Skip to content

Releases: idaholab/Malcolm

Malcolm v25.11.0

03 Nov 23:25
@mmguero mmguero
v25.11.0
2f8b5c4
This commit was signed with the committer’s verified signature.
mmguero Seth Grover
GPG key ID: 986055F72F110479
Verified
Learn about vigilant mode.

Choose a tag to compare

View all tags
Malcolm v25.11.0 Latest
Latest

Malcolm v25.11.0 includes an overhaul of the install.py installation/configuration script, a few bug fixes, and some component version updates.

v25.09.0...v25.11.0

  • ✨ Features and enhancements
    • We're in the process of majorly overhauling our install.py script (#395) used for setting up a Linux or MacOS system to run Malcolm and for configuring Malcolm's runtime options. There are future updates still to come (#766) but for now the command-line and dialog-based interfaces' functionality and backend are in place. The step-by-step wizard has been replaced with a menu-based interface that allows for changing individual values without having to step through the whole set of questions. The Docker-based Malcolm installation example on Ubuntu and end-to-end installation example have useful information about this change, as does the command-line arguments document. We've done a lot of testing on what's a complete rewrite of this, but there is a possibility we missed something; if you find an issue with the new install/configure script, please open a discussion or log a bug and let us know. For the next release or so, we're leaving the legacy installer in place as scripts/legacy_install.py which could be used in a pinch (e.g., run scripts/legacy_install.py --configure for the old configuration menu).
    • We've incorporated a new "Connections Tree" visualization. This visualization tracks the potential of lateral movement based on the observed communications between all devices that reach a root node, identified by IP address. It gives a high-level view showing both direct and indirect connetions between the root IP and all of its destinations, regardless of time, along with enriched data for each endpoint and connection.
    • Updates to the Validated Design Architecture Review (VADR) dashboards.
    • The OpenSearch container now includes the repository-s3 plugin, useful for those who wish to configure OpenSearch's snapshots to save to S3-compatible buckets.
  • ✅ Component version updates
  • 🐛 Bug fixes
    • Double imports when restarting Malcolm (#588) (thanks @KchChr)
  • 🧹 Code and project maintenance
    • Refactored a number of Python functions to reduce cyclomatic complexity (#765, work ongoing)
  • 📄 Configuration changes (in environment variables in ./config/) for Malcolm and in control_vars.conf for Hedgehog Linux. The Malcolm control script (e.g., ./scripts/status, ./scripts/start, etc.) should take care of creating new variables and migrating existing ones as needed based on the rules in ./config/env-var-actions.yml without intervention on the user's part.
    • Malcolm
      • NGINX_RESOLVER_IPV4_OFF and NGINX_RESOLVER_IPV6_OFF have been renamed to NGINX_RESOLVER_IPV4 and NGINX_RESOLVER_IPV6, respectively, and their logic reversed, in nginx.env.

Malcolm is a powerful, easily deployable network 🖧 traffic analysis tool suite for network security monitoring 🕵🏻‍♀️.

Malcolm operates as a cluster of containers 📦, isolated sandboxes which each serve a dedicated function of the system. This makes Malcolm deployable with frameworks like Docker 🐋, Podman 🦭, and Kubernetes ⎈. Check out the Quick Start guide for examples on how to get up and running.

Alternatively, dedicated official ISO installer images 💿 for Malcolm and Hedgehog Linux 🦔 can be downloaded from Malcolm's releases page on GitHub. Due to limits on individual files in GitHub releases, these ISO files have been split 🪓 into 2GB chunks and can be reassembled with scripts provided for both Bash 🐧 (release_cleaver.sh) and PowerShell 🪟 (release_cleaver.ps1). See Downloading Malcolm - Installer ISOs for instructions.

As always, join us on the Malcolm discussions board 💬 to engage with the community, or pop some corn 🍿 and watch a video 📼.

Contributors

KchChr
Assets 13

Malcolm v25.09.0

24 Sep 20:42
@mmguero mmguero
v25.09.0
b77e3eb
This commit was signed with the committer’s verified signature.
mmguero Seth Grover
GPG key ID: 986055F72F110479
Verified
Learn about vigilant mode.

Choose a tag to compare

View all tags
Malcolm v25.09.0

Malcolm v25.09.0 includes new features and available customizations, improvements to Threat Intelligence, component version updates, and several important bug fixes.

v25.08.1...v25.09.0

Malcolm is a powerful, easily deployable network 🖧 traffic analysis tool suite for network security monitoring 🕵🏻‍♀️.

Malcolm operates as a cluster of containers 📦, isolated sandboxes which each serve a dedicated function of the system. This makes Malcolm deployable with frameworks like Docker 🐋, Podman 🦭, and Kubernetes ⎈. Check out the Quick Start guide for examples on how to get up and running.

Alternatively, dedicated official ISO installer images 💿 for Malcolm and Hedgehog Linux 🦔 can be downloaded from Malcolm's releases page on GitHub. Due to limits on individual files in GitHub releases, these ISO files have been split 🪓 into 2GB chunks and can be reassembled with scripts provided for both Bash 🐧 (release_cleaver.sh) and PowerShell 🪟 (release_cleaver.ps1). See Downloading Malcolm - Installer ISOs for instructions.

As always, join us on the Malcolm discussions board 💬 to engage with the community, or pop some corn 🍿 and watch a video 📼.

Loading

Malcolm v25.08.1

28 Aug 22:11
@mmguero mmguero
v25.08.1
9367a53
This commit was signed with the committer’s verified signature.
mmguero Seth Grover
GPG key ID: 986055F72F110479
Verified
Learn about vigilant mode.

Choose a tag to compare

View all tags
Malcolm v25.08.1

Malcolm v25.08.1 consists of several major component updates and a few bug fixes.

v25.08.0...v25.08.1

If you are updating from a version older than v25.06.0, please read those release notes prior to updating to this version.

  • ✨ Features and enhancements
  • ✅ Component version updates
  • 🐛 Bug fixes
    • Query workbench (SQL and PPL) is broken due to something to do with network index pattern field aliases (cisagov/Malcolm#746)
    • Zeek containers need to be limited in max number of open files or memory grows very large (cisagov/Malcolm#747)
    • avoid OpenSearch search shard failures by including unspecified roles in indexes during NetBox enrichment #(cisagov/Malcolm#749)
    • differences in MISP object/attribute formatting cause Malcolm to ignore some threat feed indicators (cisagov/Malcolm#753)
    • NetBox sites used for development testing included in release artifacts (cisagov/Malcolm#755)
    • wipe script no longer removes .gitignore files
  • 🧹 Code and project maintenance
    • Standardized the way Python scripts in Malcolm (both in the containers and the control scripts) do debug/informational logging (increase logging level with -v, -vv, -vvv, etc.)
    • Removed vagrant-sshfs requirement from vagrant-based ISO builds in favor of Vagrant's builtin rsync mechanism

Malcolm is a powerful, easily deployable network 🖧 traffic analysis tool suite for network security monitoring 🕵🏻‍♀️.

Malcolm operates as a cluster of containers 📦, isolated sandboxes which each serve a dedicated function of the system. This makes Malcolm deployable with frameworks like Docker 🐋, Podman 🦭, and Kubernetes ⎈. Check out the Quick Start guide for examples on how to get up and running.

Alternatively, dedicated official ISO installer images 💿 for Malcolm and Hedgehog Linux 🦔 can be downloaded from Malcolm's releases page on GitHub. Due to limits on individual files in GitHub releases, these ISO files have been split 🪓 into 2GB chunks and can be reassembled with scripts provided for both Bash 🐧 (release_cleaver.sh) and PowerShell 🪟 (release_cleaver.ps1). See Downloading Malcolm - Installer ISOs for instructions.

As always, join us on the Malcolm discussions board 💬 to engage with the community, or pop some corn 🍿 and watch a video 📼.

Loading

Malcolm v25.08.0

07 Aug 21:23
@mmguero mmguero
v25.08.0
c17950f
This commit was signed with the committer’s verified signature.
mmguero Seth Grover
GPG key ID: 986055F72F110479
Verified
Learn about vigilant mode.

Choose a tag to compare

View all tags
Malcolm v25.08.0

Malcolm v25.08.0 is a minor release fixing a regression bug inadvertently introduced in v25.07.0.

v25.07.0...v25.08.0

If you are updating from a version older than v25.06.0, please read those release notes prior to updating to this version.

  • ✨ Features and enhancements
  • 🐛 Bug fixes
    • Malcolm fields are not created in Arkime (cisagov#735)
      • Due to this commit, the order in which the Arkime fields database was initialized and the WISE service started was switched, which resulted in the initial run of capture (responsible for populating Malcolm's custom fields) failing. The order of these operations has been corrected.
  • 📄 Configuration changes (in environment variables in ./config/) for Malcolm. The Malcolm control script (e.g., ./scripts/status, ./scripts/start, etc.) should take care of creating new variables and migrating existing ones as needed based on the rules in ./config/env-var-actions.yml.
    • FILEBEAT_CLEANUP_VERBOSITY and added to filebeat.env to control the verbosity of the clean-processed-folder.py script mentioned above in relation to cisagov#736. For example, setting FILEBEAT_CLEANUP_VERBOSITY=-vvvv corresponds to the DEBUG log level, and will produce output like this once per minute:
    filebeat-1  | 2025-08-07T20:23:00Z  /usr/local/bin/clean-processed-folder.py: Found 2099 Zeek processed directory files to consider.
filebeat-1  | 2025-08-07T20:23:00Z  /usr/local/bin/clean-processed-folder.py: Found 135 Zeek live directory files to consider.
filebeat-1  | 2025-08-07T20:23:00Z  /usr/local/bin/clean-processed-folder.py: Checked 2099 Zeek processed directory files at a rate of 10804 files/second.
filebeat-1  | 2025-08-07T20:23:00Z  /usr/local/bin/clean-processed-folder.py: Checked 135 Zeek live directory files at a rate of 1411 files/second.
filebeat-1  | 2025-08-07T20:23:00Z  /usr/local/bin/clean-processed-folder.py: Found 161 Suricata files to consider.
filebeat-1  | 2025-08-07T20:23:00Z  /usr/local/bin/clean-processed-folder.py: Checked 161 Suricata files at a rate of 18018 files/second.
filebeat-1  | 2025-08-07T20:23:00Z  /usr/local/bin/clean-processed-folder.py: Finished pruning files.

Malcolm is a powerful, easily deployable network 🖧 traffic analysis tool suite for network security monitoring 🕵🏻‍♀️.

Malcolm operates as a cluster of containers 📦, isolated sandboxes which each serve a dedicated function of the system. This makes Malcolm deployable with frameworks like Docker 🐋, Podman 🦭, and Kubernetes ⎈. Check out the Quick Start guide for examples on how to get up and running.

Alternatively, dedicated official ISO installer images 💿 for Malcolm and Hedgehog Linux 🦔 can be downloaded from Malcolm's releases page on GitHub. Due to limits on individual files in GitHub releases, these ISO files have been split 🪓 into 2GB chunks and can be reassembled with scripts provided for both Bash 🐧 (release_cleaver.sh) and PowerShell 🪟 (release_cleaver.ps1). See Downloading Malcolm - Installer ISOs for instructions.

As always, join us on the Malcolm discussions board 💬 to engage with the community, or pop some corn 🍿 and watch a video 📼.

Loading

Malcolm v25.07.0 (see note about regression bug)

30 Jul 19:49
@mmguero mmguero
v25.07.0
90c2cec
This commit was signed with the committer’s verified signature.
mmguero Seth Grover
GPG key ID: 986055F72F110479
Verified
Learn about vigilant mode.

Choose a tag to compare

View all tags
Malcolm v25.07.0 (see note about regression bug)

NOTE: A regression has been found (cisagov#735) in v25.07.0 that can cause the Malcolm fields to not get populated in Arkime's fields database when a new Malcolm instance is initialized. A fix is in the works. It's recommended you wait to upgrade until v25.08.0 (which should be released 2025-08-06).

Malcolm v25.07.0 includes quite a few new features and enhancements, performance improvements, bug fixes, and component version updates.

If you are updating from a version older than v25.06.0, please read those release notes prior to updating to this version.

v25.06.0...v25.07.0

Malcolm is a powerful, easily deployable network 🖧 traffic analysis tool suite for network security monitoring 🕵🏻‍♀️.

Malcolm operates as a cluster of containers 📦, isolated sandboxes which each serve a dedicated function of the system. This makes Malcolm deployable with frameworks like Docker 🐋, Podman 🦭, and Kubernetes ⎈. Check out the Quick Start guide for examples on how to get up and running.

Alternatively, dedicated official ISO installer images 💿 for Malcolm and Hedgehog Linux 🦔 can be downloaded from Malcolm's releases page on GitHub. Due to limits on individual files in GitHub releases, these ISO files have been split 🪓 into 2GB chunks and can be reassembled with scripts provided for both Bash 🐧 ([release_cleaver.sh]...

Read more
Loading

Malcolm v25.06.0

23 Jun 15:30
@mmguero mmguero
v25.06.0
fd91a09
This commit was signed with the committer’s verified signature.
mmguero Seth Grover
GPG key ID: 986055F72F110479
Verified
Learn about vigilant mode.

Choose a tag to compare

View all tags
Malcolm v25.06.0

Malcolm v25.06.0 includes a some new and oft-requested features, bug fixes, and component version bumps.

v25.05.0...v25.06.0

NOTE: As this Malcolm release enables the OpenSearch Security Plugin as described below, even inter-container access to OpenSearch must now be authenticated when using Malcolm's embedded OpenSearch instance. To accomplish this, an internal-use-only account and password is used for connecting to OpenSearch by Malcolm's other components as needed. This credential (saved in .opensearch.primary.curlrc in the Malcolm installation directory) needs to be generated before Malcolm starts up the first time after upgrading. To do so, please run ./scripts/auth_setup and select (Re)generate internal passwords for local primary OpenSearch instance. This credential is only used internally for OpenSearch and cannot be used to remotely access Malcolm.

  • ✨ Features and enhancements
    • This release adds role-based access control (RBAC) to Malcolm (cisagov#460).
      • Malcolm's RBAC feature is based on Keycloak realm roles and is implemented in to layers:
        1. Whenever possible, Malcolm's backend Keycloak realm roles are mapped to the roles/groups/permissions features provided by the components that make up Malcolm, for example:
        2. For other Malcolm components that don't implement their own permission management systems, Malcolm handles the enforcement roles based on request URIs in its NGINX proxy layer.
      • This is an optional feature. RBAC is only available when the authentication method is keycloak or keycloak_remote. With other authentication methods such as HTTP basic or LDAP, or when RBAC is disabled, all Malcolm users effectively have administrator privileges.
      • Because the OpenSearch Security Plugin requires TLS even internally, Malcolm's internal connections to the embedded OpenSearch instance, when used, are now all performed over HTTPS. However, this is all handled internally and should not behave or appear different to the user than it did in previous versions.
      • See the role-based access control documentation for more information on this feature.
    • Malcolm's embedded KeyCloak instance now automatically creates and configures the default client by ID, if specified in ./config/keycloak.env.
    • Allow user to specify subnet filters for NetBox autopopulation (cisagov#634)
      • This feature is especially useful for excluding dynamic address ranges such as those used by DHCP, which should generally not trigger autopopulation in NetBox. Since these addresses can change frequently and aren't tied to specific devices, including them could result in inaccurate or noisy inventory data. By fine-tuning which private subnets are included or excluded, users can ensure that only meaningful, typically static assignments are autopopulated.
    • Expose init arguments for Arkime's db.pl and also use them for Malcolm's creation of its own index templates (cisagov#692)
    • Extend Zeek's intel.log with additional fields using corelight/ExtendIntel (part 1) (cisagov#502)
      • This integrates the corelight/ExtendIntel plugin into Malcolm internally but does not significantly change how Malcolm presents intel.log to the user. Further work to do so will be continued in cisagov#695.
    • Some internal tweaks to the PCAP processing pipeline that are going to be leveraged by the Malcolm-Helm project (#630)
    • Handle a fix in the ICSNPP OPCUA-Binary plugin that adds a new sec_token_id field (cisagov/icsnpp-opcua-binary#101)
    • Moved the configuration for Zeek's use of the zeek-kafka plugin to its own file (kafka.zeek) to make it easier to override in Docker using a volume bind mount or in K8s using a configMap.
    • Changed some internal objects used for NetBox enrichment caching from Ruby's Concurrent::Hash to Concurrent::Map for better performance
    • Minor improvements to the icons, shortcuts, and convenience bash functions in the ISO-installed Malcolm desktop environment
    • NGINX now generates a robots.txt file to avoid web crawlers
  • ✅ Component version updates
  • 🐛 Bug fixes
    • NetBox autodiscovery no longer populating host name from DNS, DHCP, NTLM (regression, cisagov#699)
    • documentation served at /readme is trying to pull fonts from use.fontawesome.com (cisagov#694)
    • support fractional gigabytes correctly when generating Arkime's config.ini setting maxFileSizeG from PCAP_ROTATE_MEGABYTES
    • Improved logstash filters that calculate unique hashes used as document IDs for Zeek and Suricata logs to better prevent duplicate logs from being written to the document store
  • 📄 Configuration changes (in environment variables in ./config/) for Malcolm and in control_vars.conf for Hedgehog Linux. The Malcolm control script (e.g., ./scripts/status, ./scripts/start, etc.) should take care of creating new variables and migrating existing ones as needed based on the rules in ./config/env-var-actions.yml.
Read more

Contributors

awick
Loading

Malcolm v25.05.0

15 May 18:40
@mmguero mmguero
v25.05.0
33df921
This commit was signed with the committer’s verified signature.
mmguero Seth Grover
GPG key ID: 986055F72F110479
Verified
Learn about vigilant mode.

Choose a tag to compare

View all tags
Malcolm v25.05.0

Malcolm v25.05.0 adds support for the Emerson ROC Plus protocol (including a Zeek analyzer and corresponding dashboard), component updates, and bug fixes.

v25.04.1...v25.05.0

  • ✨ Features and enhancements
    • Added support for ROC Plus (cisagov#661)
    • Make Zeek metrics port configurable (thanks to @divinehawk) (cherry-picked from cisagov#668)
    • Improve ability to upload PCAP files via cURL
    • Minor UI improvements to desktop environment for Malcolm and Hedgehg Linux ISO-installed instances
  • ✅ Component version updates
  • 🐛 Bug fixes
    • race condition in suricata offline container between pcap processing and suricata socket (cisagov#667)
    • NetBox autopopulation not working with prefixes correctly (cisagov#670) (regression)
    • ensure Arkime's queryExtraIndices config.ini setting is only set when Zeek/Suricata logs are using a different index pattern
    • set number_of_replicas cluster setting to 0 for embedded single-node OpenSearch instance to avoid yellow state
  • 📄 Configuration changes (in environment variables in ./config/) for Malcolm and in control_vars.conf for Hedgehog Linux
  • 🧹 Code and project maintenance

Malcolm is a powerful, easily deployable network 🖧 traffic analysis tool suite for network security monitoring 🕵🏻‍♀️.

Malcolm operates as a cluster of containers 📦, isolated sandboxes which each serve a dedicated function of the system. This makes Malcolm deployable with frameworks like Docker 🐋, Podman 🦭, and Kubernetes ⎈. Check out the Quick Start guide for examples on how to get up and running.

Alternatively, dedicated official ISO installer images 💿 for Malcolm and Hedgehog Linux 🦔 can be downloaded from Malcolm's releases page on GitHub. Due to limits on individual files in GitHub releases, these ISO files have been split 🪓 into 2GB chunks and can be reassembled with scripts provided for both Bash 🐧 (release_cleaver.sh) and PowerShell 🪟 (release_cleaver.ps1). See Downloading Malcolm - Installer ISOs for instructions.

As always, join us on the Malcolm discussions board 💬 to engage with the community, or pop some corn 🍿 and watch a video 📼.

Contributors

divinehawk
Loading

v25.04.1

30 Apr 21:53
@mmguero mmguero
v25.04.1
b621e66
This commit was signed with the committer’s verified signature.
mmguero Seth Grover
GPG key ID: 986055F72F110479
Verified
Learn about vigilant mode.

Choose a tag to compare

View all tags
v25.04.1

Malcolm v25.04.1 contains only one change: updating Arkime to v5.6.4 which mitigates newly-discovered remote code execution (RCE) vulnerabilities.

v25.04.0...v25.04.1

  • ✅ Component version updates
    • Arkime v5.6.4 to resolve RCE vulnerabilities, as described below in the #announcements channel on the Arkime slack:
      • possible to bypass forced expressions for some API calls
      • direct access to OpenSearch/Elasticsearch could be used to create session documents that hang viewer or have viewer execute code
      • since Arkime 5.1.0 any arkimeUser user could create OpenSearch/Elasticsearch documents in any index that viewer had access to

Malcolm is a powerful, easily deployable network 🖧 traffic analysis tool suite for network security monitoring 🕵🏻‍♀️.

Malcolm operates as a cluster of containers 📦, isolated sandboxes which each serve a dedicated function of the system. This makes Malcolm deployable with frameworks like Docker 🐋, Podman 🦭, and Kubernetes ⎈. Check out the Quick Start guide for examples on how to get up and running.

Alternatively, dedicated official ISO installer images 💿 for Malcolm and Hedgehog Linux 🦔 can be downloaded from Malcolm's releases page on GitHub. Due to limits on individual files in GitHub releases, these ISO files have been split 🪓 into 2GB chunks and can be reassembled with scripts provided for both Bash 🐧 (release_cleaver.sh) and PowerShell 🪟 (release_cleaver.ps1). See Downloading Malcolm - Installer ISOs for instructions.

As always, join us on the Malcolm discussions board 💬 to engage with the community, or pop some corn 🍿 and watch a video 📼.

Loading

Malcolm v25.04.0

28 Apr 20:05
@mmguero mmguero
v25.04.0
ce3ee82
This commit was signed with the committer’s verified signature.
mmguero Seth Grover
GPG key ID: 986055F72F110479
Verified
Learn about vigilant mode.

Choose a tag to compare

View all tags
Malcolm v25.04.0

Malcolm v25.04.0 contains new features and improvements, component version updates, bug fixes, and other great stuff.

v25.03.1...v25.04.0

  • ✨ Features and enhancements

    • add option to use external NetBox instance (cisagov#597)

    • add -q/--quiet option for start/restart (cisagov#656)

    • handle non-HTTPS arkime case (cisagov#629)

    • lots of improvements to control.py and install.py for Kubernetes deployment

      • improved start/stop/wipe control script behavior
      • allow providing resource requests in manifests via YML file and command-line argument
      ...
Kubernetes:
  -n, --namespace <string>
                        Kubernetes namespace
  --skip-persistent-volume-checks [SKIPPERVOLCHECKS]
                        Skip checks for PersistentVolumes/PersistentVolumeClaims in manifests (only for "start" operation with Kubernetes)
  --no-capture-pods [NOCAPTUREPODSSTART]
                        Do not deploy pods for traffic live capture/analysis (only for "start" operation with Kubernetes)
  --no-capabilities [NOCAPABILITIES]
                        Do not specify modifications to container capabilities (only for "start" operation with Kubernetes)
  --inject-resources [INJECTRESOURCES]
                        Inject container resources from kubernetes-container-resources.yml (only for "start" operation with Kubernetes)
  --image-source <string>
                        Source for container images (e.g., "ghcr.io/idaholab/malcolm"; only for "start" operation with Kubernetes)
  --image-tag <string>  Tag for container images (e.g., "25.04.0"; only for "start" operation with Kubernetes)
  --delete-namespace [DELETENAMESPACE]
                        Delete Kubernetes namespace (only for "wipe" operation with Kubernetes)
...

    • improvements to Malcolm's vanilla Kubernetes manifests

      • lowered the amount of storage for the persistent volumes in the AWS EFS example
      • replaced name label with app label for deployments in accordance with best practices

    • improve links on landing page for NetBox and auth to accurately reflect what Malcolm is using

    • added more smarts to the NGINX startup script to dynamically set up upstreams that may or may not exist based on enabled or disabled Malcolm features

    • fixed a minor issue in the script setting up Zeek intelligence updates where it would remove its own lockfile

  • ✅ Component version updates
  • 🐛 Bug fixes
    • API tokens created in NetBox still require authentication through NGINX reverse proxy (cisagov#383)
    • adjust Logstash health check so K8s liveness probe doesn't kill it (cisagov#630)
    • be more resilient in zeekctl status checks in zeekdeploy.sh (cisagov#652)
    • in deployments with multiple zeek-live containers, each container's restarting causes the others to restart zeek (cisagov#651)
  • 📄 Configuration changes (in environment variables in ./config/) for Malcolm and in control_vars.conf for Hedgehog Linux
  • 🧹 Code and project maintenance
    • various minor documenation improvements
    • improvements to build and appliance packaging scripts (cisagov#640)
    • document customizing Malcolm with an additional output pipeline (cisagov#643)
    • overhaul "deploying Malcolm on AWS" documentation (cisagov#655)
    • integrate customizations from Malcolm-Helm as options in vanilla Malcolm (part 1) (cisagov#642)
    • put in version pinning for Python packages (cisagov#644)
    • remove redundant storage of URLs in documents as artifact of NetBox enrichment
    • removed references to AWS client access and secret keys from packer_vars.json.example and documentation for building AWS AMIs (for security, these variables are now passed in via environment variables on the command line in the examples)

Malcolm is a powerful, easily deployable network 🖧 traffic analysis tool suite for network security monitoring 🕵🏻‍♀️.

Malcolm operates as a cluster of containers 📦, isolated sandboxes which each serve a dedicated function of the system. This makes Malcolm deployable with frameworks like Docker 🐋, Podman 🦭, and Kubernetes ⎈. Check out the Quick Start guide for examples on how to get up and running.

Alternatively, dedicated official ISO installer images 💿 for Malcolm and Hedgehog Linux 🦔 can be downloaded from Malcolm's releases page on GitHub. Due to limits on individual files in GitHub releases, these ISO files have been split 🪓 into 2GB chunks and can be reassembled with scripts provided for both Bash 🐧 (release_cleaver.sh) and PowerShell 🪟 (release_cleaver.ps1). See Downloading Malcolm - Installer ISOs for instructions.

As always, join us on the Malcolm discussions board 💬 to engage with the community, or pop some corn 🍿 and watch a video 📼.

Loading

Malcolm v25.03.1

28 Mar 14:51
@mmguero mmguero
v25.03.1
e2eaabc
This commit was signed with the committer’s verified signature.
mmguero Seth Grover
GPG key ID: 986055F72F110479
Verified
Learn about vigilant mode.

Choose a tag to compare

View all tags
Malcolm v25.03.1

This has been a busy month for Malcolm! We pushed hard to get v25.03.0 out earlier this month, as it contained pretty much just the Keycloak integration one of our partners (and major funding sources) was waiting for. Rather than wait until April for the other stuff that would have gone into the regular end-of-the-month release, I decided to pull those items into this smaller release just a week and a half after the last one.

Malcolm v25.03.1 contains a few enhancements, bug fixes, and several component version updates, including one that addresses a CVE that may affect Hedgehog Linux Kiosk mode and Malcolm's API container.

v25.03.0...v25.03.1

NOTE: If you have not already upgraded to v25.03.0, read the notes for v25.02.0 and v25.03.0 and follow the Read Before Upgrading instructions on those releases.

  • ✨ Features and enhancements
    • Incorporate new S7comm device identification log, s7comm_known_devices.log (cisagov#622)
    • Display current PCAP, Zeek, and Suricata capture results in Hedgehog Linux Kiosk mode (cisagov#566)
    • Keycloak authentication: configurable group or role membership restrictions for login (cisagov#633) (see Requiring user groups and realm roles)
    • Mark newly-discovered and uninventoried devices in logs during NetBox enrichment (cisagov#573)
    • Added "Apply recommended system tweaks automatically without asking for confirmation?" question to install.py to allow the user to accept changes to sysctl.conf, grub kernel parameters, etc., without having to answer "yes" to each one.
  • ✅ Component version updates
  • 🐛 Bug fixes
    • Fix install.py error when answering yes to "Pull Malcolm images?" with podman (cisagov#604)
    • Order of user-provided tags from PCAP upload interface not preserved (cisagov#624)
  • 📄 Configuration changes (in environment variables in ./config/) for Malcolm and in control_vars.conf for Hedgehog Linux
  • 🧹 Code and project maintenance
    • Ensure Malcolm's NetBox configuration Python scripts are baked into the image in addition to bind-mounting them in docker-compose.yml at runtime.

Malcolm is a powerful, easily deployable network 🖧 traffic analysis tool suite for network security monitoring 🕵🏻‍♀️.

Malcolm operates as a cluster of containers 📦, isolated sandboxes which each serve a dedicated function of the system. This makes Malcolm deployable with frameworks like Docker 🐋, Podman 🦭, and Kubernetes ⎈. Check out the Quick Start guide for examples on how to get up and running.

Alternatively, dedicated official ISO installer images 💿 for Malcolm and Hedgehog Linux 🦔 can be downloaded from Malcolm's releases page on GitHub. Due to limits on individual files in GitHub releases, these ISO files have been split 🪓 into 2GB chunks and can be reassembled with scripts provided for both Bash 🐧 (release_cleaver.sh) and PowerShell 🪟 (release_cleaver.ps1). See Downloading Malcolm - Installer ISOs for instructions.

As always, join us on the Malcolm discussions board 💬 to engage with the community, or pop some corn 🍿 and watch a video 📼.

Loading