# Presets

> The public repo does not ship third-party PCAP corpora, but MarlinSpike supports local preset captures for labs and repeatable field libraries.

*Canonical HTML: https://grassmarlin.com/wiki/presets/*
*Markdown source: https://grassmarlin.com/wiki/presets.md*
*Français: https://grassmarlin.com/fr/wiki/presets.md*

---

This page mirrors the honest stance in the project docs: public images and the public repository do not bundle third-party corpora by default, but operators can still maintain a local preset library.

**No bundled corpora in public repo**, The checked-in preset docs explicitly say third-party PCAP corpora are not bundled publicly.

**Local preset folders supported**, You can create your own category folders under `presets/` and load local captures there.

**Admin uploads also work**, Teams can upload captures through the application UI after deployment instead of baking them into the local preset tree.

## Public preset-library policy

The public repository does not bundle third-party PCAP corpora. That keeps redistribution clean and avoids shipping capture data the public project should not be republishing by default.

The same principle applies to public images: local corpora are for your own deployment or lab environment, not something the public site should imply is always included.

## How to add local presets

The checked-in preset README gives a simple pattern:

- Create category folders under `presets/`.
- Add your own `.pcap`, `.pcapng`, or `.cap` files locally.
- Or upload those files later through the admin UI after deployment.

```
presets/
  site-a/
    baseline-shift-a.pcapng
  site-b/
    historian-incident.cap
```

## Why those files stay local

The preset docs note that preset capture files are ignored by both `.gitignore` and `.dockerignore`. That means they are not committed and not baked into public images by default.

This is a useful operational split:

- The public repo stays clean and redistributable.
- Your private deployment can still keep a repeatable capture library for training, testing, or demos.
- Teams do not have to expose customer traffic or third-party data just to use the preset feature.

## Alternative intake paths

You do not need a baked-in preset library to use MarlinSpike effectively. The project docs repeatedly position the main intake path as uploads or captures fed into the workbench during an engagement.

Use presets when you want a local reusable library. Use uploads when you want ad hoc field captures, incident files, or lab exports reviewed immediately.

The deployment page explains how the app stores uploads, reports, and preset data inside the Docker-backed runtime paths. See [Deployment](/wiki/deployment.md).

Source references: [presets/README.md](https://github.com/eris-ot/marlinspike/blob/main/presets/README.md) · [README.md](https://github.com/eris-ot/marlinspike/blob/main/README.md)