Malcolm v23.09.0 - Githubissues

cisagov / Malcolm

Malcolm is a powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts (PCAP files), Zeek logs and Suricata alerts.

https://cisagov.github.io/Malcolm/

Other

1.91k stars 319 forks source link

Malcolm v23.09.0 #279

Closed mmguero closed 1 year ago

mmguero commented 1 year ago

Malcolm v23.09.0 is a release containing enhancements and bug fixes.

https://github.com/cisagov/Malcolm/compare/v23.08.1...v23.09.0

Features and enhancements
- enable/disable Zeek's ICS parsers via environment variable (idaholab/Malcolm#256)
- fully automated configuration and installation (idaholab/Malcolm#237) via command-line arguments
- improvements to several dashboards
- improvements to field normalization for BACnet and Modbus
- improvements to the install.py and control.py scripts
Component version updates
- ICSNPP parsers to latest releases
- Arkime to v4.5.0
- Beats to v8.10.0
- capa to v6.1.0
- Fluent Bit to v2.1.9
- Logstash to v8.10.0
- NetBox to v3.6.1 (see also v3.6.0 release notes)
- opensearch-py to v2.3.1
- Zeek to v6.0.1 (see also v6.0.0 release notes)
Bug fixes
- filtering in Arkime sessions view returned zero rows for some reason (idaholab/Malcolm#212)
- Hedgehog - logrotate service not starting (idaholab/Malcolm#243)
- Documentation issue (idaholab/Malcolm#245)
- Error with configure-interfaces.py on both new server images (23.08.1) when setting ntp to 0.pool.ntp.org (idaholab/Malcolm#247)
- installer script not loading prepackaged tarball correctly (idaholab/Malcolm#257)
- logs inserted before template gets created cause field conflicts (idaholab/Malcolm#261)