cisagov/Malcolm v5.2.7

Malcolm v5.2.7

on GitHub

Malcolm v5.2.7 is a patch release with improvements and bug fixes.

v5.2.6...v5.2.7

• Bugs fixed

  • fixed instances where spicy_ will sometimes be prepended to network.protocol fields (e.g., spicy_wireguard is now fixed to just be wireguard)

• Improvements

  • base GitHub workflow files' docker build step on moby/buildkit:master
  • added API webhook that can be used as an Alerting destionation for alerts to be indexed back into the OpenSearch database as session records
  • added example Alerting monitor and destination using API webhook
  • added ability to run Malcolm's nginx-proxy container in non-HTTPs mode (not recommended unless running behind a third-party reverse proxy like Traefik or Caddy, in which case it is very useful)
  • removed performance-analyzer plugin from OpenSearch container to free up resources
  • improvements to documentation for Anomaly Detection and Alerting
  • added example scripts and Vagrantfile for easily configuring and running Malcolm in a read-only or demo mode on Amazon Linux 2 (useful for AWS)

• Version bumps

  • Arkime to v3.4.0
  • Yara to v4.2.0
  • Capa to v3.2.0

Malcolm and Hedgehog Linux may be obtained by pulling or building the Docker images and/or building the ISO installer images as described in the documentation. Unofficial ISO installer images for Malcolm and Hedgehog Linux are not hosted on GitHub, but may be downloaded from https://malcolm.fyi/download/.