Logo

A powerful, easily deployable network traffic analysis tool suite

Quick Start

Documentation

Components

Supported Protocols

Configuring

Arkime

Dashboards

Hedgehog Linux

Contribution Guide

Adding new log fields

Although OpenSearch is a NoSQL database and as-such is “unstructured” and “schemaless,” adding a new data source field requires it be defined in several places in order for it to show up and be usable throughout Malcolm. Minimally, this involves three files:

When possible, it is recommended to use (or at least take inspiration from) the Elastic Common Schema (ECS) Reference when deciding how to define new field names.

If new log fields are coming from a Zeek script where they are defined in a record as &log fields, the script scripts/zeek_script_to_malcolm_boilerplate.py may help by autogenerating the parts of the files mentioned above.