Phoenix is an Open Source malware analysis appliance. At the core, Phoenix is the marriage of Cuckoo, MISP, and Moloch. Phoenix was built by Incident Responders not only as a mechanism to detonate malware and harvest indicators, but also as a system to create and regression test countermeasures (Snort, Suricata, Yara, Bluecoat CPL, etc.). Created with trust groups and sharing in mind, all submissions and hunts are governed by built in TLP. In addition, instead of creating flat, boring IOCs, Phoenix creates rich contextual relationships within MISP which you can then aggregate, correlate and share with other Threat Intel Platforms. Every piece of valuable information extracted from detonation is indexed into Elasticsearch so that "host based hunts" can be pivoted into Moloch with a single click. See a pattern in command line execution? Create a search for it and then pivot directly into Moloch for deeper network analysis on that particular threat family. Phoenix has built in integration with Reversing Labs A1000 platform and Virus Total, so you can simply paste hashes from the latest and greatest malware report, pick a VPN circuit to detonate them on, and Phoenix will grab the files and kick off the detonations allowing you to easily harvest the indicators. All detonations are compared against your existing Suricata and Yara controls so you can immediately tell if you are protected, or if you need to create countermeasures. With Phoenix you can go from malware detonation to control triage in minutes.Phoenix ships with an easy-button so that anyone with some OpenVPN config files, a few VMs, and a couple hours can setup their own malware analysis platform. On very modest desktop hardware it is possible to detonate thousands of samples per day, with full memory dumps (>10TB of memory dumps / day processed on a single system is routine). Phoenix also supports both Windows and Linux malware.Phoenix comes with everything you always wanted an appliance to ship with: a built in ELK stack for logging & troubleshooting, Grafana for performance monitoring and tuning, Docker containers to scale out your Suricata and Yara hunting, and OpenVPN tunneling for up to 252 different circuits.This talk is a 30 minute turbo introduction into the architecture and deployment of Phoenix, followed by a 30 minute advanced use case walk through. The purpose of this talk is to equip conference goers with everything they need to leave and start up their own malware analysis platform within a few hours.