Malcolm v23.03.0 is a release with enhancements, component version updates and bug fixes.

Malcolm is a powerful, easily deployable (via Docker) network traffic analysis tool suite for full packet capture artifacts (PCAP files), Zeek logs and Suricata alerts.

• Enhancements

  • Replace Zeek's misc/scan.zeek with ncsa/bro-simple-scan
  • terminate start and restart scripts once Malcolm has started properly (cisagov/Malcolm#240 and cisagov/Malcolm#241, thanks @Njinx)
  • minor usability improvements for ISO-installed Malcolm and Hedgehog (idaholab/Malcolm#155)
    • Added a "Configure Malcolm" menu item (under the "Internet" GTK menu with the other Malcolm stuff) and launcher on the top panel of icons in Malcolm. This runs ./scripts/install.py --configure in full screen. May look at starting this automatically on first boot in the future. (Malcolm)
    • Added Malcolm shortcut to gtk-3.0/bookmarks so it shows up in Thunar sidebar (Malcolm)
    • Added /opt/sensor/sensor_ctl shortcut to gtk-3.0/bookmarks so it shows up in Thunar sidebar (Hedgehog)
    • Have tilix from launcher panel start in /opt/sensor/sensor_ctl (Hedgehog)
  • minor tweaks to defaults for install.py --configure (enable offline-capable file scanners by default)
  • interrupt #NetBox startup import script when netbox-restore is run
  • added NetBox restore logic to reset_and_auto_populate.sh script (used mostly for demos and presentations)

• Component version updates

  • #Arkime to v4.2.0
  • OpenSearch and OpenSearch Dashboards to 2.6.0
  • Logstash from v8.4.0 to v8.6.1
  • Beats to v8.6.2
  • Zeek to v5.0.7
  • OpenSearch-Py to v2.2.0 (and remove opensearch-dsl which is now part of opensearch-py)
  • Supercronic to v0.2.2
  • Capa to v5.0.0
  • Fluent Bit to v2.0.9
  • Version updates to various Python package dependencies

• Fixes

  • last few seconds' Zeek logs prior to log rotation may be lost (idaholab/Malcolm#151)
  • in ISO-packaged Malcolm installation scripts directory, symlink netbox-backup and netbox-restore to control.py
  • improve opensearchpy connect/health check logig in pcap_watcher.py in pcap-monitor container

#Malcolm #OpenSearch #Zeek #Arkime #Suricata #PCAP #NetworkTrafficAnalysis #CyberSecurity #Cyber #Infosec #GitHub #INL #DHS #CISA #CISAgov

#Malcolm v6.4.3 is a minor #release containing enhancements, component version updates and bug fixes.

• Enhancements

  • Import the NetBox Device Type Library on NetBox first run to populate manufacturers, device types, models and modules
  • idaholab/Malcolm#127 have install.py --configure ask about other storage locations for PCAP, Zeek logs and OpenSearch indices
  • idaholab/Malcolm#128 have install.py --configure prompt for Arkime to manage uploaded PCAP files or not

• Component version updates

  • #Alpine Linux to v3.17 for some Docker containers' base images
  • #Filebeat to v8.5.2
  • #NetBox to v3.3.9
  • #Zeek to v5.0.4
  • #opensearch-py to v2.0.1
  • #FluentBit to v2.0.6

• Fixes

  • Fix some bad links in the documentation and other minor documentation improvements
  • Fix idaholab/Malcolm#126, suricata logs show up in Arkime as "notip" for the protocol
  • Fix idaholab/Malcolm#129, filtering by rootId in Arkime returns no results
  • Fix Docker health checks for NetBox and supporting containers
  • Fix "read-only" version of nginx.conf
  • Tweaks to install.py memory recommendations

#Malcolm and #HedgehogLinux may be obtained by pulling or building the #Docker images and/or building the ISO installer images as described in the documentation. Unofficial ISO installer images for Malcolm and Hedgehog Linux are not hosted on #GitHub, but may be downloaded from https://malcolm.fyi/.

#cybersecurity #pcap #networktrafficanalysis #zeek #arkime #ICS #INL #CISAgov

Practical #tshark filters for network traffic analysis:
https://gist.github.com/verovaleros/ccaefe5c686a1b0b7f2cade529b0eed5

#PacketCapture #PacketAnalysis #networking #networktrafficanalysis #tsharkfilters #trafficanalysis

If you ever used our @stratosphere malware datasets, we have good news! Under my direction, we will be actively working on improving all our datasets to make them better and more accessible to the community.

These datasets are unique in many ways and we look to make them even better.

If you have suggestions, ideas, would-be-nice comments, use cases, or any comments in general we would love to hear about it!

These datasets were initially created to aid machine learning researchers in developing new and better models to identify malicious behaviors in the network. When we started, there were few datasets out there with real malware network traffic that lasted longer than just a few minutes.

https://mcfp.felk.cvut.cz/publicDatasets/

#networksecurity #malwaretraffic #machinelearning #datascience #cybersecurity #maliciousbehaviors #datasets #networktrafficanalysis #ml #anomalydetection

I'm pleased to announce the v6.4.2 release of Malcolm. This release updates #Zeek to v5.0.3 and #OpenSearch and #OpenSearchDashboards to v2.4.0 as well as some other minor fixes and improvements. It also includes a Zeek plugin to detect vulnerability to and exploitation attempts of #CVE20223602.

See the documentation for instructions for installing Malcolm and pulling the new #Docker images, or grab the _(unofficial) ISOs.

#Malcolm #HedgehogLinux #cybersecurity #pcap #networktrafficanalysis #zeek #arkime #ICS #INL #CISAgov

Woohoo! The lab (#INL) put out a PR piece on my #OpenSource #NetworkTrafficAnalysis project, #Malcolm: https://inl.gov/article/new-framework-harnesses-multiple-cybersecurity-tools-to-protect-critical-infrastructure

You can check it out on GitHub or at https://malcolm.fyi . I'd love to get feedback from people on infosec.exchange.

The twelve-monitor monster behind me is named the dodecascreendron by those in the know.

#cybersecurity #pcap #zeek #arkime #ICS #OpenSearch

Making the Case for Supply Chain Behavior Transparency - The Biden Administration’s Cyber Executive Order includes a Software Bill of Mate... http://feedproxy.google.com/~r/securityweekly/XBIC/~3/h4jGRbifZy0/ #networktrafficanalysis #applicationsecurity #intrusiondetection #securityoperations #threatintelligence #incidentresponse #cloudsecurity #3rdpartyrisk #articles #devops

How Cloud Defenders Thwart Attacks Against Resilient Services - The introduction of containers and micro-service architectures have changed the w... http://feedproxy.google.com/~r/securityweekly/XBIC/~3/5xeuBcZN4ic/ #networktrafficanalysis #applicationsecurity #securityoperations #attacksurfacemgmt #containersecurity #incidentresponse #cloudsecurity #articles #blueteam #devops

How Behavioral Detections Actually Discovered the SolarWinds Orion SUNBURST Attack - The post How Behavioral Detections Actually Discovered the SolarWinds Orion SUNBURST Attack appeared... http://feedproxy.google.com/~r/securityweekly/XBIC/~3/WZD-F7MIEPw/ #networktrafficanalysis #intrusiondetection #securityoperations #threatintelligence #incidentresponse #assetmanagement #articles #blueteam

How Can We Vaccinate Our Networks? - The post How Can We Vaccinate Our Networks? appeared first on Security Weekly. http://feedproxy.google.com/~r/securityweekly/XBIC/~3/EZLahC1V9Ks/ #configurationmanagement #vulnerabilitymanagement #networktrafficanalysis #threatintelligence #attacksurfacemgmt #attacksimulation #assetmanagement #cloudsecurity #remoteaccess #compliance #articles #blueteam #firewall

What Security Data Do I Really Need to Collect and Analyze? - The post What Security Data Do I Really Need to Collect and Analyze? appeared first on Security Week... http://feedproxy.google.com/~r/securityweekly/XBIC/~3/Q6QUGMdlZLQ/ #managedsecurityservices #vulnerabilitymanagement #networktrafficanalysis #applicationsecurity #intrusiondetection #securityoperations #threatintelligence #endpointsecurity #activedirectory #patchmanagement #cloudsecurity #articles #blueteam #firewall #siem

Packet Collection and Analysis at Scale - The post Packet Collection and Analysis at Scale appeared first on Security Weekly. more: http://feedproxy.google.com/~r/securityweekly/XBIC/~3/cvV6p_xKZlo/ #networktrafficanalysis #intrusiondetection #securityoperations #incidentresponse #insiderthreat #threathunting #articles #siem

Reducing Remediation Costs from a Breach - The post Reducing Remediation Costs from a Breach appeared first on Security Weekly. more: http://feedproxy.google.com/~r/securityweekly/XBIC/~3/f8-QgTYdyz0/ #networktrafficanalysis #securityoperations #incidentresponse #threathunting #forensics #articles

Cloud Native Network Detection and Response - The post Cloud Native Network Detection and Response appeared first on Security Weekly. more: http://feedproxy.google.com/~r/securityweekly/XBIC/~3/k5IQ2rS4ddU/ #networktrafficanalysis #securityoperations #cloudsecurity #forensics #articles