cisagov/Malcolm v23.05.0

Malcolm v23.05.0

on GitHub

Malcolm v23.05.0 is a major release with new features, enhancements, component version updates and bug fixes.

IMPORTANT NOTE: Malcolm v23.05.0 has completely changed the way it manages its settings: rather than using environment variables found at the top of the docker-compose.yml file, it uses environment variables in .env files inside of the config directory. The locations of a number of configuration files have also changed. It's not recommended to update to Malcolm v23.05.0 from a previous version of Malcolm. Instead, shut down Malcolm, rename your old Malcolm installation directory to something else, and reconfigure Malcolm using ./scripts/configure and ./scripts/auth_setup.

v23.04.0...v23.05.0

• New features

  • integrate ICSNPP-Synchrophasor parser (idaholab#190)
  • End-to-end Malcolm and Hedgehog Linux ISO Installation document (idaholab#181)
  • support Malcolm deployment with Kubernetes (idaholab#149)
    • see Deploying Malcolm with Kubernetes
    • This could be considered a "beta" release for Malcolm deployment with Kubernetes, as there is still some work to be done in this area. Please let us know what issues or suggestions you have via the issue tracker or via email to malcolm@inl.gov.
    • contributing issues:
      • inotify issue (idaholab#168)
      • htadmin/nginx and htpasswd (idaholab#169)
      • opensearch (idaholab#170)
      • uploading large PCAP files (idaholab#171)
      • script consolidation (idaholab#172)
      • documentation (idaholab#173)
      • user-defined persistent volumes (idaholab#174)
      • opensearch keystore (idaholab#176)
      • expose other TCP services (idaholab#183)
      • provide with filebeat access to nginx access and error logs (idaholab#186)
      • use Secrets for some environment variables instead of ConfigMaps (idaholab#189)

• Enhancements and fixes

  • remove name-map-ui container (idaholab#165) in favor of using NetBox for asset identification
  • Python script refactoring, consolidation and cleanup
  • standardization of Docker container entrypoints
  • create ./scripts/configure alias for ./scripts/install.py --configure

• Component version updates

  • Arkime to v4.3.0
  • Capa to v5.1.0
  • Fluent Bit to v2.1.2
  • NetBox to v3.5.0
  • NGINX to v1.22.1
  • Supercronic to v0.2.24
  • Suricata to v6.0.10
  • Yara to v4.3.0
  • Zeek to v5.2.1

Malcolm and Hedgehog Linux may be obtained by pulling or building the Docker images and/or building the ISO installer images as described in the documentation. Unofficial ISO installer images for Malcolm and Hedgehog Linux are not hosted on GitHub, but may be downloaded from https://malcolm.fyi/.