diff --git a/docs/doxygen-user/ct_malware_scanner.dox b/docs/doxygen-user/ct_malware_scanner.dox
new file mode 100644
index 0000000000000000000000000000000000000000..196a4d5b00ffbf4772cfb05a5b127bab65642b11
--- /dev/null
+++ b/docs/doxygen-user/ct_malware_scanner.dox
@@ -0,0 +1,57 @@
+/*! \page ct_malware_scanner_page Cyber Triage Malware Scanner Module
+
+[TOC]
+
+What Does It Do
+========
+
+The Cyber Triage Malware Scanner module will use the malware scanning infrastructure from Cyber Triage to identify if any Windows executables are malware. It will query an online service using the file's hash value to see if the file was already analyzed and allows you to upload files for analysis if they are new.
+
+This module requires a commercial license from Cyber Triage.
+
+For more information on obtaining a license, refer to [CyberTriage.com](https://cybertriage.com/autopsy-malware-module). The remainder of this page is about the use of the module once it is licensed. 
+
+
+Configuration
+=======
+
+Once you have a license, you must add it on the Options panel.  Choose the 'Cyber Triage' tab and choose 'Add License'.
+
+
+IMAGE
+
+After you enter the license number that you should have received from your email, you will then need to review and agree to the license terms. 
+
+
+The options panel should now display information about the lookup limits. You can always refer back to here about what your limits are and when they reset. 
+
+IMAGE
+
+
+
+Using the Module
+======
+
+Ingest Settings
+------
+
+For each data source, you select if you want files to be uploaded if they have not already been analyzed. By default, they are uploaded. You can choose to not upload them though. 
+
+IMAGE
+
+
+
+Out of Scans
+-------
+
+If you go beyond your limits, you will get a dialog that not all files were analyzed.  You can wait until your limits reset and then start ingest again with only the malware scanning module enabled. It will ignore the files that are already analyzed.
+
+
+Seeing Results
+------
+
+Once ingest has completed, the files with malware will be listed in the Malware node in the tree. 
+
+IMAGE
+
+*/
diff --git a/docs/doxygen-user/main.dox b/docs/doxygen-user/main.dox
index a31367ff6cd2d9ac6822ca2ff2ec2d040f32dccb..193a5abcba9f03498b46ec1cb63bcfca415c74d5 100644
--- a/docs/doxygen-user/main.dox
+++ b/docs/doxygen-user/main.dox
@@ -58,6 +58,7 @@ The following topics are available here:
  - \subpage ileapp_page
  - \subpage aleapp_page
  - \subpage yara_page
+ - \subpage ct_malware_scanner_page
 
 - Reviewing the Results
  - \subpage uilayout_page