Malcolm is a powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts (PCAP files), Zeek logs and Suricata alerts.
When building Docker images and the Hedgehog Linux ISO, allow specifying alternate download URL for MaxMind GeoIP database files (idaholab/Malcolm#565)
Allow total index size-based pruning for opensearch-remote and elasticsearch-remote database modes (idaholab/Malcolm#446)
Allow splitting out indexes by other field values (idaholab/Malcolm#450)
Allow users to use the Arkime Lua plugin without having to create new bind volume mounts manually (idaholab/Malcolm#533)
Automatically create empty document on startup to avoid "no data" message spamming by Dashboards (idaholab/Malcolm#527 and idaholab/Malcolm#567)
Improvements to documentation and install.py for Linux performance tweaks (idaholab/Malcolm#495)
The MALCOLM_NETWORK_INDEX_SUFFIX and MALCOLM_OTHER_INDEX_SUFFIX variables in ./config/opensearch.env now also support expanding dot-delimited field names in ｛｛ ｝｝ (e.g., ｛｛event.provider｝｝％{％y％m％d}).
MALCOLM_CONTAINER_RUNTIME has been added to ./config/process.env to indicate docker, podman, or kubernetes. This value only currently used in the install, configuration, and control scripts, not inside the containers themselves.
ZEEK_DISABLE_ICS_HART_IP has been added to ./config/zeek.env and can be set to true to disable the new HART-IP protocol parser.
Hedgehog Linux
ZEEK_DISABLE_ICS_HART_IP has been added to control_vars.conf and can be set to true to disable the new HART-IP protocol parser.
Malcolm v24.09.0 contains minor improvements, some component version updates, and bug fixes.
https://github.com/idaholab/Malcolm/compare/v24.08.0...v24.09.0
opensearch-remoteandelasticsearch-remotedatabase modes (idaholab/Malcolm#446)install.pyfor Linux performance tweaks (idaholab/Malcolm#495)install.pyinstallation and configuration script (idaholab/Malcolm#487)ARKIME_NODE_HOSTincorrectly (idaholab/Malcolm#560 and idaholab/Malcolm#559, thanks @divinehawk)suricataDocker container does not initializesuricata.ymlconfig file (idaholab/Malcolm#564)./config/) for Malcolm and incontrol_vars.conffor Hedgehog LinuxMALCOLM_NETWORK_INDEX_SUFFIXandMALCOLM_OTHER_INDEX_SUFFIXvariables in./config/opensearch.envnow also support expanding dot-delimited field names in｛｛ ｝｝(e.g.,｛｛event.provider｝｝％{％y％m％d}).MALCOLM_CONTAINER_RUNTIMEhas been added to./config/process.envto indicatedocker,podman, orkubernetes. This value only currently used in the install, configuration, and control scripts, not inside the containers themselves.ZEEK_DISABLE_ICS_HART_IPhas been added to./config/zeek.envand can be set totrueto disable the new HART-IP protocol parser.ZEEK_DISABLE_ICS_HART_IPhas been added tocontrol_vars.confand can be set totrueto disable the new HART-IP protocol parser.