Malcolm v23.05.0

[mmguero]

Malcolm v23.05.0 is a major release with new features, enhancements, component version updates and bug fixes.

IMPORTANT NOTE: Malcolm v23.05.0 has completely changed the way it manages its settings: rather than using environment variables found at the top of the docker-compose.yml file, it uses environment variables in .env files inside of the config directory. The locations of a number of configuration files have also changed. It's not recommended to update to Malcolm v23.05.0 from a previous version of Malcolm. Instead, shut down Malcolm, rename your old Malcolm installation directory to something else, and reconfigure Malcolm using ./scripts/configure and ./scripts/auth_setup.

v23.04.0...v23.05.0

• New features

  • integrate ICSNPP-Synchrophasor parser (integrate synchrophasor parser #190)
  • End-to-end Malcolm and Hedgehog Linux ISO Installation document (end-to-end ISO install documentation for Malcolm and Hedgehog #181)
  • support Malcolm deployment with Kubernetes (support Malcolm deployment with Kubernetes  #149)
    • see Deploying Malcolm with Kubernetes
    • This could be considered a "beta" release for Malcolm deployment with Kubernetes, as there is still some work to be done in this area. Please let us know what issues or suggestions you have via the issue tracker or via email to malcolm@inl.gov.
    • contributing issues:
      • inotify issue (kubernetes deployment - inotify issue #168)
      • htadmin/nginx and htpasswd (kubernetes deployment - htadmin/nginx and htpasswd #169)
      • opensearch (kubernetes deployment - opensearch #170)
      • uploading large PCAP files (kubernetes deployment - uploading large PCAP files #171)
      • script consolidation (kubernetes deployment - script consolidation #172)
      • documentation (kubernetes deployment - documentation #173)
      • user-defined persistent volumes (kubernetes deployment - user-defined persistent volumes #174)
      • opensearch keystore (kubernetes deployment - opensearch keystore #176)
      • expose other TCP services (kubernetes deployment - expose other TCP services #183)
      • provide with filebeat access to nginx access and error logs (kubernetes deployment - provide with filebeat access to nginx access and error logs #186)
      • use Secrets for some environment variables instead of ConfigMaps (kubernetes - use Secrets for some environment variables instead of ConfigMaps #189)

• Enhancements and fixes

  • remove name-map-ui container (remove name-map-ui container #165) in favor of using NetBox for asset identification
  • Python script refactoring, consolidation and cleanup
  • standardization of Docker container entrypoints
  • create ./scripts/configure alias for ./scripts/install.py --configure

• Component version updates

  • Arkime to v4.3.0
  • Capa to v5.1.0
  • Fluent Bit to v2.1.2
  • NetBox to v3.5.0
  • NGINX to v1.22.1
  • Supercronic to v0.2.24
  • Suricata to v6.0.10
  • Yara to v4.3.0
  • Zeek to v5.2.1