Malcolm's Network Sensor
- End-to-end Malcolm and Hedgehog Linux ISO Installation
- Configuring Hedgehog for Standalone Use
- Running Hedgehog Linux on Raspberry Pi
Hedgehog Linux is a Debian-based operating system built to
- monitor network interfaces
- capture packets to PCAP files
- detect file transfers in network traffic and extract and scan those files for threats
- generate and forward Zeek logs, Arkime sessions, and other information to [Malcolm]({{ site.github.repository_url }})
As of Malcolm v25.12.0, the Malcolm and Hedgehog Linux base operating systems have been merged into a single code base; in other words, the Hedgehog Linux installer ISO is now simply another "flavor" of the Malcolm installer ISO preconfigured to use the "Hedgehog" run profile. As such, the documentation for Malcolm and Hedgehog Linux has converged, since both platforms use the same procedures for installation and configuration.
The exception to this is the Hedgehog Linux Raspberry Pi Image, which is built using a slightly different process from that of the Malcolm and Hedgehog Linux installer ISOs.