allow forwarding setup to specify Malcolm connection information in one place (vs. three)

cisagov / Malcolm

Malcolm is a powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts (PCAP files), Zeek logs and Suricata alerts.

https://cisagov.github.io/Malcolm/

Other

1.97k stars 331 forks source link

allow forwarding setup to specify Malcolm connection information in one place (vs. three) #476

Open mmguero opened 2 weeks ago

mmguero commented 2 weeks ago

@mmguero cloned issue idaholab/Malcolm#159 on 2023-03-10:

When configuring forwarding for Hedgehog to Malcolm, right now you have to do filebeat, arkime and "miscbeat" in three different steps.

It would make more sense to ask for the the information once and then set it in all three places, as it almost 100% will always be the same.

I could still leave the option to configure them individually, but I should add an option to configure all of the forwarding in one spot.