cisagov/Malcolm v6.4.0

Malcolm v6.4.0

on GitHub

Malcolm v6.4.0 features refactored documentation, the initial integration of NetBox (a network infrastructure resource modeling tool), several component version updates and other improvements and bug fixes.

Note that some changes involved in this release require some modifications to files used by docker-compose. Please run ./scripts/auth_setup and ./scripts/install.py --configure to ensure the appropriate new environment variables are set.

v6.3.0...v6.4.0

• New features
  • initial NetBox integration (development ongoing, see idaholab#17)
• Improvements
  • Documentation reformat/refactor
  • Use tini for Docker image init
  • Added support for s7comm_upload_download.log
  • Surface more options in install.py --configure, as well as minor tweaks
  • Update documentation report for results of ISO hardening
• Component version updates
  • Arkime v4.0.1
    • Allow (optional) PCAP compression on Hedgehog
  • OpenSearch and OpenSearch Dashboards v2.3.0
  • Fluent Bit v1.9.9
  • Zeek v5.0.2
• Bug fixes
  • verify capa signature hits are still being parsed/inserted correctly (idaholab#120)
  • Handle long integers in parsing bacnet_discovery and bacnet_property
  • Better enrichment of network.direction based on source and destination IP addresses

Malcolm and Hedgehog Linux may be obtained by pulling or building the Docker images and/or building the ISO installer images as described in the documentation. Unofficial ISO installer images for Malcolm and Hedgehog Linux are not hosted on GitHub, but may be downloaded from https://malcolm.fyi/.