While the course may be over, there's still a lot more
you can learn about Arkime. First,
let's talk a little bit about capabilities. You could find more
resources about the framework itself at arkime.com.
Arkime has an API,
which allows you to provide more programmatic
access to the data that it contains,
and you can find information about that API at arkime.com/api. I
mentioned earlier in the course the ability to integrate IDS alerts
from Suricata. You can learn about that through the plugins section,
as well as other plugins that are available to expand the data that
you have available.
And finally, you may be concerned about how you connect to your Arkime instance.
So you can also take a look at their documentation about implementing TLS.
As Arkime has been around for quite a while,
there are a number of articles and presentations available.
You do need to keep in mind that some of those
presentations may go under the former name, Moloch.
While we've covered a number of important attack scenarios such as phishing,
command and control, and data exfiltration,
there still is a lot more to learn, not only within those techniques themselves,
but others commonly used by threat actors such as lateral
movement and host/environment discovery.
There are a number of resources available online.
For example,
I provide on my GitHub a number of malware artifacts to include
PCAPs that highlight certain behaviors or characteristics that I
think are interesting and worth studying.
I sincerely appreciate your time and joining me with this course.
Consider following me on Pluralsight so that you'll stay up
to date on future courses that I release.
Until then, keep learning and happy hunting.