Network Traffic Analysis with Malcolm
Channel: Malcolm Network Traffic Analysis Tool Suite
Date: 27/05/2021

A crash course in using Malcolm to analyze network traffic.

Download the sample files (credit to 2020 SANS ICS Virtual Conference CTF) used in the example at:
* https://malcolm.fyi/examples/Cyberville.pcap
* https://malcolm.fyi/examples/net-map.json

Introduction - 00:00:00
Intrusion Detection Systems - 00:01:34
What is Zeek? - 00:12:28
What is Arkime? - 00:28:50
Malcolm Components and Data Flow - 00:29:44
Identifying Hosts and Subnets - 00:32:32
Importing PCAP Data - 00:40:35
Data Tagging and Enrichment - 00:44:30
Data Visualization in Kibana - 00:48:43
Data Visualization in Arkime - 01:00:44
Data Source Correlation - 01:20:05
Carved File Analysis - 01:29:05
Search Tips - 01:32:49