Understand MarlinSpike fast, then bring it up from source.

What MarlinSpike is

MarlinSpike is not just a packet parser and not just a topology viewer. It is a field-deployable analyst platform for passive OT and ICS network analysis that turns capture files into topology, asset context, Purdue-level inference, risk findings, suspicious external communication review, and portable JSON report artifacts.

The main product ideas from the project README are straightforward:

• Passive OT and ICS analysis first.
• The modern successor to GrassMarlin — same passive-visibility first principle, rebuilt as a shared web workbench instead of a single-user desktop client.
• A shared workbench model with projects, uploads, scans, history, and review.
• A portable report contract so analysis and review are not trapped in one UI session.

Quick start

The project documentation keeps the first-run path intentionally short. Clone the repo, set secrets in .env, and start the Docker stack.

git clone https://github.com/eris-ot/marlinspike.git
cd marlinspike
cp .env.example .env
docker compose up -d --build

Open the app at http://127.0.0.1:5001 or through your reverse proxy. On first boot, MarlinSpike creates an admin user. If ADMIN_PASSWORD is blank, a random password is generated and printed in the container logs.

Core workflow

The workflow that shows up throughout the project docs is:

1. Create or choose a project.
2. Upload or select a capture.
3. Run a scan that produces a report artifact.
4. Review topology, findings, inventory, and drift in the workbench.
5. Export or archive the JSON report artifact for downstream use.

Documentation trail

If you are new to the project, this is the recommended reading order after this page: