Malcolm v23.12.0 is a feature release with many improvements, updates and fixes
- Features and enhancements
- replace kbn_sankey_vis with vega or transform (#147)
- address issues with NetBox database and Logstash's NetBox cache (#259)
- integrate nsacyber/ELITEWOLF signatures into default rule set CISA (#275)
- improve error messages for PCAP/artifact processing beyond just icons (#276)
- option to auto-create "catch-all" NetBox IPAM prefixes for private IP space (#279)
- use prefix.description instead of VRF for identifying subnets in NetBox (#280)
- allow customizing Arkime's freeSpaceG setting (for PCAP deletion) in an environment variable (#285)
- replace master/slave with client/server when parsing modbus logs (#291)
- put netbox restore database functionality inside container (#294)
- provide way to customize zeek Site::local_nets (#295)
- allow configuration of docker's logging driver to prevent disk-exhaustion (#301)
- allow user to include other suricata config YML files (#302)
- allow user to be able to provide custom zeek config (#303)
- allow tuning Suricata's max-pending-packets via environment variable (#304)
- enable OpenSearch dashboards condensed header
- Component version updates
- Bug fixes
- Malcolm Sensor Temperature dashboard issue (#265)
- strip out broken Arkime and NetBox links from dashboards for Kibana import (#286)
- have netbox-restore script restart necessary services or set necessary permissions (#287)
- file type validation not working for upload from (some?) windows browsers (#292)
- go through list of Qualys image scan results (#299)
Malcolm and Hedgehog Linux may be obtained by pulling or building the Docker images and/or building the ISO installer images as described in the documentation. Unofficial ISO installer images for Malcolm and Hedgehog Linux are not hosted on GitHub, but may be downloaded from https://malcolm.fyi/.