cisagov/Malcolm v5.2.4

Malcolm v5.2.4

on GitHub

Malcolm v5.2.4 is a patch release with improvements and bug fixes.

v5.2.3...v5.2.4

• New features

  • idaholab#74 (automatically generate Zeek intelligence indicators from STIX/TAXII)

• Improvements

  • group MAC addresses and OUI (vendors) into related.mac and related.oui for easier searching across all fields
  • improvements to default anomaly detectors

• Bug fixes

  • Fix idaholab#75 (OpenSearch Dashboards loads slowly without network connectivity)
  • Fix idaholab#76 (directory creation race condition starting up zeek on sensor which may cause zeekctl to fail)

Malcolm and Hedgehog Linux may be obtained by pulling or building the Docker images and/or building the ISO installer images as described in the documentation. Unofficial ISO installer images for Malcolm and Hedgehog Linux are not hosted on GitHub, but may be downloaded from https://malcolm.fyi/download/.