{"id":13415470,"url":"https://github.com/arkime/arkime","last_synced_at":"2026-10-18T23:05:39.017Z","repository":{"id":3843831,"uuid":"4927517","full_name":"arkime/arkime","owner":"arkime","description":"Arkime is an open source, large scale, full packet capturing, indexing, and database system.","archived":false,"fork":false,"pushed_at":"2026-10-11T14:33:30.000Z","size":74345,"stargazers_count":7534,"open_issues_count":41,"forks_count":1172,"subscribers_count":338,"default_branch":"main","last_synced_at":"2026-10-11T15:59:31.524Z","etag":null,"topics":["big-data","c","javascript","network-monitoring","nsm","packet-capture","pcap","security"],"latest_commit_sha":null,"homepage":"https://arkime.com","language":"C","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/arkime.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG","contributing":"CONTRIBUTING.md","funding":".github/FUNDING.yml","license":"LICENSE","code_of_conduct":"CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":"NOTICE","maintainers":null,"copyright":null,"agents":null,"claude":null,"gemini":null,"cursor":null,"copilot":null,"dco":null,"cla":null,"disclosure":null},"funding":{"github":["awick",31453],"patreon":null,"open_collective":null,"ko_fi":null,"tidelift":null,"community_bridge":null,"liberapay":null,"issuehunt":null,"lfx_crowdfunding":null,"polar":null,"buy_me_a_coffee":"arkime","thanks_dev":null,"custom":null}},"created_at":"2012-07-06T16:10:55.000Z","updated_at":"2026-10-11T12:40:39.000Z","dependencies_parsed_at":"2026-10-04T05:55:20.359Z","dependency_job_id":null,"html_url":"https://github.com/arkime/arkime","commit_stats":{"total_commits":5067,"total_committers":113,"mean_commits":44.84070796460177,"dds":0.5131241365699626,"last_synced_commit":"91c5507c72ba9294dd2d01461de3336cc87d72b5"},"previous_names":["aol/moloch"],"tags_count":169,"template":false,"template_full_name":null,"purl":"pkg:github/arkime/arkime","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/arkime%2Farkime","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/arkime%2Farkime/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/arkime%2Farkime/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/arkime%2Farkime/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/arkime","download_url":"https://codeload.github.com/arkime/arkime/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/arkime%2Farkime/sbom","scorecard":{"id":207281,"data":{"date":"2025-08-15T14:49:38Z","repo":{"name":"github.com/arkime/arkime","commit":"358fb0671be209278d2095674b3f64d67df4678f"},"scorecard":{"version":"v4.13.1","commit":"49c0eed3a423f00c872b5c3c9f1bbca9e8aae799"},"score":4.7,"checks":[{"name":"Binary-Artifacts","score":10,"reason":"no binaries found in the repo","details":null,"documentation":{"short":"Determines if the project has generated executable (binary) artifacts in the source repository.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#binary-artifacts"}},{"name":"Branch-Protection","score":-1,"reason":"internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration","details":null,"documentation":{"short":"Determines if the default and release branches are protected with GitHub's branch protection settings.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#branch-protection"}},{"name":"CI-Tests","score":8,"reason":"26 out of 30 merged PRs checked by a CI test -- score normalized to 8","details":null,"documentation":{"short":"Determines if the project runs tests before pull requests are merged.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#ci-tests"}},{"name":"CII-Best-Practices","score":5,"reason":"badge detected: passing","details":null,"documentation":{"short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#cii-best-practices"}},{"name":"Code-Review","score":0,"reason":"found 25 unreviewed changesets out of 26 -- score normalized to 0","details":null,"documentation":{"short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#code-review"}},{"name":"Contributors","score":10,"reason":"9 different organizations found -- score normalized to 10","details":["Info: contributors work for Codegrounds,aol @oath @yahoo @verizonmedia,jku linz,mmguero-dev,nodemcu,open src analytics,ruag c5i,visa inc,yahoo"],"documentation":{"short":"Determines if the project has a set of contributors from multiple organizations (e.g., companies).","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#contributors"}},{"name":"Dangerous-Workflow","score":0,"reason":"dangerous workflow patterns detected","details":["Warn: script injection with untrusted input ' github.head_ref ': .github/workflows/build.yml:31","Warn: script injection with untrusted input ' github.head_ref ': .github/workflows/build.yml:31"],"documentation":{"short":"Determines if the project's GitHub Action workflows avoid dangerous patterns.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#dangerous-workflow"}},{"name":"Dependency-Update-Tool","score":10,"reason":"update tool detected","details":["Info: tool 'Dependabot' is used: :0"],"documentation":{"short":"Determines if the project uses a dependency update tool.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#dependency-update-tool"}},{"name":"Fuzzing","score":10,"reason":"project is fuzzed","details":["Info: CLibFuzzer integration found: capture/main.c:1001","Info: CLibFuzzer integration found: capture/main.c:1058"],"documentation":{"short":"Determines if the project uses fuzzing.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#fuzzing"}},{"name":"License","score":10,"reason":"license file detected","details":["Info: License file found in expected location: LICENSE:1","Info: FSF or OSI recognized license: LICENSE:1"],"documentation":{"short":"Determines if the project has defined a license.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#license"}},{"name":"Maintained","score":10,"reason":"30 commit(s) out of 30 and 0 issue activity out of 30 found in the last 90 days -- score normalized to 10","details":null,"documentation":{"short":"Determines if the project is \"actively maintained\".","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#maintained"}},{"name":"Packaging","score":10,"reason":"publishing workflow detected","details":["Info: GitHub/GitLab publishing workflow used in run https://api.github.com/repos/arkime/arkime/actions/runs/16992242394: .github/workflows/build.yml:293"],"documentation":{"short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#packaging"}},{"name":"Pinned-Dependencies","score":1,"reason":"dependency not pinned by hash detected -- score normalized to 1","details":["Warn: third-party GitHubAction not pinned by hash: .github/workflows/build.yml:307: update your workflow using https://app.stepsecurity.io/secureworkflow/arkime/arkime/build.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/build.yml:226: update your workflow using https://app.stepsecurity.io/secureworkflow/arkime/arkime/build.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/build.yml:253: update your workflow using https://app.stepsecurity.io/secureworkflow/arkime/arkime/build.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/build.yml:257: update your workflow using https://app.stepsecurity.io/secureworkflow/arkime/arkime/build.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/build.yml:265: update your workflow using https://app.stepsecurity.io/secureworkflow/arkime/arkime/build.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/build.yml:280: update your workflow using https://app.stepsecurity.io/secureworkflow/arkime/arkime/build.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/release.yml:228: update your workflow using https://app.stepsecurity.io/secureworkflow/arkime/arkime/release.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/release.yml:154: update your workflow using https://app.stepsecurity.io/secureworkflow/arkime/arkime/release.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/release.yml:182: update your workflow using https://app.stepsecurity.io/secureworkflow/arkime/arkime/release.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/release.yml:186: update your workflow using https://app.stepsecurity.io/secureworkflow/arkime/arkime/release.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/release.yml:194: update your workflow using https://app.stepsecurity.io/secureworkflow/arkime/arkime/release.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/release.yml:208: update your workflow using https://app.stepsecurity.io/secureworkflow/arkime/arkime/release.yml/main?enable=pin","Warn: containerImage not pinned by hash: release/Dockerfile:2: pin your Docker image by updating debian:12-slim to debian:12-slim@sha256:b1a741487078b369e78119849663d7f1a5341ef2768798f7b7406c4240f86aef","Warn: containerImage not pinned by hash: release/Dockerfile.ja4:3","Warn: pipCommand not pinned by hash: easybutton-build.sh:452","Warn: npmCommand not pinned by hash: .github/workflows/build.yml:221","Warn: npmCommand not pinned by hash: .github/workflows/release.yml:151","Info:   9 out of   9 GitHub-owned GitHubAction dependencies pinned","Info:   1 out of  13 third-party GitHubAction dependencies pinned","Info:   0 out of   1 pipCommand dependencies pinned","Info:   0 out of   2 npmCommand dependencies pinned","Info:   0 out of   2 containerImage dependencies pinned"],"documentation":{"short":"Determines if the project has declared and pinned the dependencies of its build process.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#pinned-dependencies"}},{"name":"SAST","score":0,"reason":"SAST tool is not run on all commits -- score normalized to 0","details":["Warn: 0 commits out of 30 are checked with a SAST tool","Warn: CodeQL tool not detected"],"documentation":{"short":"Determines if the project uses static code analysis.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#sast"}},{"name":"Security-Policy","score":10,"reason":"security policy file detected","details":["Info: security policy file detected: SECURITY.md:1","Info: Found linked content: SECURITY.md:1","Info: Found disclosure, vulnerability, and/or timelines in security policy: SECURITY.md:1","Info: Found text in security policy: SECURITY.md:1"],"documentation":{"short":"Determines if the project has published a security policy.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#security-policy"}},{"name":"Signed-Releases","score":0,"reason":"0 out of 5 artifacts are signed or have provenance","details":["Warn: release artifact last-commit6 does not have provenance: https://api.github.com/repos/arkime/arkime/releases/181756074","Warn: release artifact last-commit6 not signed: https://api.github.com/repos/arkime/arkime/releases/181756074","Warn: release artifact last-commit does not have provenance: https://api.github.com/repos/arkime/arkime/releases/133404691","Warn: release artifact last-commit not signed: https://api.github.com/repos/arkime/arkime/releases/133404691","Warn: release artifact v5.7.1 does not have provenance: https://api.github.com/repos/arkime/arkime/releases/234685104","Warn: release artifact v5.7.1 not signed: https://api.github.com/repos/arkime/arkime/releases/234685104","Warn: release artifact v5.7.0 does not have provenance: https://api.github.com/repos/arkime/arkime/releases/224634012","Warn: release artifact v5.7.0 not signed: https://api.github.com/repos/arkime/arkime/releases/224634012","Warn: release artifact v5.6.4 does not have provenance: https://api.github.com/repos/arkime/arkime/releases/215544051","Warn: release artifact v5.6.4 not signed: https://api.github.com/repos/arkime/arkime/releases/215544051"],"documentation":{"short":"Determines if the project cryptographically signs release artifacts.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#signed-releases"}},{"name":"Token-Permissions","score":0,"reason":"detected GitHub workflow tokens with excessive permissions","details":["Info: topLevel 'contents' permission set to 'read': .github/workflows/build.yml:15","Info: topLevel 'packages' permission set to 'read': .github/workflows/build.yml:16","Warn: jobLevel 'contents' permission set to 'write': .github/workflows/build.yml:48: Verify which permissions are needed and consider whether you can reduce them. (High effort)","Warn: jobLevel 'contents' permission set to 'write': .github/workflows/build.yml:298: Verify which permissions are needed and consider whether you can reduce them. (High effort)","Warn: topLevel 'packages' permission set to 'write': .github/workflows/delete-old-snapshots.yml:58: Visit https://app.stepsecurity.io/secureworkflow/arkime/arkime/delete-old-snapshots.yml/main?enable=permissions\nTick the 'Restrict permissions for GITHUB_TOKEN'\nUntick other options\nNOTE: If you want to resolve multiple issues at once, you can visit https://app.stepsecurity.io/securerepo instead. (Low effort)","Info: topLevel 'contents' permission set to 'read': .github/workflows/release.yml:16","Info: topLevel 'packages' permission set to 'read': .github/workflows/release.yml:17","Warn: jobLevel 'contents' permission set to 'write': .github/workflows/release.yml:39: Verify which permissions are needed and consider whether you can reduce them. (High effort)","Warn: jobLevel 'contents' permission set to 'write': .github/workflows/release.yml:224: Verify which permissions are needed and consider whether you can reduce them. (High effort)","Info: topLevel permissions set to 'read-all': .github/workflows/scorecard.yml:21"],"documentation":{"short":"Determines if the project's workflows follow the principle of least privilege.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#token-permissions"}},{"name":"Vulnerabilities","score":0,"reason":"10 existing vulnerabilities detected","details":["Warn: Project is vulnerable to: GHSA-968p-4wvh-cqc8","Warn: Project is vulnerable to: GHSA-vc8w-jr9v-vj7f","Warn: Project is vulnerable to: GHSA-v6h2-p8h4-qcjw","Warn: Project is vulnerable to: GHSA-pxg6-pf52-xh8x","Warn: Project is vulnerable to: GHSA-35jh-r3h4-6jhm","Warn: Project is vulnerable to: GHSA-56x4-j7p9-fcf9","Warn: Project is vulnerable to: GHSA-v78c-4p63-2j6c","Warn: Project is vulnerable to: GHSA-7fh5-64p2-3v2j","Warn: Project is vulnerable to: GHSA-5j4c-8p2g-v4jx","Warn: Project is vulnerable to: GHSA-g3ch-rx76-35fx"],"documentation":{"short":"Determines if the project has open, known unfixed vulnerabilities.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#vulnerabilities"}}]},"last_synced_at":"2025-08-17T00:03:52.779Z","repository_id":3843831,"created_at":"2025-08-17T00:03:52.779Z","updated_at":"2025-08-17T00:03:52.779Z"},"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":344872684,"owners_count":38343410,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-10-03T21:59:58.778Z","status":"online","status_checked_at":"2026-10-18T02:00:06.448Z","response_time":63,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["big-data","c","javascript","network-monitoring","nsm","packet-capture","pcap","security"],"created_at":"2024-07-30T21:00:49.431Z","updated_at":"2026-10-18T23:05:39.004Z","avatar_url":"https://github.com/arkime.png","language":"C","funding_links":["https://github.com/sponsors/awick","https://github.com/sponsors/31453","https://buymeacoffee.com/arkime"],"categories":["Full Packet Capture Solution","Networking and Distributed","JavaScript","Educational Aides","Application Recommendation","c","Defensive (D3FEND-aligned lifecycle)","Network Simulators and Traffic Generators","C","Security","Security monitoring"],"sub_categories":["Monitoring and Observability","🔒 Cybersecurity","🔬 Digital Forensics","SD-WAN","Security Tools","Network Security Monitoring (NSM)"],"readme":"[![OpenSSF Best Practices](https://www.bestpractices.dev/projects/7997/badge)](https://www.bestpractices.dev/projects/7997)\n[![GitHub tag (with filter)](https://img.shields.io/github/v/tag/arkime/arkime?label=download\u0026color=a800fc)](https://arkime.com/#download)\n[![Static Badge](https://img.shields.io/badge/license-Apache_2.0-D22128)](https://github.com/arkime/arkime/blob/main/LICENSE)\n[![Static Badge](https://img.shields.io/badge/chat-on_Slack-ECB22E?logo=slack)](https://slackinvite.arkime.com/)\n[![Static Badge](https://img.shields.io/badge/follow_us-on_LinkedIn-0077B5?logo=linkedin)](https://www.linkedin.com/company/arkime)\n\n\n# Arkime\n\u003e Arkime is a large scale, open-source network analysis and packet capture system.\n\n![banner](https://raw.githubusercontent.com/arkime/arkime/main/assets/Arkime_Logo_FullGradientBlack@3x.png)\n\nArkime augments your current security infrastructure to store and index network traffic in standard PCAP format, providing fast, indexed access. An intuitive and simple web interface is provided for PCAP browsing, searching, and exporting. Arkime exposes APIs which allow for PCAP data and JSON formatted session data to be downloaded and consumed directly. Arkime stores and exports all packets in standard PCAP format, allowing you to also use your favorite PCAP ingesting tools, such as Wireshark, during your analysis workflow.\n\nArkime is built to be deployed across many systems and can scale to handle tens of gigabits/sec of traffic. PCAP retention is based on available sensor disk space. Metadata retention is based on the Elasticsearch cluster scale. Both can be increased at anytime and are under your complete control.\n\n[Learn more on arkime.com](https://arkime.com)\n\n## Arkimeet 2026\n\nJoin us for **[Arkimeet 2026](https://arkime.com/arkimeet)**, our Arkime community gathering!\n\n* **When:** Tuesday, October 6, 2026, 9:00 AM - 5:00 PM EDT (happy hour to follow)\n* **Where:** Amazon IAD28, 13200 Woodland Park Rd, Herndon, VA 20171\n* **Cost:** Free, but **registration is required by September 22, 2026** - space is limited\n\nThe day includes an Arkime keynote covering new features and demos, community talks, and an open discussion about the features you want to see next. Everyone is welcome, whether you are brand new to Arkime or have been running it for years.\n\nInterested in speaking? A call for presentations is open - see the [Arkimeet page](https://arkime.com/arkimeet) to register or submit a talk. Chat with us in the `#arkimeet` channel on [Slack](https://slackinvite.arkime.com).\n\n## Table of Contents\n\n- [Arkimeet 2026](#arkimeet-2026)\n- [Background](#background)\n- [Installation](#installation)\n- [Configuration](#configuration)\n- [Usage](#usage)\n- [Security](#security)\n- [API](#api)\n- [Contribute](#contribute)\n- [License](#license)\n\n## Background\n\nArkime was created to replace commercial full packet systems at AOL in 2012. By having complete control of hardware and costs, we found we could deploy full packet capture across all our networks for the same cost as just one network using a commercial tool, with larger retention.\n\nThe Arkime system is comprised of 3 main components:\n* **capture** - A threaded C application that monitors network traffic, writes PCAP formatted files to local disk, parses the captured packets, and sends metadata (SPI data) to OpenSearch/Elasticsearch.\n* **viewer** - A [node.js](http://nodejs.org/) application that runs per capture machine. It handles the web interface and transfer of packets to the browser.\n* **[OpenSearch](https://opensearch.org/downloads.html)/[Elasticsearch](https://www.elastic.co/guide/en/elasticsearch/reference/current/getting-started.html)** - The search database technology powering Arkime.\n\nWe also provide several optional applications:\n* **cont3xt** - An application that provides a structured approach to gathering contextual intelligence in support of technical investigations.\n* **esProxy** - A proxy that provides extra security between capture and OpenSearch/Elasticsearch.\n* **Parliament** - An application that monitors and is a front door to multiple Arkime clusters.\n* **wiseService** - An application that integrates threat intelligence into the session metadata.\n\n\nArkime offers a user-friendly web interface for exploring network data. The Sessions page provides a comprehensive overview, listing individual sessions that can be expanded to view metadata and packet details.\n\n\u003cimg src=\"https://github.com/arkime/arkimeweb/blob/main/assets/sessions.png\" width=\"1000\"\u003e\n\n\nThe SPI View page offers a detailed breakdown of data, displaying all unique values for each field recognized by Arkime\n\n\u003cimg src=\"https://github.com/arkime/arkimeweb/blob/main/assets/spiview.png\" width=\"1000\"\u003e\n\n## Installation\n\nWe recommend installing Arkime using either our prebuilt binaries or containers.\n\n### Recommended Methods\n* **Prebuilt Binaries:** Available on our [Downloads page](https://arkime.com/downloads). Follow the [simple install instructions](https://arkime.com/install).\n* **Containers:** We provide official containers for easy deployment. Please refer to our [Docker instructions](https://arkime.com/docker) for details on available tags and usage.\n\n### Building from Source (Advanced)\nBuilding from source is only recommended for advanced users or contributors.\n\n* Make sure `node` is in your path, currently main supports Node version 22.x\n* `git clone https://github.com/arkime/arkime` - latest version on github\n* Find your OS in `.github/workflows/versions` for the easybutton options to use\n* `./easybutton-build.sh [easybutton options] --install` - build and install Arkime (Run `./easybutton-build.sh --help` for list of options)\n* `make config` - performs an initial Arkime configuration\n* Refer to the [CONTRIBUTING.md](CONTRIBUTING.md) file for information about how to get involved\n\n## Configuration\n\nMost of the system configuration is located in the `/opt/arkime/etc/config.ini` file.  The variables are documented on our [Settings page](https://arkime.com/settings).\n\n## Usage\n\nOnce Arkime is running, point your browser to http://localhost:8005 to access the web interface.  **Click on the Owl to reach the Arkime help page.**\n\n## Security\n\nAccess to Arkime is protected by using HTTPS with digest passwords or by using an authentication-providing web server proxy. All PCAPs are stored on the sensors and are only accessed using the Arkime interface or API. Arkime is not meant to replace an IDS but instead work alongside them to store and index all the network traffic in standard PCAP format, providing fast access.\n\n\n* Arkime can be configured to use OpenSearch/Elasticsearch user auth or API keys.\n\n* Arkime machines should be locked down; however, they need to communicate with each other (port 8005) and the OpenSearch/Elasticsearch machines (ports 9200-920x). Additionally, the web interface needs to be open (port 8005).\n\n* Arkime ``viewer`` should be configured to use TLS.\n\n  - It's easiest to use a single certificate with multiple DNs or a wildcard.\n  - Make sure you protect the cert on the filesystem with proper file permissions.\n  - Edit certFile and keyFile settings in ``/opt/arkime/etc/config.ini`` to enable.\n\n* For large deployments it is possible to set up an Arkime ``viewer`` on a central machine that doesn't capture any data, instead the machine gateways all UI requests.\n\n  - Using a reverse proxy (Caddy, Apache, ...) can handle the authentication and pass the username on to Arkime, this is how we deploy it.\n\n* A shared password stored in the Arkime configuration file is used to encrypt password hashes AND for inter-Arkime communication.\n\n  - Make sure you protect the config file on the filesystem with proper file permissions.\n  - Encrypted password hashes are used so a new password hash cannot be inserted into OpenSearch/Elasticsearch directly in case it hasn't been secured.\n\n## API\n\nYou can learn more about the Arkime API on our [API page](https://arkime.com/api).\n\n\n## Contribute\n\nPlease refer to the [CONTRIBUTING.md](CONTRIBUTING.md) file for information about how to get involved. We welcome issues, feature requests, pull requests, and documentation updates in GitHub.  For questions about using and troubleshooting Arkime please use the Slack channels.\n\n## Maintainers\n\nThe best way to reach us is on Slack.  Please request an invitation to join the Arkime Slack workspace [here](https://slackinvite.arkime.com).\n\n## License\n\nThis project is licensed under the terms of the Apache 2.0 open source license. Please refer to [LICENSE](LICENSE) for the full terms.\n\n## Thanks\n\n\u003ca href=\"https://www.blacksmith.sh/\"\u003e\u003cimg src=\"https://arkime.com/assets/blacksmith.png\" height=\"50\" align=\"middle\" alt=\"Blacksmith\"\u003e\u003c/a\u003e\u0026nbsp;\u0026nbsp;\u003ca href=\"https://greynoise.io\"\u003e\u003cimg src=\"https://arkime.com/assets/greynoise.svg\" height=\"20\" align=\"middle\" alt=\"GreyNoise\"\u003e\u003c/a\u003e\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Farkime%2Farkime","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Farkime%2Farkime","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Farkime%2Farkime/lists"}