Malcolm v24.03.0

[mmguero]

Malcolm v24.03.0 contains new features, improvements, bug fixes and component version updates.

v24.02.0...v24.03.0

• Features and enhancements
  • support json-delimited import for Zeek logs (support json-delimited import for Zeek logs idaholab/Malcolm#65)
  • go through list of Trivy security findings (go through list of Trivy security findings idaholab/Malcolm#236)
  • support /attributes and /events enpoints from MISP feed for Zeek intel generation (support /attributes and /events enpoints from MISP feed for Zeek intel generation idaholab/Malcolm#336)
  • KEV detections for Unitronics VisiLogic CVE-2023-6448 (KEV detections for Unitronics VisiLogic CVE-2023-6448 idaholab/Malcolm#394)
  • create dashboards for other non-network log data (create dashboards for other non-network log data idaholab/Malcolm#414)
  • links on landing page should open in a new tab (links on landing page should open in a new tab idaholab/Malcolm#427)
  • incorporate ICSNPP Profinet IO CM parser (incorporate icsnpp-profinet-io-cm idaholab/Malcolm#429)
• Component version updates
  • Arkime to v5.0.1
  • OpenSearch and OpenSearch Dashboards to v2.12.0
• Bug fixes
  • fix the way we do environment variables in local.zeek (fix the way we do environment variables in local.zeek idaholab/Malcolm#413)
  • a few issues with the install.py script when installing from GitHub releases (a few issues with the install.py script when installing from GitHub releases idaholab/Malcolm#416)
  • htadmin creating entries without a newline between them in the htpasswd file (htadmin creating entries without a newline between them in the htpasswd file idaholab/Malcolm#426)
  • hard-coded date value in Kibana pivot links (hard-coded date value in Kibana pivot links idaholab/Malcolm#428)
  • unencrypted, unzipped extracted file download not working (unencrypted, unzipped extracted file download not working idaholab/Malcolm#431)
• Configuration changes (in environment variables in ./config/)
  • these variables in zeek.env

  # Set to true to indicate that Zeek should output logs in JSON format
  ZEEK_JSON=
  # Whether or not to require SSL certificate verification when querying a TAXII or MISP feed
  ZEEK_INTEL_FEED_SSL_CERTIFICATE_VERIFICATION=false
  # Whether or not to disable the ICSNPP Profinet IO CM parser
  ZEEK_DISABLE_ICS_PROFINET_IO_CM=