Moloch: OpenSOC CTF Tool Demo
Walks through full packet capture analysis, session reconstruction, and PCAP carving using Moloch in OpenSOC.
Summary
Large-Scale Packet Indexing with Moloch
Moloch (now Arkime) is an open-source, large-scale packet capture, indexing, and database system that provides visual browsing and session reconstruction for network traffic.
Session Analysis and Packet Carving
The presenter illustrates how to construct complex SPI search queries, examine reassembled TCP sessions, and carve suspect payloads directly from full packet captures.
Applying Full PCAP to the OpenSOC Challenge
Participants discover how Moloch serves as the definitive source of truth in OpenSOC, validating whether network anomalies triggered by other tools represent true positive intrusions.
Related talks
Village Presentations·47 min
Leon Ward
Leon Ward demonstrates deploying OpenFPC, an open-source distributed full packet capture system that integrates seamless PCAP retrieval into SIEM workflows.
Blue Team Village·31 min
Tim Johnson
Demonstrates using Kibana to query, visualize, and analyze security event logs during the OpenSOC defense CTF.
Blue Team Village·44 min
Lennart Koopmann
Demonstrates deploying and querying Graylog centralized log management for real-time threat investigation in OpenSOC.