Malcolm v23.10.0 development - Githubissues

cisagov / Malcolm

Malcolm is a powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts (PCAP files), Zeek logs and Suricata alerts.

https://cisagov.github.io/Malcolm/

Other

1.91k stars 319 forks source link

Malcolm v23.10.0 development #287

Closed mmguero closed 11 months ago

mmguero commented 11 months ago

Malcolm v23.10.0 is a feature release.

https://github.com/cisagov/Malcolm/compare/v23.09.0...v23.10.0

Features and enhancements
- support both OpenSearch and Elasticsearch output (idaholab/Malcolm#258)
- "capture-only" Malcolm configuration (AKA "dockerized Hedgehog") (idaholab/Malcolm#254)
- don't run kiosk mode on Hedgehog first boot (idaholab/Malcolm#263)
- let Arkime check its own database to see if it needs to be upgraded
- allow specifying Arkime password hash secret for Viewer clusters
- documentation improvements
- minor updates to slide decks
- allow specifying ports for EtherNet/IP parser via environment variable
Component version updates
- Arkime to v4.6.0
- supercronic to v0.2.27
- beats to v8.10.4
- Logstash to v8.10.4
- NetBox to v3.6.4
- Fluent Bit to v2.1.10
Bug fixes
- set "autorestart" to true for all started services (idaholab/Malcolm#267)
- changed toolchain for building Zeek and Zeek plugins to clang/libc++ to address some build issues with Spicy plugins using GCC
- ensure Arkime is started before creating OpenSearch artifacts
- ensure Arkime and OpenSearch artifacts are populated before starting LogStash
- don't log "0.0" temperatures from Fluent Bit thermal forwarders