Malcolm is a powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts (PCAP files), Zeek logs and Suricata alerts.
Support for multiple NetBox sites (idaholab/Malcolm#449)
Malcolm now supports enrichment from a NetBox inventory for asset interaction analysis across multiple sites. The NetBox site can be specified for uploaded PCAP, for a Hedgehog Linux sensor, and for Malcolm live capture.
JA4+ replaces the JA3 TLS fingerprinting standard from 2017 (see also this blog post) (idaholab/Malcolm#419)
Support uploading Windows Event Log evtx files (idaholab/Malcolm#465) and update associated dashboard
Document using GitHub runners to build Malcolm images (for contributors' guide, idaholab/Malcolm#491)
Generate new forwarder SSL keys on-the-fly when transferring between Malcolm and Hedgehog Linux (idaholab/Malcolm#492)
Add links to the navigation pane of most dashboards to "other" dashboards for non-network log data (e.g., resource monitoring, Windows Event logs, etc.)
./config/*.envenvironment variable files in Malcolm v24.06.0