based Software-as-a-Service (SaaS) product for SOC analysts, incident responders, and threat hunters.Starting Price: $39/month -
42
Qintel CrossLink
Qintel
When users first open CrossLink they are met with the words “Know More.” This ethos powers CrossLink. How can we help everyone, be it a SOC analyst, an investigator, or an incident responder, tell a better story around their own data? Search results from six synergistic verticals of network and actor-centric data quickly provide key information that can be assembled and shared across an organization with the click of a button. CrossLink was designed to address the deficiencies in the current marketplace by a team of analysts who have decades of hands-on experience investigating a full range of threats. Data verticals include an unparalleled range of actor profiles, communications, historical Internet registration records, IP reputation, digital currency records, and passive DNS telemetry that jump-start investigations into actors and incidents. CrossLink provides users with the ability to create alerts and lightweight management functions via shareable case folders. -
43
SecBI XDR
SecBI
Your cyber defense is filled with disparate point solutions covering single vectors making easy targets for hackers. But that can end today. Add the glue to connect and integrate your security tools with the SecBI XDR Platform. SecBI XDR applies behavioral analytics on all data sources: security gateways, end points and cloud under a single pane of glass for continuous, automated and smarter threat detection, investigation and response. Work across the network, endpoints and the cloud to head off the stealthy, low & slow cyberattacks with SecBI’s XDR platform. Benefit from rapidly deployed, orchestrated integration of your siloed cyber solutions (mail and web gateways, EDRs, SIEM, SOAR) by responding and blocking the threats faster across a wider range of vectors. Gain full network visibility, automated threat hunting, and multi-source detection uncovering malware such as file-less and BIOS-level viruses. -
44
VIXN
Fermata Discovery
VIXN is a comprehensive investigative case management platform that: • Maps all case data to display nexus and knowledge gaps • Sources case data and structures information for analysis • Filters, indexes, and visualizes data to expose insights • Organizes casework and enables investigation collaboration • Generates actionable entity profiles and automated client reports The VIXN engine is an identity resolution platform that automatically aggregates data on entities-of-interest involved in an investigation and crunches high volumes of information for vital clues. Powered by open source and proprietary data streams, the VIXN engine is delivered in UI and API formats.Starting Price: Call for pricing -
45
Videris
Blackdot Solutions
Videris is an enterprise-grade open-source intelligence platform designed to help organizations collect, analyze, and visualize public and deep-web data to uncover hidden risks and networks. It enables users to search across corporate registries, surface web, deep and dark web, and social media, then layer internal or niche data sources for enriched context. Featured capabilities include AI-driven risk analysis, automated entity disambiguation, network visualization tools that map connections between people, organizations, and events, secure browsing of live web content without revealing investigator identity, and automated reporting that preserves evidential integrity with full sourcing and audit logs. It offers two modes: an “Automate” workflow for high-volume, repeat investigations and a “Investigate” mode for expert-driven deep dives into complex cases. -
46
Storyzy
Storyzy
Automated, AI-based research tools allow for easier, faster, and more effective open-source research. Thousands of categorized sources—websites, blogs, video channels, social networks, are automatically indexed and archived, and continually added to Storyzy’s platform database. This allows users to add on to it and customize their own source lists. All in 42 languages. Granular investigations are made possible, allowing the identification of clues, markers, and hard evidence of information manipulation, on websites, blogs, social media documents, but also in images and visuals. For over ten years now, Storyzy’s teams have been designing and developing tools to fight online information manipulation. Artificial and human intelligence combined are the indispensable ingredients that made it possible to build the Storyzy platform with its actual users. -
47
Wazuh
Wazuh
Wazuh is a free, open source and enterprise-ready security monitoring solution for threat detection, integrity monitoring, incident response and compliance. Wazuh is used to collect, aggregate, index and analyze security data, helping organizations detect intrusions, threats and behavioral anomalies. As cyber threats are becoming more sophisticated, real-time monitoring and security analysis are needed for fast threat detection and remediation. That is why our light-weight agent provides the necessary monitoring and response capabilities, while our server component provides the security intelligence and performs data analysis. Wazuh addresses the need for continuous monitoring and response to advanced threats. It is focused on providing the right visibility, with the insights to help security analysts discover, investigate and response to threats and attack campaigns across multiple endpoints. -
48
WireX Systems
WireX Systems
Powerful central hub to streamline the entire investigation and response processes and to accelerate knowledge sharing across team members. The framework includes integration points with the various SIEM vendors to import tickets details (as well as export them back at the end of the process) investigation management system, playbook modeling capabilities, as well as enrichment tools like Sandbox technologies, IP and host reputation, geo-location and other threat feeds. Contextual Capture™ provides the world’s largest organizations the technology foundation to collect and automatically analyze network data for security investigations. Using the WireX Systems Contextual Capture ™ technology you can break through the limitations of full packet capture, store payload level information for periods of months and remove the complexities of sifting through the packets in order to “glue” them back together. -
49
Active Wall
Active Network CO
Active Wall uses the middle layer drivers developed independently as the filter engines, which are more low-leveled than other software which uses WinPCap. Because WinPCap is a protocol-type driver, it can only monitor but not block. The other software which uses WinPCap can only block TCP communications, but cannot block UDP, ICMP, IGMP data packets. It has been proved that Active Wall is more stable, correct and effective after working online for a long time. Most similar software support the only one mode- Passby monitoring mode. Besides the Passby mode, Active Wall supports more modes including Gateway mode, Bridge mode and Single mode. It is recommended that the users should use the Gateway mode or the Bridge mode. When using the Passby mode, Active Wall can only block TCP data packets for the limit of the network topology. However, the Gateway mode or the Bridge mode enables the Active Wall to block all kinds of data packets.Starting Price: $10 per user -
50
Code42
Code42
Welcome to data security for the collaborative and remote enterprise. Validate proper use of sanctioned collaboration tools, such as Slack and OneDrive. Uncover Shadow IT applications that may indicate gaps in corporate tools or training. Gain visibility into off-network file activity, such as web uploads and cloud sync apps. Quickly detect, investigate and respond to data exfiltration by remote employees. Receive activity alerts based on file type, size or count. Access detailed user activity profiles to speed investigation and response.
