cisagov/Malcolm v5.2.3

Malcolm v5.2.3

on GitHub

Malcolm v5.2.3 is a patch release with component version bumps, bug fixes and improvements.

v5.2.2...v5.2.3

• Version bumps

  • Arkime v3.3.1
  • Zeek v4.2.0

• Improvements

  • Added script and better documentation for putting Malcolm in "read-only" mode
  • Improved Files dashboard

• Bug fixes

  • Fixed an issue where Logstash wasn't parsing the ftime from files.log correctly (a field added by the Spicy ZIP analyzer)
  • Fixed idaholab#73 (path for tcpdump changed) for Hedgehog Linux
  • Fixed idaholab#72 (better file directory/name parsing and normalization in Logstash)

Malcolm and Hedgehog Linux may be obtained by pulling or building the Docker images and/or building the ISO installer images as described in the documentation. Unofficial ISO installer images for Malcolm and Hedgehog Linux are not hosted on GitHub, but may be downloaded from https://malcolm.fyi/download/.