Learning

Malcolm Learning Tree

The Malcolm team is always working to develop and improve resources for learning about how to deploy, configure, and use Malcolm. This list organizes learning modules by category with links to the documentation and video resources associated with each topic. If you have an idea or request for a training topic, please let us know by submitting a training issue request or opening a new discussion in the Training category on the discussions board.

Learning topics are also tracked as issues in this project on the Malcolm GitHub repository.

If you're not looking for training per se, the Q&A and Troubleshooting discussion categories are a great place to go for help. Or, if you have a feature request or think you've found a bug in Malcolm, check out the Issue Tracker.

Learning Modules

• Legend
  • 📔 Malcolm documentation
  • 📓 External documentation
  • 📼 Malcolm Video
  • 📺 External video
  • 🔜 Coming soon

Category	Topic	Documentation	Video
Overview	Using GitHub	📓 📓 📓	📼
Overview	Malcolm Overview	📔	📼
Overview	Malcolm Background		📼
Overview	Malcolm Terms & Definitions	🔜	🔜
General	Malcolm Technical Workshop	🔜	🔜
Installation	Installing Malcolm Using the Installation ISO	📔 📔 📔	📼
Installation	Installing Malcolm on Linux Using Docker	📔 📔	📼
Installation	Installing Malcolm on Microsoft Windows Using WSL & Docker	📔	📼
Installation	Installing Malcolm on macOS Using Docker	📔	🔜
Installation	Cloud Deployment: Deploying Malcolm Using Kubernetes	📔	🔜
Installation	Cloud Deployment: Deploying Malcolm Using Amazon AWS EKS	📔	🔜
Installation	Cloud Deployment: Deploying Malcolm Using Microsoft Azure AKS	📔	🔜
Installation	Cloud Deployment: Deploying Malcolm Using AWS EC2 with AMI	📔	🔜
Configuration	Configuring Malcolm	📔 📔	📼
Configuration	Authentication and User Management	📔	🔜
Configuration	Running Malcolm	📔	📼
Configuration	Ingesting Traffic: Capturing Live Network Traffic for Analysis	📔	🔜
Configuration	Ingesting Traffic: Uploading PCAP for Analysis	📔	🔜
Configuration	Using a Remote OpenSearch or Elasticearch Instance	📔	🔜
Configuration	Managing OpenSearch/Elasticsearch Indexes	📔 📔	🔜
Configuration	Using Custom Rules and Scripts	📔	🔜
Dashboards	OpenSearch Dashboards Overview	📔 📓	📼
Dashboards	Pre-Built Dashboards	📔 📓	🔜
Dashboards	Queries and Filters	📔 📓 📓 📓 📓 📓 📓 📓	🔜
Dashboards	Security-focused Dashboards	🔜	🔜
Dashboards	Discover	📔	🔜
Dashboards	Anomaly Detection	📔	🔜
Dashboards	Creating Custom Dashboards	📔	🔜
Dashboards	Alerting: Configuring Email for Alerting	📔	🔜
Dashboards	Alerting: Alerting	📔	🔜
Arkime	Arkime Overview	📔 📓	📼
Arkime	Queries and Filters	📔	🔜
Arkime	Sessions	📔	🔜
Arkime	SPIView	📔	🔜
Arkime	SPIGraph	📔	🔜
Arkime	Connections	📔	🔜
Arkime	Hunt	📔	🔜
Arkime	CyberChef	📔 📓	🔜
NetBox	NetBox Overview	📔 📓 📓	📼 📺
NetBox	NetBox Data Model	📔	🔜
NetBox	Manual Inventory Population	📔 📔📓	🔜 📺
NetBox	Automatic Inventory Population	📔	🔜
NetBox	Asset Interaction Analysis	📔 📓	🔜
NetBox	Backing up and Restoring the NetBox Inventory	📔	🔜
Analysis	Hypothesis-Driven Hunting Fundamentals	🔜	🔜
Analysis	Pivoting Between Data Sources	📔	🔜
Analysis	File Extraction and Analysis	📔	🔜
Analysis	Severity Scoring	📔	🔜
Analysis	Forwarding Third-Party Logs to Malcolm	📔	🔜
Analysis	Using Threat Intelligence Feeds	📔 📓 📓	🔜
Analysis	Log Enrichment	🔜	🔜
Analysis	Using the Malcolm REST API	📔	🔜
Hedgehog Linux	Installing Hedgehog Linux	📔 📔	📼
Hedgehog Linux	Configuring Hedgehog Linux	📔	📼
Hedgehog Linux	Sensor Placement Fundamentals	🔜	📼
Hedgehog Linux	Operation: Running Hedgehog Linux	📔	🔜
Hedgehog Linux	Operation: Monitoring Sensor Metrics	🔜	🔜
Parsers	Parsnip Overview	📔	📼
Parsers	Parsnip Language Overview	📔	📼
Parsers	Parsnip Intermediate Language	📔	📼