v6.3.0 development merge

[mmguero]

• New Features

  • Support remote OpenSearch instance/cluster as alternative to local containerized instance (SFTP upload broken due to dollar sign(s) in openssl-encrypted password idaholab/Malcolm#110)
  • Documentation and convenience scripts for configuring ingestion of third-party logs, and basic parsing/normalizing of Fluent-Bit's Windows event logs
  • S7comm Plus support and replaced Amazon S7comm parser with icsnpp-s7comm (add icsnpp-s7comm parser support idaholab/Malcolm#99)

• Version Bumps

  • OpenSearch and OpenSearch Dashboards to v2.2.1
  • Zeek to v5.0.1
  • Spicy to v1.5.1
  • spicy-plugin to v1.3.17
  • YARA to v4.2.3
  • Capa to v4.0.1

• Improvements

  • Major improvements to OPC UA Binary parser and supporting dashboards
  • Ensure that all containers are provided the same information about trusted CA certificates
  • changed list of "sensitive countries" to match U.S. Department of Energy Sensitive Country List
  • Increased maximum fields from 3,000 to 5,000
  • Standardized configuration and authentication for primary and secondary remote OpenSearch instances, and make sure that index templates are created on secondary remote OpenSearch instances
  • Expand and fix normalization of network.direction in lieu of using tags
  • Various tweaks and improvements to the install.py script for enabling/disabling some features

• Bugs Fixed

  • fields could be missing in Arkime due to a large number of concurrent requests (fields could be missing in Arkime due to a large number of concurrent requests idaholab/Malcolm#115)
  • mapper_parsing_exception, TCP flag parsing problem (mapper_parsing_exception, TCP flag parsing problem #214)

[lgtm-com]

This pull request introduces 2 alerts and fixes 1 when merging aa7d6af into 28ee931 - view on LGTM.com

new alerts:

• 1 for Except block handles 'BaseException'
• 1 for Unused import

fixed alerts:

• 1 for Except block handles 'BaseException'