stamparm/maltrail

★ 8,439PythonAudience · ops devopsComplexity · 3/5LicenseSetup · moderate

Mindmap

mindmap
  root((maltrail))
    What It Does
      Monitor network traffic
      Detect bad actors
      Alert on threats
    System Parts
      Sensor watches traffic
      Server stores events
      Web reporting client
    Threat Sources
      Public AV feeds
      Botnet trackers
      Manual malware list
    Detection Methods
      Known threat matching
      Heuristic checks
      Honeypot support

mindmap root((maltrail)) What It Does Monitor network traffic Detect bad actors Alert on threats System Parts Sensor watches traffic Server stores events Web reporting client Threat Sources Public AV feeds Botnet trackers Manual malware list Detection Methods Known threat matching Heuristic checks Honeypot support

Click or tap to explore — scroll the page freely

Things people build with this

USE CASE 1

Monitor a home or office network for connections to known malware domains and review flagged events in a web dashboard.

USE CASE 2

Run on a honeypot machine intentionally left exposed to detect and log attacker behavior.

USE CASE 3

Deploy a sensor on a Linux machine connected to your switch's monitoring port to see all network traffic.

USE CASE 4

Investigate security events by browsing detected alerts filtered by type in the built-in reporting interface.

Tech stack

PythonLinux

Getting it running

Difficulty · moderate Time to first run · 1h+

Requires a Linux machine with network visibility (mirror port or inline bridge), Windows is not supported for the Sensor.

Use, modify, and distribute freely for any purpose, including commercial use, under the MIT license.

In plain English

Maltrail is a network security tool that watches the traffic flowing through your computer network and raises alerts when it spots known bad actors. It works by comparing the domains, web addresses, IP addresses, and certain request headers it sees against a large collection of threat intelligence lists. Those lists contain entries that security researchers have identified as belonging to malware, attackers, botnets, and other malicious activity. The threat lists come from dozens of public sources, including AV companies, security research feeds, and organizations that track botnets and ransomware. On top of those feeds, the project maintains its own manually compiled entries covering hundreds of named malware families and attack campaigns, including mobile malware for Android devices. When traffic matches an entry in any of these lists, Maltrail logs the event and flags it for review. It also has optional heuristic checks that can catch suspicious behavior that does not appear in any list yet. The system is split into three pieces: a Sensor, a Server, and a reporting Client. The Sensor is the component that actually watches the network. You run it on a Linux machine that has visibility into your network traffic, either by connecting it to a monitoring port on your switch or by placing it inline on a network bridge. It can also run on a honeypot, which is a machine intentionally left exposed to attract attackers. The Sensor sends any events it finds to the Server, which stores them. By default all three components run on the same machine, but you can split them across separate machines if needed. The Client is a web-based reporting interface where you can browse detected events, filter by type, and investigate what happened. The README includes screenshots of the interface and a section covering real-life example cases, such as port scans, mass scanning activity, data leakage, and false positives. Maltrail is written in Python and runs on Linux. It is open source under the MIT license. The full README is longer than what was shown.

Copy-paste prompts

Prompt 1

How do I set up Maltrail's Sensor on a Linux machine to monitor traffic through a switch mirror port and send events to the Server?

Prompt 2

Configure Maltrail to run the Sensor, Server, and reporting Client all on the same Linux box and show me how to view alerts in the browser.

Prompt 3

How do I add a custom suspicious domain to Maltrail's threat list so it gets flagged immediately when seen in traffic?

Prompt 4

Walk me through reading a Maltrail event report to decide whether a detected alert is a real threat or a false positive.

Open on GitHub → Explain another repo

← stamparm on gitmyhub — every repo by this author, as a profile.

Verify against the repo before relying on details.