Malcolm Contributor Guide

The purpose of this document is to provide some direction for those willing to modify Malcolm, whether for local customization or for contribution to the Malcolm project.

• Local modifications
  • Docker bind mounts
  • Building Malcolm’s Docker images
• Adding a new service (Docker image)
  • Networking and firewall
• Adding new log fields
• Zeek
  • local.zeek
  • Adding a new Zeek package
  • Zeek Intelligence Framework
• PCAP processors
• Logstash
  • Parsing a new log data source
  • Parsing new Zeek logs
  • Enrichments
  • Logstash plugins
• OpenSearch Dashboards
  • Adding new visualizations and dashboards
  • OpenSearch Dashboards plugins
• Carved file scanners
• Style