search

cisagov / Malcolm

Malcolm is a powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts (PCAP files), Zeek logs and Suricata alerts.
https://cisagov.github.io/Malcolm/
Other
1.91k stars 319 forks source link

Malcom Iso #313

Closed Kush2000528 closed 4 months ago

Kush2000528 commented 4 months ago

Hello Team,

Could you please explain why the Malcolm ISO file is as large as 5.28 GB even though the Malcolm Docker images are meant to be pulled separately? I’m curious to understand the rationale behind the ISO’s size given that the Docker images, which are typically quite large, are not included.

mmguero commented 4 months ago

The Malcolm ISO does include the docker images, so the ISO can be installed and used in environments where internet connectivity is not available. The images are compressed and stored at /malcolm_images.tar.xz and are then loaded using docker load at the first boot after the install is complete, after which /malcolm_images.tar.xz is deleted.

Kush2000528 commented 4 months ago

Thank You Team For Your Response

Kush2000528 commented 4 months ago

Hello Team,

Could you please provide information about two repositories, cisagov/Malcom and idaholab/Malcom? I'm interested in learning about the work associated with each of these repositories.

mmguero commented 4 months ago

The two repositories are identical except for URL links pointing back to GitHub. I'm the maintainer of both, and I keep them completely in sync.

Kush2000528 commented 4 months ago

Thank You Sir For Your Response

Could you please clarify why the docker-compose.yml file for cisagov/Malcolm pulls images from the idaholab/Malcolm registry? Additionally, I have noticed that the image sizes are larger than I anticipated. Could you provide some insights into the reasons for this?

mmguero commented 4 months ago

The idaholab images are used as the canonical images for consistency's sake between builds. I don't know how to answer what the image size question: the images include the tools they need to include. You're welcome to use a tool like dive to investigate the layers if you want to.

Kush2000528 commented 4 months ago

Hello Team,

I am trying to make an ISO that is lighter so that I can share it with all my branch offices, this ISO shouldn't contain any of the images, it will fetch depending on the configuration requirements. What I noticed is the ISO of Malcom is heavier even after removing the compressed image file. I tried to study build.sh file it seems the build is not using mini.iso of Debian. Are there any possibilities we could use mini.iso so that we can make Malcom ISO of a few hundred MB without compromising all the customization / CIS-related changes?

Thanks.

mmguero commented 4 months ago

We're not going to support using another ISO base. You're welcome to try to do so, but we won't be able to provide any support for that.

You can build the Malcolm ISO yourself, just don't include the images tarball with the -d argument. If I recall correctly, this will make the iso in the neighborhood of about two gigabytes.

There is no possibility of me spending time getting the iso down to a few hundred megabytes. Best of luck.

Kush2000528 commented 4 months ago

Thank You Team For Your Response