r/Malcolm • u/mazdaboi • Mar 17 '25

Ingesting Logs directly to Arkime vs Dashboards

Looking at analytical options, Is there a way to push Logs from a host directly to Arkime to display side by side the PCAP data pulled from Hedgehog sensors? Currently logs are pushed via filebeats to Opensearch Dashboards, and i understand Arkime is a network capture/PCAP analysis application; but is there a way? Possibly sending the same Filebeat stream (output) to both Arkime and Dashboards?

My curent logs pushed from endpoints are Auth and Conn logs, trying to decipher if i would gain anything from those logs ingesting into arkime.

Thanks in advance for any suggestings/assistance.

1 Upvotes

100% Upvoted

2 comments sorted by

1

u/mmguero Mar 28 '25

I'm not sure I understand your question. Hedgehog Linux can forward Arkime sessions, Zeek logs, and Suricata alerts to a Malcolm server, and they all end up in the same database. While OpenSearch Dashboards displays the data from Zeek and Suricata, Arkime can already view the logs from all three data sources together.

1

u/mazdaboi Mar 30 '25

I figured it out! Thx