idaholab#463, documentation

mmguero-dev · May 16, 2024 · 32fb37c · 32fb37c
1 parent 2b8d85e
commit 32fb37c
Show file tree

Hide file tree

Showing 4 changed files with 8 additions and 0 deletions.
diff --git a/docs/hedgehog.md b/docs/hedgehog.md
@@ -30,6 +30,7 @@ Hedgehog Linux is a Debian-based operating system built to
         * [filebeat](malcolm-hedgehog-e2e-iso-install.md#Hedgehogfilebeat): Zeek and Suricata log forwarding
         * [miscbeat](malcolm-hedgehog-e2e-iso-install.md#Hedgehogmiscbeat): System metrics forwarding        
         * [acl-configure](malcolm-hedgehog-e2e-iso-install.md#HedgehogACL): Configure ACL for artifact reachback from Malcolm
+        * [tags-configure](malcolm-hedgehog-e2e-iso-install.md#HedgehogTags): Specify extra tags for forwarded logs
     - [Autostart services](malcolm-hedgehog-e2e-iso-install.md#HedgehogConfigAutostart)
     - [Managing disk usage](malcolm-hedgehog-e2e-iso-install.md#HedgehogDiskUsage)
     - [Zeek Intelligence Framework](hedgehog-config-zeek-intel.md#HedgehogZeekIntel)

diff --git a/docs/images/hedgehog/images/forwarder_config.png b/docs/images/hedgehog/images/forwarder_config.png
diff --git a/docs/images/hedgehog/images/forwarder_tags_config.png b/docs/images/hedgehog/images/forwarder_tags_config.png
diff --git a/docs/malcolm-hedgehog-e2e-iso-install.md b/docs/malcolm-hedgehog-e2e-iso-install.md
@@ -30,6 +30,7 @@ In contrast to using the ISO installer, Malcolm can also be installed on any x86
         * [filebeat](#Hedgehogfilebeat): Zeek and Suricata log forwarding
         * [miscbeat](#Hedgehogmiscbeat): System metrics forwarding        
         * [acl-configure](#HedgehogACL): Configure ACL for artifact reachback from Malcolm
+        * [tags-configure](#HedgehogTags): Specify extra tags for forwarded logs
     - [Autostart services](#HedgehogConfigAutostart)
     - [Managing disk usage](#HedgehogDiskUsage)
 * [Verifying Traffic Capture and Forwarding](#Verify)
@@ -587,6 +588,12 @@ Users will be shown a dialog for a list of IP addresses used to populate a firew
 
 ![PCAP retrieval ACL](./images/hedgehog/images/malcolm_arkime_reachback_acl.png)
 
+### <a name="HedgehogTags"></a>tags-configure: Specify extra tags for forwarded logs
+
+Users may populate a list of values, one per line, to be added to the `tags` field for logs forwarded from the sensor to a Malcolm aggregator. These tags may make it easier to identify or search for data during analysis.
+
+![Extra tags](./images/hedgehog/images/forwarder_tags_config.png)
+
 ### <a name="HedgehogConfigAutostart"></a>Autostart services
 
 Once the forwarders have been configured, the final step is to **Configure Autostart Services**. Choose this option from the configuration mode menu after the welcome screen of the sensor configuration tool.