diff --git a/README.md b/README.md index 2be87d992..7b8528e58 100644 --- a/README.md +++ b/README.md @@ -19,7 +19,7 @@ Arkime is built to be deployed across many systems and can scale to handle tens ## Table of Contents - [Background](#background) -- [Installation](#install) +- [Installation](#installation) - [Configuration](#configuration) - [Usage](#usage) - [Security](#security) @@ -29,11 +29,11 @@ Arkime is built to be deployed across many systems and can scale to handle tens ## Background -Arkime, previously named Moloch, was created to replace commercial full packet systems at AOL in 2012. By having complete control of hardware and costs, we found we could deploy full packet capture across all our networks for the same cost as just one network using a commercial tool, with large retention. +Arkime, previously named Moloch, was created to replace commercial full packet systems at AOL in 2012. By having complete control of hardware and costs, we found we could deploy full packet capture across all our networks for the same cost as just one network using a commercial tool, with larger retention. The Arkime system is comprised of 3 main components: -* **capture** - A threaded C application that monitors network traffic, writes PCAP formatted files to disk, parses the captured packets, and sends metadata (SPI data) to elasticsearch. -* **viewer** - A [node.js](http://nodejs.org/) application that runs per capture machine. It handles the web interface and transfer of PCAP files. +* **capture** - A threaded C application that monitors network traffic, writes PCAP formatted files to local disk, parses the captured packets, and sends metadata (SPI data) to OpenSearch/Elasticsearch. +* **viewer** - A [node.js](http://nodejs.org/) application that runs per capture machine. It handles the web interface and transfer of packets to the browser. * **[OpenSearch](https://opensearch.org/downloads.html)/[Elasticsearch](https://www.elastic.co/guide/en/elasticsearch/reference/current/getting-started.html)** - The search database technology powering Arkime. We also provide several optional applications: @@ -42,12 +42,13 @@ We also provide several optional applications: * **Parliament** - An application that monitors and is a front door to multiple Arkime clusters. * **wiseService** - An application that integrates threat intelligence into the session metadata. -Once installed, a user can look at the data Arkime has captured using a simple web interface. Arkime provides multiple views of the data. The primary view is the Sessions page that contains a list of sessions. Each session can be opened to view the metadata and PCAP data. + +Arkime offers a user-friendly web interface for exploring network data. The Sessions page provides a comprehensive overview, listing individual sessions that can be expanded to view metadata and packet details. -Another way to view the data is the SPI View page, which allows the user to see all the unique values for each field that Arkime understands. +The SPI View page offers a detailed breakdown of data, displaying all unique values for each field recognized by Arkime @@ -58,14 +59,13 @@ Most users should use the prebuilt binaries available on our [Downloads page](ht For advanced users, you can build Arkime yourself: * Make sure `node` is in your path, currently main supports Node version 20.x * `git clone https://github.com/arkime/arkime` - latest version on github -* `./easybutton-build.sh --install` - downloads all the prerequisites, build, and install +* `./easybutton-build.sh --install` - downloads all the prerequisites, build, and install Arkime * `make config` - performs an initial Arkime configuration * Refer to the [CONTRIBUTING.md](CONTRIBUTING.md) file for information about how to get involved - ## Configuration -Most of the system configuration is located in the `/opt/arkime/etc/config.ini` file. The variables are documented in our [Settings page](https://arkime.com/settings). +Most of the system configuration is located in the `/opt/arkime/etc/config.ini` file. The variables are documented on our [Settings page](https://arkime.com/settings). ## Usage