cisagov/Malcolm v23.09.0

Malcolm v23.09.0

on GitHub

Malcolm v23.09.0 is a release containing enhancements and bug fixes.

v23.08.1...v23.09.0

• Features and enhancements
  • enable/disable Zeek's ICS parsers via environment variable (idaholab#256)
  • fully automated configuration and installation (idaholab#237) via command-line arguments
  • improvements to several dashboards
  • improvements to field normalization for BACnet and Modbus
  • improvements to the install.py and control.py scripts
• Component version updates
  • ICSNPP parsers to latest releases
  • Arkime to v4.5.0
  • Beats to v8.10.0
  • capa to v6.1.0
  • Fluent Bit to v2.1.9
  • Logstash to v8.10.0
  • NetBox to v3.6.1 (see also v3.6.0 release notes)
  • opensearch-py to v2.3.1
  • Zeek to v6.0.1 (see also v6.0.0 release notes)
• Bug fixes
  • filtering in Arkime sessions view returned zero rows for some reason (idaholab#212)
  • Hedgehog - logrotate service not starting (idaholab#243)
  • Documentation issue (idaholab#245)
  • Error with configure-interfaces.py on both new server images (23.08.1) when setting ntp to 0.pool.ntp.org (idaholab#247)
  • installer script not loading prepackaged tarball correctly (idaholab#257)
  • logs inserted before template gets created cause field conflicts (idaholab#261)

Malcolm and Hedgehog Linux may be obtained by pulling or building the Docker images and/or building the ISO installer images as described in the documentation. Unofficial ISO installer images for Malcolm and Hedgehog Linux are not hosted on GitHub, but may be downloaded from https://malcolm.fyi/.