incorporate icsnpp-profinet-io-cm

idaholab / Malcolm

Malcolm is a powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts (PCAP files), Zeek logs and Suricata alerts.

https://idaholab.github.io/Malcolm/

Other

353 stars 58 forks source link

incorporate icsnpp-profinet-io-cm #429

Closed mmguero closed 7 months ago

mmguero commented 7 months ago

add cisagov/icsnpp-profinet-io-cm to installed zeek parsers
add environment variables for enabling/disabling to zeek.env and local.zeek
add field definitions to OS template and arkime
add parsing code to logstash
add new dashboard (and/or incorporate with existing profinet dashboard?)