This material has been designed to be taught in a classroom environment... hands-on 80% + talk 40% + slides 0% = 120% hard work

The online material is missing some of the contextual concepts and ideas that will be covered in class.

This is 4 days of material for any intermediate-level dev-ops who has some experience with other security|monitoring tools and wants to learn Arkime. We believe these classes are perfect for anyone who wants a jump start in learning Arkime or who wants a more thorough understanding of it internals.

Arkime was formerly named Moloch, so the materials on this site may still refer to it as Moloch in various ways or forms. Same holds true for the Arkime codebase.

Arkime is not meant to replace Intrusion Detection Systems (IDS). Arkime augments your current security infrastructure by storing and indexing network traffic in standard PCAP format, while also providing fast indexed access.

NB! Provided timeline is preliminary and will develop according to the actual progress of the class. On-site participation only.

• 12:30 Registration open, coffee

• 13:00 - 17:00

  • Intro
  • Singlehost
  • LS24 overview
  • Basic viewer and queries
  • Intro to LS24 data capture

• 09:30 - 12:30
  • Arkime setup
  • basic config
• 13:30 - 17:00
  • Hunting - RT Web

• 09:30 - 12:30
  • Arkime setup, adding new fields
• 13:30 - 17:00
  • MISP integration
  • Suricata integration
  • Suricata

• 09:30 - 12:30
  • Suricata rules, suricata-update
  • Suricata datasets
• 13:30 - 17:00
  • Hunting - RT client side
  • Polarproxy

• 09:30 - 10:30
  • Hunting - RT Net
• 11:00 - 12:00
  • feedback, contact exchange, thanks, etc.

• Splitting LS BT traffic
• build from source
• Pikksilm
• WISE - Plugins
• Clustered elastic, multinode
• Clustering teamwork, cont
• evebox, scirius, kibana

• vagrant, docker
  • Prepare local environment

• browse trough ...
• Arkime
• Arkime in GitHub
• Arkime FAQ
• Arkime learn
• InfoSec matters - Arkime FPC