Side by side
Arkime vs Plaso
Both stand on digital forensics software. Which one you can start free with, which one lets you read the code, and what each costs once you pay.
Free plan Open source APILinuxSelf-hosted+1
Arkime offers session search, packet inspection, and flexible packet retention without license fees. It requires an OpenSearch or Elasticsearch deployment, so teams should account for that dependency and its operation.
Visit Arkime Free plan Open source APILinuxMac+2
Plaso brings collection and timeline analysis into a single forensic workflow, with support for varied inputs and output formats. Its extensibility and free license may appeal to teams comfortable working with command-line tools.
Visit PlasoThe facts
| Arkime | Plaso | |
|---|---|---|
| Free plan | Yes | Yes |
| Open source | Yes | Yes |
| Runs on | API, Linux, Self-hosted, Web | API, Linux, Mac, Self-hosted, Windows |
| Lowest paid plan | Free or on request | Free or on request |
| Plans published | 1 | 2 |
| Maker | Not published | Not published |
| Website | arkime.com | plaso.readthedocs.io |
| On digital forensics software | #1 of 30 | #3 of 30 |
Arkime: what it does well
- Stores full packets in standard PCAP format.
- Supports metadata-only capture with traffic selection rules.
- Exports search results as PCAP or CSV.
- Capture can scale with more machines, CPU, or disk.
- Authentication options include OIDC.
What to know first
- Requires OpenSearch or Elasticsearch for session metadata.
- Phone indicator enrichment is limited to the U.S.
- Anonymous authentication is not recommended.
Plaso: what it does well
- Collects events from files, devices, and storage images.
- Supports Windows, browser, database, text, and cloud logs.
- Includes filtering, sorting, and automatic analysis.
- Extensible with parsers, plug-ins, and scripts.
- Free; repository license is Apache-2.0.
What to know first
- Command-line tools are central to its workflow.
- Documentation recommends using a version no older than six months.