Malcolm instance landing page

[mmguero]

In previous version of Malcolm hitting the "root" URI of the instance (e.g., https://localhost/ if Malcolm is running locally) takes you to Arkime (the /sessions page, specifically).

I think it would be a better idea to design a landing page for Malcolm that is a jumping-off place for the various components of Malcolm. This could be a simple static page, but should look attractive and modern and ought to fit in as best as possible other elements of the Malcolm UI. The links it ought to contain include:

• local Malcolm components
  • README (/readme)
  • Arkime (/sessions)
  • Dashboards (/dashboards)
  • Artifact Upload (/upload)
  • NetBox (/netbox)
  • Local Account Management (/auth)
  • CyberChef (/cyberchef/)
  • API (/mapi, not sure if we care to include this or not?)
• external links
  • GitHub project
  • GitHub Issue tracker

Pretty much all the work for this is going to be in nginx.conf, where you can see the Arkime stuff is currently the default. It'll be changing the default / location to point to the new landing page and identifying all of the arkime locations (sessions, connections, spiview, etc.) and making sure they all go to Arkime as planned. Or, alternately, change it so there's an /arkime/ part of the UI and have everything under there (/arkime/sessions, /arkime/spiview, etc.).

We also have to determine what's hosting the page. Rather than another docker container, it seems to me it would make sense just to have the nginx-proxy container do it like it's doing for the readme.

[n8hacks]

The best solution seems to have this sit within the Nginx container itself.

[n8hacks]

Here is what I am thinking. I'd love feedback. It is dark mode by default. Also when you hover over a tile it goes opaque.

[mmguero]

I like the aesthetic of it but I think it's going to need to have some text describing what things are. If this is where people are first going to land the first time they run Malcolm they're going to look at it and be like "what is all of this."

Maybe those same icons, but like, in rows with some text describing each thing? Sort or like:

• Arkime - Visualizations of Zeek logs, Suricata alerts, and Arkime sessions including access to full packet payloads
• Dashboards - Prebuilt and user-definable dashboards for Zeek logs, Suricata alerts, and third-party logs, as well as anomaly detection, alerting, and reporting.
• Upload - ...

etc.

[n8hacks]

That's a great idea! What do you think of this. It pops up with the additional text when you hover over the box. If we want to move towards rows, we can do that too.

[e101sg]

Looks good! Wish there is FAQ as well. Some of the Do's /Do not or common doubts can be there in a Text file.

[mmguero]

I think that's going in the right direction, @n8hacks . Let's keep on that track and see how it's received and we can tweak in the future if needed.

[mmguero]

working on a new design

[mmguero]

TODO: add the malcolm version/build information to the landing page

[mmguero]