Malcolm v24.03.0

[mmguero]

Malcolm v24.03.0 contains new features, improvements, bug fixes and component version updates.

https://github.com/cisagov/Malcolm/compare/v24.02.0...v24.03.0

• Features and enhancements
  • support json-delimited import for Zeek logs (idaholab/Malcolm#65)
  • go through list of Trivy security findings (idaholab/Malcolm#236)
  • support /attributes and /events enpoints from MISP feed for Zeek intel generation (idaholab/Malcolm#336)
  • KEV detections for Unitronics VisiLogic CVE-2023-6448 (idaholab/Malcolm#394)
  • create dashboards for other non-network log data (idaholab/Malcolm#414)
  • links on landing page should open in a new tab (idaholab/Malcolm#427)
  • incorporate ICSNPP Profinet IO CM parser (idaholab/Malcolm#429)
• Component version updates
  • Arkime to v5.0.1
  • OpenSearch and OpenSearch Dashboards to v2.12.0
• Bug fixes
  • fix the way we do environment variables in local.zeek (idaholab/Malcolm#413)
  • a few issues with the install.py script when installing from GitHub releases (idaholab/Malcolm#416)
  • htadmin creating entries without a newline between them in the htpasswd file (idaholab/Malcolm#426)
  • hard-coded date value in Kibana pivot links (idaholab/Malcolm#428)
  • unencrypted, unzipped extracted file download not working (idaholab/Malcolm#431)
• Configuration changes (in environment variables in ./config/)
  • these variables in zeek.env

    # Set to true to indicate that Zeek should output logs in JSON format
    ZEEK_JSON=
    # Whether or not to require SSL certificate verification when querying a TAXII or MISP feed
    ZEEK_INTEL_FEED_SSL_CERTIFICATE_VERIFICATION=false
    # Whether or not to disable the ICSNPP Profinet IO CM parser
    ZEEK_DISABLE_ICS_PROFINET_IO_CM=