-
Notifications
You must be signed in to change notification settings - Fork 331
Learning
The Malcolm team is always working to develop and improve resources for learning about how to deploy, configure, and use Malcolm. This list organizes learning modules by category with links to the documentation and video resources associated with each topic. If you have an idea or request for a training topic, please let us know by submitting a training issue request or opening a new discussion in the Training category on the discussions board.
Learning topics are also tracked as issues in this project on the Malcolm GitHub repository.
If you're not looking for training per se, the Q&A and Troubleshooting discussion categories are a great place to go for help. Or, if you have a feature request or think you've found a bug in Malcolm, check out the Issue Tracker.
- Legend
- 📔 Malcolm documentation
- 📓 External documentation
- 📼 Video
- 🔜 Coming soon
| Category | Topic | Documentation | Video |
|---|---|---|---|
| Overview | GitHub Overview | 📓 📓 📓 | 🔜 |
| Overview | Malcolm Overview | 📔 | 📼 |
| Overview | Malcolm Background | 🔜 | 🔜 |
| Overview | Malcolm Terms & Definitions | 🔜 | 🔜 |
| General | Malcolm Technical Workshop | 🔜 | 🔜 |
| Installation | Installing Malcolm Using the Installation ISO | 📔 📔 📔 | 📼 |
| Installation | Installing Malcolm on Linux Using Docker | 📔 📔 | 📼 |
| Installation | Installing Malcolm on Microsoft Windows Using WSL & Docker | 📔 | 🔜 |
| Installation | Installing Malcolm on macOS Using Docker | 📔 | 🔜 |
| Installation | Cloud Deployment: Deploying Malcolm Using Kubernetes | 📔 | 🔜 |
| Installation | Cloud Deployment: Deploying Malcolm Using Amazon AWS EKS | 📔 | 🔜 |
| Installation | Cloud Deployment: Deploying Malcolm Using AWS EC2 with AMI | 📔 | 🔜 |
| Configuration | Configuring Malcolm | 📔 📔 | 🔜 |
| Configuration | Authentication and User Management | 📔 | 🔜 |
| Configuration | Running Malcolm | 📔 | 🔜 |
| Configuration | Ingesting Traffic: Capturing Live Network Traffic for Analysis | 📔 | 🔜 |
| Configuration | Ingesting Traffic: Uploading PCAP for Analysis | 📔 | 🔜 |
| Configuration | Sensor Placement | 🔜 | 🔜 |
| Configuration | Using a Remote OpenSearch or Elasticearch Instance | 📔 | 🔜 |
| Configuration | Managing OpenSearch/Elasticsearch Indexes | 📔 📔 | 🔜 |
| Dashboards | OpenSearch Dashboards Overview | 📔 📓 | 📼 |
| Dashboards | Pre-Built Dashboards | 📔 | 🔜 |
| Dashboards | Queries and Filters | 📔 | 🔜 |
| Dashboards | Notices and Signatures | 🔜 | 🔜 |
| Dashboards | Discover | 📔 | 🔜 |
| Dashboards | Anomaly Detection | 📔 | 🔜 |
| Dashboards | Creating Custom Dashboards | 📔 | 🔜 |
| Dashboards | Alerting: Configuring Email for Alerting | 📔 | 🔜 |
| Dashboards | Alerting: Alerting | 📔 | 🔜 |
| Arkime | Arkime Overview | 📔 📓 | 📼 |
| Arkime | Queries and Filters | 📔 | 🔜 |
| Arkime | Sessions | 📔 | 🔜 |
| Arkime | SPIView | 📔 | 🔜 |
| Arkime | SPIGraph | 📔 | 🔜 |
| Arkime | Connections | 📔 | 🔜 |
| Arkime | Hunt | 📔 | 🔜 |
| Arkime | CyberChef | 📔 📓 | 🔜 |
| NetBox | NetBox Overview | 📔 📓 | 📼 |
| NetBox | Manual Inventory Population | 📔 | 🔜 |
| NetBox | Automatic Inventory Population | 📔 | 🔜 |
| NetBox | Asset Interaction Analysis | 📔 | 🔜 |
| NetBox | Backing up and Restoring the NetBox Inventory | 📔 | 🔜 |
| Analysis | Pivoting Between Data Sources | 📔 | 🔜 |
| Analysis | File Extraction and Analysis | 📔 | 🔜 |
| Analysis | Severity Scoring | 📔 | 🔜 |
| Integrations | Forwarding Third-Party Logs to Malcolm | 📔 | 🔜 |
| Integrations | Using Threat Intelligence Feeds | 📔 | 🔜 |
| Other | Log Enrichment | 🔜 | 🔜 |
| Configuration | Using Custom Rules and Scripts | 📔 | 🔜 |
| Other | Using the Malcolm REST API | 📔 | 🔜 |
| Hedgehog Linux | Installing Hedgehog Linux | 📔 📔 | 🔜 |
| Hedgehog Linux | Configuring Hedgehog Linux | 📔 | 🔜 |
| Hedgehog Linux | Operation: Running Hedgehog Linux | 📔 | 🔜 |
| Hedgehog Linux | Operation: Monitoring Sensor Metrics | 🔜 | 🔜 |