#opensearch — Public Fediverse posts
Live and recent posts from across the Fediverse tagged #opensearch, aggregated by home.social.
-
Hello #OpenSearch community. Janelle Arita and the #UX team have an open request for comments on new ideas for Dashboards.
Come give your input and help take improvement ideas forward with the OpenSearch Project.
#OpenSearchAmbassador #opensource @OpenSearchProjecthttps://github.com/opensearch-project/OpenSearch-Dashboards/issues/11830
-
Hello #OpenSearch community. Janelle Arita and the #UX team have an open request for comments on new ideas for Dashboards.
Come give your input and help take improvement ideas forward with the OpenSearch Project.
#OpenSearchAmbassador #opensource @OpenSearchProjecthttps://github.com/opensearch-project/OpenSearch-Dashboards/issues/11830
-
Hello #OpenSearch community. Janelle Arita and the #UX team have an open request for comments on new ideas for Dashboards.
Come give your input and help take improvement ideas forward with the OpenSearch Project.
#OpenSearchAmbassador #opensource @OpenSearchProjecthttps://github.com/opensearch-project/OpenSearch-Dashboards/issues/11830
-
Hello #OpenSearch community. Janelle Arita and the #UX team have an open request for comments on new ideas for Dashboards.
Come give your input and help take improvement ideas forward with the OpenSearch Project.
#OpenSearchAmbassador #opensource @OpenSearchProjecthttps://github.com/opensearch-project/OpenSearch-Dashboards/issues/11830
-
Hello #OpenSearch community. Janelle Arita and the #UX team have an open request for comments on new ideas for Dashboards.
Come give your input and help take improvement ideas forward with the OpenSearch Project.
#OpenSearchAmbassador #opensource @OpenSearchProjecthttps://github.com/opensearch-project/OpenSearch-Dashboards/issues/11830
-
The maintainers of the Go client for #OpenSearch are looking for more folks to join in.
If you're a #GoLang dev, and you want to contribute to #opensource, the opensearch-go library @OpenSearchProject (a @linuxfoundation top-level project) is a great opportunity.
https://www.linkedin.com/posts/horovits_opensearch-golang-opensource-share-7459465913906544640-uXPR -
I've never been to Slovenia, so extra excited towards #JCON Slovenia 🇸🇮
I'll speak about the OpenSearch Project, and how it can help you in your search, observability and vector database needs.
See you 27-29 May in Portorož @jcon Slovenia!
And if you have any recommendations for a first-time visitor, comment or DM me 🙂
#OpenSearchAmbassador #OpenSearch #JConSlovenia
https://makeit.si/schedule/ -
I've never been to Slovenia, so extra excited towards #JCON Slovenia 🇸🇮
I'll speak about the OpenSearch Project, and how it can help you in your search, observability and vector database needs.
See you 27-29 May in Portorož @jcon Slovenia!
And if you have any recommendations for a first-time visitor, comment or DM me 🙂
#OpenSearchAmbassador #OpenSearch #JConSlovenia
https://makeit.si/schedule/ -
I've never been to Slovenia, so extra excited towards #JCON Slovenia 🇸🇮
I'll speak about the OpenSearch Project, and how it can help you in your search, observability and vector database needs.
See you 27-29 May in Portorož @jcon Slovenia!
And if you have any recommendations for a first-time visitor, comment or DM me 🙂
#OpenSearchAmbassador #OpenSearch #JConSlovenia
https://makeit.si/schedule/ -
I've never been to Slovenia, so extra excited towards #JCON Slovenia 🇸🇮
I'll speak about the OpenSearch Project, and how it can help you in your search, observability and vector database needs.
See you 27-29 May in Portorož @jcon Slovenia!
And if you have any recommendations for a first-time visitor, comment or DM me 🙂
#OpenSearchAmbassador #OpenSearch #JConSlovenia
https://makeit.si/schedule/ -
I've never been to Slovenia, so extra excited towards #JCON Slovenia 🇸🇮
I'll speak about the OpenSearch Project, and how it can help you in your search, observability and vector database needs.
See you 27-29 May in Portorož @jcon Slovenia!
And if you have any recommendations for a first-time visitor, comment or DM me 🙂
#OpenSearchAmbassador #OpenSearch #JConSlovenia
https://makeit.si/schedule/ -
📢 #OpenSearch #Hadoop connector 2.0 is out!
Your helper to parallelize reads/writes across @apache.org Spark partitions and @opensearch.org shards just got a boost:
✅ Spark 3.5 and 4 support
✅ OpenSearch 3.x compatibility
✅ Amazon OpenSearch Serverless support
and more
https://opensearch.org/blog/introducing-the-opensearch-hadoop-connector-2-0-spark-4-support-opensearch-serverless-and-more/ -
Excited to have 2 talks accepted to 'Community Over Code' this year!
"Beyond Pull Requests How Non-Coders Quietly Power #OpenSource" with fellow #OpenSearchAmbassador Sakshi Nasha where we'll discuss the importance of non-code contributions
&
"Planning an event? Learn how chaos can drive engagement" where I will pass along my knowledge from years of running a unique 'Unconference' at our OpenSearchCon conferences.
-
CW: release notes for Malcolm v26.05.0, a network traffic analysis tool suite for network security monitoring
Malcolm v26.05.0 delivers a mix of feature improvements, performance improvements, bug fixes, dependency updates, and deployment refinements across Malcolm and Hedgehog for both Docker- and Kubernetes-based workflows.
If you are upgrading from an existing Malcolm installation, run
./scripts/statusfor Malcolm to migrate some settings prior to running./scripts/configure,./scripts/start, or other Malcolm control scripts.https://github.com/idaholab/Malcolm/compare/v26.04.1...v26.05.0
- ✨ Features and enhancements
- #726 — use hierarchical structure for NetBox device roles
- Expanded/reworked NetBox preloaded device roles into a hierarchical taxonomy (thanks Crubumble)
- #867 — examine large chown'ed directories in container images and see if they can be reduced
- #954 — allow users to provide custom netbox scripts to be automatically registered on startup (thanks PrudhviChanda)
- Added NetBox custom script support in the container/runtime and docs, including bind-mounting
./netbox/custom-scriptsand automatic script registration at startup - Renamed NetBox startup/control scripts from
netbox/scriptstonetbox/control-scripts
- Added NetBox custom script support in the container/runtime and docs, including bind-mounting
- Added
file.stringsextraction/indexing/search support across Strelka → Logstash → OpenSearch templates (wildcard field mapping type) → Arkime/WISE - Added configurable Zeek file analyzer timeout via
ZEEK_FILE_ANALYZER_TIMEOUT_SEC netdevusers in ISO-installed environment can runnmcliandnmtuito configure network interfaces.- the
malcolm_appliance_packager.shscript that creates a tarball of Malcolm images can now package for both Malcolm and Hedgehog profiles.
- #726 — use hierarchical structure for NetBox device roles
- ✅ Component version updates
- 🐛 Bug fixes
- #757 — multiple OpenSearch nodes (using Malcolm-Helm) fail to communicate with each other due to self-signed certs (thanks scott-jeffery)
- OpenSearch post-start setup now supports configurable default replica counts instead of always forcing single-node replicas to
0 - OpenSearch self-signed internal cert generation can now be skipped when external/preexisting certs are being used
- OpenSearch post-start setup now supports configurable default replica counts instead of always forcing single-node replicas to
- #827 — Fix raspberry pi build which is broken since v25.12.0 Hedgehog/Malcolm platform unification
- Updated Hedgehog Raspberry Pi docs and first-boot behavior/documentation
- Hedgehog Raspberry Pi image now forces password change for
sensoron first login and disables direct root password login by default - Refactored Raspberry Pi GitHub Actions build into reusable workflow
.github/workflows/raspi-build-push.yml
- #878 — Arkime capture Fails to Start on Hedgehog When WISE Web Config Is Enabled
- Arkime RBAC role-mapping injection is now only applied when role-based access control is enabled
- Arkime WISE configuration initialization now handles missing/empty persistent config files more robustly
- Arkime live capture now normalizes WISE URLs better, follows redirects when probing, and avoids some bad URL construction edge cases
- #957 — configuration script can disable ICS parsers unintentionally
- #959 — Arkime sessions view attempts to load PCAP for Zeek and Suricata logs (which don't have PCAP) (see also arkime/arkime#3934)
- Fixed one-off cleanup of interrupted Zeek intel files during
stop --wipe
- #757 — multiple OpenSearch nodes (using Malcolm-Helm) fail to communicate with each other due to self-signed certs (thanks scott-jeffery)
- 🧹 Code and project maintenance
- Documentation improvements
- #913 — replace ingress-nginx which is EOL
- Switched Kubernetes ingress example/docs from ingress-nginx to Traefik and replaced the old Vagrant example with a new RKE2/Traefik-based environment
- Fixed malformed indentation in
kubernetes/01-volumes-nfs.yml.examplefor thefilescanvolume section - Removed deprecated Kubernetes example files for ingress-nginx and the old separate NFS-server Vagrant setup
opensearchis no longer part of thehedgehogDocker Compose profile, and somedepends_onrelationships were adjusted accordingly
- #942 - Fixed mutable default argument usage in Zeek threat feed helper functions (thanks @stef41)
- #917 — develop IronBank (US DoD) images for Malcolm
- 📄 Configuration changes for Malcolm (in environment variables in
./config/). The Malcolm control script (e.g.,./scripts/status,./scripts/start) automatically handles creation and migration of variables according to./config/env-var-actions.yml.- Added
ZEEK_FILE_ANALYZER_TIMEOUT_SEC(default5) tozeek.env. This is the default amount of time a file can be inactive before the file analysis gives up and discards any internal state related to the file. ZEEK_CLUSTER_BACKENDcan be specified inzeek.envto specify the Zeek cluster backend (ZeroMQvsBroker).
- Added
- ❌ Errata
- Under NetBox → Plugins → NetBox HealthCheck Plugin → HealthCheck the error "unavailable: Unable to connect to Redis: Connection Error" is displayed. This is a side effect of #882 and does not actually indicate a problem with NetBox or its connection to Valkey. This will be fixed in the next release.
Malcolm is a powerful, easily deployable network 🖧 traffic analysis tool suite for network security monitoring 🕵🏻♀️.
Malcolm operates as a cluster of containers 📦, isolated sandboxes which each serve a dedicated function of the system. This makes Malcolm deployable with frameworks like Docker 🐋, Podman 🦭, and Kubernetes ⎈. Check out the Quick Start guide for examples on how to get up and running.
Alternatively, dedicated official ISO installer images 💿 for Malcolm and Hedgehog Linux 🦔 can be downloaded from Malcolm's releases page on GitHub. Due to limits on individual files in GitHub releases, these ISO files have been split 🪓 into 2GB chunks and can be reassembled with scripts provided for both Bash 🐧 (
release_cleaver.sh) and PowerShell 🪟 (release_cleaver.ps1). See Downloading Malcolm - Installer ISOs for instructions.As always, join us on the Malcolm discussions board 💬 to engage with the community, or pop some corn 🍿 and watch a video 📼.
#Malcolm #HedgehogLinux #Zeek #Arkime #Strelka #NetBox #OpenSearch #Elasticsearch #Suricata #PCAP #NetworkTrafficAnalysis #networksecuritymonitoring #OT #ICS #icssecurity #CyberSecurity #Cyber #Infosec #INL
- ✨ Features and enhancements
-
CW: release notes for Malcolm v26.05.0, a network traffic analysis tool suite for network security monitoring
Malcolm v26.05.0 delivers a mix of feature improvements, performance improvements, bug fixes, dependency updates, and deployment refinements across Malcolm and Hedgehog for both Docker- and Kubernetes-based workflows.
If you are upgrading from an existing Malcolm installation, run
./scripts/statusfor Malcolm to migrate some settings prior to running./scripts/configure,./scripts/start, or other Malcolm control scripts.https://github.com/idaholab/Malcolm/compare/v26.04.1...v26.05.0
- ✨ Features and enhancements
- #726 — use hierarchical structure for NetBox device roles
- Expanded/reworked NetBox preloaded device roles into a hierarchical taxonomy (thanks Crubumble)
- #867 — examine large chown'ed directories in container images and see if they can be reduced
- #954 — allow users to provide custom netbox scripts to be automatically registered on startup (thanks PrudhviChanda)
- Added NetBox custom script support in the container/runtime and docs, including bind-mounting
./netbox/custom-scriptsand automatic script registration at startup - Renamed NetBox startup/control scripts from
netbox/scriptstonetbox/control-scripts
- Added NetBox custom script support in the container/runtime and docs, including bind-mounting
- Added
file.stringsextraction/indexing/search support across Strelka → Logstash → OpenSearch templates (wildcard field mapping type) → Arkime/WISE - Added configurable Zeek file analyzer timeout via
ZEEK_FILE_ANALYZER_TIMEOUT_SEC netdevusers in ISO-installed environment can runnmcliandnmtuito configure network interfaces.- the
malcolm_appliance_packager.shscript that creates a tarball of Malcolm images can now package for both Malcolm and Hedgehog profiles.
- #726 — use hierarchical structure for NetBox device roles
- ✅ Component version updates
- 🐛 Bug fixes
- #757 — multiple OpenSearch nodes (using Malcolm-Helm) fail to communicate with each other due to self-signed certs (thanks scott-jeffery)
- OpenSearch post-start setup now supports configurable default replica counts instead of always forcing single-node replicas to
0 - OpenSearch self-signed internal cert generation can now be skipped when external/preexisting certs are being used
- OpenSearch post-start setup now supports configurable default replica counts instead of always forcing single-node replicas to
- #827 — Fix raspberry pi build which is broken since v25.12.0 Hedgehog/Malcolm platform unification
- Updated Hedgehog Raspberry Pi docs and first-boot behavior/documentation
- Hedgehog Raspberry Pi image now forces password change for
sensoron first login and disables direct root password login by default - Refactored Raspberry Pi GitHub Actions build into reusable workflow
.github/workflows/raspi-build-push.yml
- #878 — Arkime capture Fails to Start on Hedgehog When WISE Web Config Is Enabled
- Arkime RBAC role-mapping injection is now only applied when role-based access control is enabled
- Arkime WISE configuration initialization now handles missing/empty persistent config files more robustly
- Arkime live capture now normalizes WISE URLs better, follows redirects when probing, and avoids some bad URL construction edge cases
- #957 — configuration script can disable ICS parsers unintentionally
- #959 — Arkime sessions view attempts to load PCAP for Zeek and Suricata logs (which don't have PCAP) (see also arkime/arkime#3934)
- Fixed one-off cleanup of interrupted Zeek intel files during
stop --wipe
- #757 — multiple OpenSearch nodes (using Malcolm-Helm) fail to communicate with each other due to self-signed certs (thanks scott-jeffery)
- 🧹 Code and project maintenance
- Documentation improvements
- #913 — replace ingress-nginx which is EOL
- Switched Kubernetes ingress example/docs from ingress-nginx to Traefik and replaced the old Vagrant example with a new RKE2/Traefik-based environment
- Fixed malformed indentation in
kubernetes/01-volumes-nfs.yml.examplefor thefilescanvolume section - Removed deprecated Kubernetes example files for ingress-nginx and the old separate NFS-server Vagrant setup
opensearchis no longer part of thehedgehogDocker Compose profile, and somedepends_onrelationships were adjusted accordingly
- #942 - Fixed mutable default argument usage in Zeek threat feed helper functions (thanks @stef41)
- #917 — develop IronBank (US DoD) images for Malcolm
- 📄 Configuration changes for Malcolm (in environment variables in
./config/). The Malcolm control script (e.g.,./scripts/status,./scripts/start) automatically handles creation and migration of variables according to./config/env-var-actions.yml.- Added
ZEEK_FILE_ANALYZER_TIMEOUT_SEC(default5) tozeek.env. This is the default amount of time a file can be inactive before the file analysis gives up and discards any internal state related to the file. ZEEK_CLUSTER_BACKENDcan be specified inzeek.envto specify the Zeek cluster backend (ZeroMQvsBroker).
- Added
- ❌ Errata
- Under NetBox → Plugins → NetBox HealthCheck Plugin → HealthCheck the error "unavailable: Unable to connect to Redis: Connection Error" is displayed. This is a side effect of #882 and does not actually indicate a problem with NetBox or its connection to Valkey. This will be fixed in the next release.
Malcolm is a powerful, easily deployable network 🖧 traffic analysis tool suite for network security monitoring 🕵🏻♀️.
Malcolm operates as a cluster of containers 📦, isolated sandboxes which each serve a dedicated function of the system. This makes Malcolm deployable with frameworks like Docker 🐋, Podman 🦭, and Kubernetes ⎈. Check out the Quick Start guide for examples on how to get up and running.
Alternatively, dedicated official ISO installer images 💿 for Malcolm and Hedgehog Linux 🦔 can be downloaded from Malcolm's releases page on GitHub. Due to limits on individual files in GitHub releases, these ISO files have been split 🪓 into 2GB chunks and can be reassembled with scripts provided for both Bash 🐧 (
release_cleaver.sh) and PowerShell 🪟 (release_cleaver.ps1). See Downloading Malcolm - Installer ISOs for instructions.As always, join us on the Malcolm discussions board 💬 to engage with the community, or pop some corn 🍿 and watch a video 📼.
#Malcolm #HedgehogLinux #Zeek #Arkime #Strelka #NetBox #OpenSearch #Elasticsearch #Suricata #PCAP #NetworkTrafficAnalysis #networksecuritymonitoring #OT #ICS #icssecurity #CyberSecurity #Cyber #Infosec #INL
- ✨ Features and enhancements
-
CW: release notes for Malcolm v26.05.0, a network traffic analysis tool suite for network security monitoring
Malcolm v26.05.0 delivers a mix of feature improvements, performance improvements, bug fixes, dependency updates, and deployment refinements across Malcolm and Hedgehog for both Docker- and Kubernetes-based workflows.
If you are upgrading from an existing Malcolm installation, run
./scripts/statusfor Malcolm to migrate some settings prior to running./scripts/configure,./scripts/start, or other Malcolm control scripts.https://github.com/idaholab/Malcolm/compare/v26.04.1...v26.05.0
- ✨ Features and enhancements
- #726 — use hierarchical structure for NetBox device roles
- Expanded/reworked NetBox preloaded device roles into a hierarchical taxonomy (thanks Crubumble)
- #867 — examine large chown'ed directories in container images and see if they can be reduced
- #954 — allow users to provide custom netbox scripts to be automatically registered on startup (thanks PrudhviChanda)
- Added NetBox custom script support in the container/runtime and docs, including bind-mounting
./netbox/custom-scriptsand automatic script registration at startup - Renamed NetBox startup/control scripts from
netbox/scriptstonetbox/control-scripts
- Added NetBox custom script support in the container/runtime and docs, including bind-mounting
- Added
file.stringsextraction/indexing/search support across Strelka → Logstash → OpenSearch templates (wildcard field mapping type) → Arkime/WISE - Added configurable Zeek file analyzer timeout via
ZEEK_FILE_ANALYZER_TIMEOUT_SEC netdevusers in ISO-installed environment can runnmcliandnmtuito configure network interfaces.- the
malcolm_appliance_packager.shscript that creates a tarball of Malcolm images can now package for both Malcolm and Hedgehog profiles.
- #726 — use hierarchical structure for NetBox device roles
- ✅ Component version updates
- 🐛 Bug fixes
- #757 — multiple OpenSearch nodes (using Malcolm-Helm) fail to communicate with each other due to self-signed certs (thanks scott-jeffery)
- OpenSearch post-start setup now supports configurable default replica counts instead of always forcing single-node replicas to
0 - OpenSearch self-signed internal cert generation can now be skipped when external/preexisting certs are being used
- OpenSearch post-start setup now supports configurable default replica counts instead of always forcing single-node replicas to
- #827 — Fix raspberry pi build which is broken since v25.12.0 Hedgehog/Malcolm platform unification
- Updated Hedgehog Raspberry Pi docs and first-boot behavior/documentation
- Hedgehog Raspberry Pi image now forces password change for
sensoron first login and disables direct root password login by default - Refactored Raspberry Pi GitHub Actions build into reusable workflow
.github/workflows/raspi-build-push.yml
- #878 — Arkime capture Fails to Start on Hedgehog When WISE Web Config Is Enabled
- Arkime RBAC role-mapping injection is now only applied when role-based access control is enabled
- Arkime WISE configuration initialization now handles missing/empty persistent config files more robustly
- Arkime live capture now normalizes WISE URLs better, follows redirects when probing, and avoids some bad URL construction edge cases
- #957 — configuration script can disable ICS parsers unintentionally
- #959 — Arkime sessions view attempts to load PCAP for Zeek and Suricata logs (which don't have PCAP) (see also arkime/arkime#3934)
- Fixed one-off cleanup of interrupted Zeek intel files during
stop --wipe
- #757 — multiple OpenSearch nodes (using Malcolm-Helm) fail to communicate with each other due to self-signed certs (thanks scott-jeffery)
- 🧹 Code and project maintenance
- Documentation improvements
- #913 — replace ingress-nginx which is EOL
- Switched Kubernetes ingress example/docs from ingress-nginx to Traefik and replaced the old Vagrant example with a new RKE2/Traefik-based environment
- Fixed malformed indentation in
kubernetes/01-volumes-nfs.yml.examplefor thefilescanvolume section - Removed deprecated Kubernetes example files for ingress-nginx and the old separate NFS-server Vagrant setup
opensearchis no longer part of thehedgehogDocker Compose profile, and somedepends_onrelationships were adjusted accordingly
- #942 - Fixed mutable default argument usage in Zeek threat feed helper functions (thanks @stef41)
- #917 — develop IronBank (US DoD) images for Malcolm
- 📄 Configuration changes for Malcolm (in environment variables in
./config/). The Malcolm control script (e.g.,./scripts/status,./scripts/start) automatically handles creation and migration of variables according to./config/env-var-actions.yml.- Added
ZEEK_FILE_ANALYZER_TIMEOUT_SEC(default5) tozeek.env. This is the default amount of time a file can be inactive before the file analysis gives up and discards any internal state related to the file. ZEEK_CLUSTER_BACKENDcan be specified inzeek.envto specify the Zeek cluster backend (ZeroMQvsBroker).
- Added
- ❌ Errata
- Under NetBox → Plugins → NetBox HealthCheck Plugin → HealthCheck the error "unavailable: Unable to connect to Redis: Connection Error" is displayed. This is a side effect of #882 and does not actually indicate a problem with NetBox or its connection to Valkey. This will be fixed in the next release.
Malcolm is a powerful, easily deployable network 🖧 traffic analysis tool suite for network security monitoring 🕵🏻♀️.
Malcolm operates as a cluster of containers 📦, isolated sandboxes which each serve a dedicated function of the system. This makes Malcolm deployable with frameworks like Docker 🐋, Podman 🦭, and Kubernetes ⎈. Check out the Quick Start guide for examples on how to get up and running.
Alternatively, dedicated official ISO installer images 💿 for Malcolm and Hedgehog Linux 🦔 can be downloaded from Malcolm's releases page on GitHub. Due to limits on individual files in GitHub releases, these ISO files have been split 🪓 into 2GB chunks and can be reassembled with scripts provided for both Bash 🐧 (
release_cleaver.sh) and PowerShell 🪟 (release_cleaver.ps1). See Downloading Malcolm - Installer ISOs for instructions.As always, join us on the Malcolm discussions board 💬 to engage with the community, or pop some corn 🍿 and watch a video 📼.
#Malcolm #HedgehogLinux #Zeek #Arkime #Strelka #NetBox #OpenSearch #Elasticsearch #Suricata #PCAP #NetworkTrafficAnalysis #networksecuritymonitoring #OT #ICS #icssecurity #CyberSecurity #Cyber #Infosec #INL
- ✨ Features and enhancements
-
CW: release notes for Malcolm v26.05.0, a network traffic analysis tool suite for network security monitoring
Malcolm v26.05.0 delivers a mix of feature improvements, performance improvements, bug fixes, dependency updates, and deployment refinements across Malcolm and Hedgehog for both Docker- and Kubernetes-based workflows.
If you are upgrading from an existing Malcolm installation, run
./scripts/statusfor Malcolm to migrate some settings prior to running./scripts/configure,./scripts/start, or other Malcolm control scripts.https://github.com/idaholab/Malcolm/compare/v26.04.1...v26.05.0
- ✨ Features and enhancements
- #726 — use hierarchical structure for NetBox device roles
- Expanded/reworked NetBox preloaded device roles into a hierarchical taxonomy (thanks Crubumble)
- #867 — examine large chown'ed directories in container images and see if they can be reduced
- #954 — allow users to provide custom netbox scripts to be automatically registered on startup (thanks PrudhviChanda)
- Added NetBox custom script support in the container/runtime and docs, including bind-mounting
./netbox/custom-scriptsand automatic script registration at startup - Renamed NetBox startup/control scripts from
netbox/scriptstonetbox/control-scripts
- Added NetBox custom script support in the container/runtime and docs, including bind-mounting
- Added
file.stringsextraction/indexing/search support across Strelka → Logstash → OpenSearch templates (wildcard field mapping type) → Arkime/WISE - Added configurable Zeek file analyzer timeout via
ZEEK_FILE_ANALYZER_TIMEOUT_SEC netdevusers in ISO-installed environment can runnmcliandnmtuito configure network interfaces.- the
malcolm_appliance_packager.shscript that creates a tarball of Malcolm images can now package for both Malcolm and Hedgehog profiles.
- #726 — use hierarchical structure for NetBox device roles
- ✅ Component version updates
- 🐛 Bug fixes
- #757 — multiple OpenSearch nodes (using Malcolm-Helm) fail to communicate with each other due to self-signed certs (thanks scott-jeffery)
- OpenSearch post-start setup now supports configurable default replica counts instead of always forcing single-node replicas to
0 - OpenSearch self-signed internal cert generation can now be skipped when external/preexisting certs are being used
- OpenSearch post-start setup now supports configurable default replica counts instead of always forcing single-node replicas to
- #827 — Fix raspberry pi build which is broken since v25.12.0 Hedgehog/Malcolm platform unification
- Updated Hedgehog Raspberry Pi docs and first-boot behavior/documentation
- Hedgehog Raspberry Pi image now forces password change for
sensoron first login and disables direct root password login by default - Refactored Raspberry Pi GitHub Actions build into reusable workflow
.github/workflows/raspi-build-push.yml
- #878 — Arkime capture Fails to Start on Hedgehog When WISE Web Config Is Enabled
- Arkime RBAC role-mapping injection is now only applied when role-based access control is enabled
- Arkime WISE configuration initialization now handles missing/empty persistent config files more robustly
- Arkime live capture now normalizes WISE URLs better, follows redirects when probing, and avoids some bad URL construction edge cases
- #957 — configuration script can disable ICS parsers unintentionally
- #959 — Arkime sessions view attempts to load PCAP for Zeek and Suricata logs (which don't have PCAP) (see also arkime/arkime#3934)
- Fixed one-off cleanup of interrupted Zeek intel files during
stop --wipe
- #757 — multiple OpenSearch nodes (using Malcolm-Helm) fail to communicate with each other due to self-signed certs (thanks scott-jeffery)
- 🧹 Code and project maintenance
- Documentation improvements
- #913 — replace ingress-nginx which is EOL
- Switched Kubernetes ingress example/docs from ingress-nginx to Traefik and replaced the old Vagrant example with a new RKE2/Traefik-based environment
- Fixed malformed indentation in
kubernetes/01-volumes-nfs.yml.examplefor thefilescanvolume section - Removed deprecated Kubernetes example files for ingress-nginx and the old separate NFS-server Vagrant setup
opensearchis no longer part of thehedgehogDocker Compose profile, and somedepends_onrelationships were adjusted accordingly
- #942 - Fixed mutable default argument usage in Zeek threat feed helper functions (thanks @stef41)
- #917 — develop IronBank (US DoD) images for Malcolm
- 📄 Configuration changes for Malcolm (in environment variables in
./config/). The Malcolm control script (e.g.,./scripts/status,./scripts/start) automatically handles creation and migration of variables according to./config/env-var-actions.yml.- Added
ZEEK_FILE_ANALYZER_TIMEOUT_SEC(default5) tozeek.env. This is the default amount of time a file can be inactive before the file analysis gives up and discards any internal state related to the file. ZEEK_CLUSTER_BACKENDcan be specified inzeek.envto specify the Zeek cluster backend (ZeroMQvsBroker).
- Added
- ❌ Errata
- Under NetBox → Plugins → NetBox HealthCheck Plugin → HealthCheck the error "unavailable: Unable to connect to Redis: Connection Error" is displayed. This is a side effect of #882 and does not actually indicate a problem with NetBox or its connection to Valkey. This will be fixed in the next release.
Malcolm is a powerful, easily deployable network 🖧 traffic analysis tool suite for network security monitoring 🕵🏻♀️.
Malcolm operates as a cluster of containers 📦, isolated sandboxes which each serve a dedicated function of the system. This makes Malcolm deployable with frameworks like Docker 🐋, Podman 🦭, and Kubernetes ⎈. Check out the Quick Start guide for examples on how to get up and running.
Alternatively, dedicated official ISO installer images 💿 for Malcolm and Hedgehog Linux 🦔 can be downloaded from Malcolm's releases page on GitHub. Due to limits on individual files in GitHub releases, these ISO files have been split 🪓 into 2GB chunks and can be reassembled with scripts provided for both Bash 🐧 (
release_cleaver.sh) and PowerShell 🪟 (release_cleaver.ps1). See Downloading Malcolm - Installer ISOs for instructions.As always, join us on the Malcolm discussions board 💬 to engage with the community, or pop some corn 🍿 and watch a video 📼.
#Malcolm #HedgehogLinux #Zeek #Arkime #Strelka #NetBox #OpenSearch #Elasticsearch #Suricata #PCAP #NetworkTrafficAnalysis #networksecuritymonitoring #OT #ICS #icssecurity #CyberSecurity #Cyber #Infosec #INL
- ✨ Features and enhancements
-
CW: release notes for Malcolm v26.05.0, a network traffic analysis tool suite for network security monitoring
Malcolm v26.05.0 delivers a mix of feature improvements, performance improvements, bug fixes, dependency updates, and deployment refinements across Malcolm and Hedgehog for both Docker- and Kubernetes-based workflows.
If you are upgrading from an existing Malcolm installation, run
./scripts/statusfor Malcolm to migrate some settings prior to running./scripts/configure,./scripts/start, or other Malcolm control scripts.https://github.com/idaholab/Malcolm/compare/v26.04.1...v26.05.0
- ✨ Features and enhancements
- #726 — use hierarchical structure for NetBox device roles
- Expanded/reworked NetBox preloaded device roles into a hierarchical taxonomy (thanks Crubumble)
- #867 — examine large chown'ed directories in container images and see if they can be reduced
- #954 — allow users to provide custom netbox scripts to be automatically registered on startup (thanks PrudhviChanda)
- Added NetBox custom script support in the container/runtime and docs, including bind-mounting
./netbox/custom-scriptsand automatic script registration at startup - Renamed NetBox startup/control scripts from
netbox/scriptstonetbox/control-scripts
- Added NetBox custom script support in the container/runtime and docs, including bind-mounting
- Added
file.stringsextraction/indexing/search support across Strelka → Logstash → OpenSearch templates (wildcard field mapping type) → Arkime/WISE - Added configurable Zeek file analyzer timeout via
ZEEK_FILE_ANALYZER_TIMEOUT_SEC netdevusers in ISO-installed environment can runnmcliandnmtuito configure network interfaces.- the
malcolm_appliance_packager.shscript that creates a tarball of Malcolm images can now package for both Malcolm and Hedgehog profiles.
- #726 — use hierarchical structure for NetBox device roles
- ✅ Component version updates
- 🐛 Bug fixes
- #757 — multiple OpenSearch nodes (using Malcolm-Helm) fail to communicate with each other due to self-signed certs (thanks scott-jeffery)
- OpenSearch post-start setup now supports configurable default replica counts instead of always forcing single-node replicas to
0 - OpenSearch self-signed internal cert generation can now be skipped when external/preexisting certs are being used
- OpenSearch post-start setup now supports configurable default replica counts instead of always forcing single-node replicas to
- #827 — Fix raspberry pi build which is broken since v25.12.0 Hedgehog/Malcolm platform unification
- Updated Hedgehog Raspberry Pi docs and first-boot behavior/documentation
- Hedgehog Raspberry Pi image now forces password change for
sensoron first login and disables direct root password login by default - Refactored Raspberry Pi GitHub Actions build into reusable workflow
.github/workflows/raspi-build-push.yml
- #878 — Arkime capture Fails to Start on Hedgehog When WISE Web Config Is Enabled
- Arkime RBAC role-mapping injection is now only applied when role-based access control is enabled
- Arkime WISE configuration initialization now handles missing/empty persistent config files more robustly
- Arkime live capture now normalizes WISE URLs better, follows redirects when probing, and avoids some bad URL construction edge cases
- #957 — configuration script can disable ICS parsers unintentionally
- #959 — Arkime sessions view attempts to load PCAP for Zeek and Suricata logs (which don't have PCAP) (see also arkime/arkime#3934)
- Fixed one-off cleanup of interrupted Zeek intel files during
stop --wipe
- #757 — multiple OpenSearch nodes (using Malcolm-Helm) fail to communicate with each other due to self-signed certs (thanks scott-jeffery)
- 🧹 Code and project maintenance
- Documentation improvements
- #913 — replace ingress-nginx which is EOL
- Switched Kubernetes ingress example/docs from ingress-nginx to Traefik and replaced the old Vagrant example with a new RKE2/Traefik-based environment
- Fixed malformed indentation in
kubernetes/01-volumes-nfs.yml.examplefor thefilescanvolume section - Removed deprecated Kubernetes example files for ingress-nginx and the old separate NFS-server Vagrant setup
opensearchis no longer part of thehedgehogDocker Compose profile, and somedepends_onrelationships were adjusted accordingly
- #942 - Fixed mutable default argument usage in Zeek threat feed helper functions (thanks @stef41)
- #917 — develop IronBank (US DoD) images for Malcolm
- 📄 Configuration changes for Malcolm (in environment variables in
./config/). The Malcolm control script (e.g.,./scripts/status,./scripts/start) automatically handles creation and migration of variables according to./config/env-var-actions.yml.- Added
ZEEK_FILE_ANALYZER_TIMEOUT_SEC(default5) tozeek.env. This is the default amount of time a file can be inactive before the file analysis gives up and discards any internal state related to the file. ZEEK_CLUSTER_BACKENDcan be specified inzeek.envto specify the Zeek cluster backend (ZeroMQvsBroker).
- Added
- ❌ Errata
- Under NetBox → Plugins → NetBox HealthCheck Plugin → HealthCheck the error "unavailable: Unable to connect to Redis: Connection Error" is displayed. This is a side effect of #882 and does not actually indicate a problem with NetBox or its connection to Valkey. This will be fixed in the next release.
Malcolm is a powerful, easily deployable network 🖧 traffic analysis tool suite for network security monitoring 🕵🏻♀️.
Malcolm operates as a cluster of containers 📦, isolated sandboxes which each serve a dedicated function of the system. This makes Malcolm deployable with frameworks like Docker 🐋, Podman 🦭, and Kubernetes ⎈. Check out the Quick Start guide for examples on how to get up and running.
Alternatively, dedicated official ISO installer images 💿 for Malcolm and Hedgehog Linux 🦔 can be downloaded from Malcolm's releases page on GitHub. Due to limits on individual files in GitHub releases, these ISO files have been split 🪓 into 2GB chunks and can be reassembled with scripts provided for both Bash 🐧 (
release_cleaver.sh) and PowerShell 🪟 (release_cleaver.ps1). See Downloading Malcolm - Installer ISOs for instructions.As always, join us on the Malcolm discussions board 💬 to engage with the community, or pop some corn 🍿 and watch a video 📼.
#Malcolm #HedgehogLinux #Zeek #Arkime #Strelka #NetBox #OpenSearch #Elasticsearch #Suricata #PCAP #NetworkTrafficAnalysis #networksecuritymonitoring #OT #ICS #icssecurity #CyberSecurity #Cyber #Infosec #INL
- ✨ Features and enhancements
-
#OpenSource in production is great — until something breaks at 2am and you're on your own.
The #OpenSearch Software Foundation just launched Long Term Support to address that with accredited vendors. No lock-in. long asked by #enterprises @OpenSearchProject
opensearch.org/long-term-supportLearn more:
- Program page: https://opensearch.org/long-term-support/
- Announcement blog: https://www.linuxfoundation.org/press/opensearch-software-foundation-strengthens-enterprise-readiness-with-new-long-term-support-versions
- Technical Steering Committee proposal: https://github.com/opensearch-project/technical-steering/issues/86
- Explainer video: https://www.youtube.com/watch?v=gdvEcu5-R2M&list=PLzgr9zSpws1767PXK53BmRiSE8cP3vNxo&index=1 -
OpenSearch Dashboards и как веб‑интерфейс упрощает работу с кластером
Мы уже рассказывали, что такое OpenSearch как сервис в Selectel и как легко и быстро начать им пользоваться . Если коротко — это managed-решение, где кластер развертывается за несколько минут, а все заботы берет на себя провайдер: обслуживает кластеры, настраивает СУБД, обеспечивает отказоустойчивость, беспокоится о бэкапах и масштабировании, предоставляет поддержку. Но дальше возникает вопрос — как с этим кластером работать? Как настроить мониторинг, визуализировать данные и метрики, работать с бэкапами, управлять пользователями и доступами? Можно, конечно, отправлять curl-запросы к API. Можно подключать сторонние инструменты, вроде Grafana. Но есть способ проще и удобнее — OpenSearch Dashboards. Привет, Хабр! Меня зовут Сергей Кардапольцев, я технический писатель Читать далее →
-
CW: Release notes for v26.04.1 of Malcolm, a powerful, easily deployable network traffic analysis tool suite for network security monitoring
Malcolm v26.04.1 contains improvements, bug fixes, security updates, and component bumps.
If you are upgrading from an existing Malcolm installation, run
./scripts/statusfor Malcolm to migrate some settings prior to running./scripts/configure,./scripts/start, or other Malcolm control scripts.Note that v26.04.1 is the same as v26.04.0 released last week, apart from the fix for bug #943. If you're already running v26.04.0 and don't use the encrypted install option in the installer ISO, you probably don't need to worry about updating to v26.04.1. The full release notes from v26.04.0 are also included here.
- ✨ Features and enhancements
- implemented easier way to enable/disable Strelka scanners #935
- Handle nested file scanning (e.g., from ZIP files) with Strelka #922
- index selected Strelka result fields #919
- ✅ Component version updates
- Zeek to v8.1.1
- Arkime to v6.1.1
- crytography to v46.0.6 (for CVE-2026-34073)
- evtx to v0.11.2
- Flask to v3.1.3 (for CVE-2026-27205)
- Fluent Bit to v5.0.2
- Logstash to v9.2.7
- Requests to v2.33.1 (for CVE-2026-25645)
- supercronic to v0.2.43
- yq to v4.52.5
- Updates for ICSNPP Hart IP parser #924
- 🐛 Bug fixes
- Hedgehog Linux Breaking on Reboot after Encrypted Quick Install with Multiple Drives #943
- Fix YAML syntax error in kubernetes/15-redis.yml due to missing end quote #926
- Using remote elasticsearch data store uses deprecated
ssl_certificate_verificationsetting [https://github.com/cisagov/Malcolm/issues/915] - fix Malcolm API loopback webhook to handle RBAC and non-JSON formatted events #916
- fix issues in zeekdeploy.sh to handle long crypto handshakes and Zeek's state DB getting out of sync
- 🧹 Code and project maintenance
- swap redis out for valkey #882
- pin all third-party GitHub CI actions at known good SHA sums to mitigate things like the Trivy supply chain attack #933
- some minor tweaks to various Dockerfiles and ISO build scripts to address vulnerability scanner findings
- some documentation updates
- 📄 Configuration changes for Malcolm (in environment variables in
./config/). The Malcolm control script (e.g.,./scripts/status,./scripts/start) automatically handles creation and migration of variables according to./config/env-var-actions.yml.- Added
ARKIME_PCAP_LIBPCAPtoarkime.envshould uses wish to revert to older libpcap mode for PCAP file processing rather than faster scheme processing (defaultfalse) FILEBEAT_SCANNER_FINGERPRINT_LENGTH's default infilescan.envhas been changed from1024to512redis.envhas been renamed tovalkey.envand its variables also have been renamed accordinglySTRELKA_SCANNERShas been added topipeline.envfor #935ZEEK_DISABLE_SPICY_ZIPhas been added tozeek.envfor #922 (defaulttrue)
- Added
Malcolm is a powerful, easily deployable network 🖧 traffic analysis tool suite for network security monitoring 🕵🏻♀️.
Malcolm operates as a cluster of containers 📦, isolated sandboxes which each serve a dedicated function of the system. This makes Malcolm deployable with frameworks like Docker 🐋, Podman 🦭, and Kubernetes ⎈. Check out the Quick Start guide for examples on how to get up and running.
Alternatively, dedicated official ISO installer images 💿 for Malcolm and Hedgehog Linux 🦔 can be downloaded from Malcolm's releases page on GitHub. Due to limits on individual files in GitHub releases, these ISO files have been split 🪓 into 2GB chunks and can be reassembled with scripts provided for both Bash 🐧 (
release_cleaver.sh) and PowerShell 🪟 (release_cleaver.ps1). See Downloading Malcolm - Installer ISOs for instructions.As always, join us on the Malcolm discussions board 💬 to engage with the community, or pop some corn 🍿 and watch a video 📼.
#Malcolm #HedgehogLinux #Zeek #Arkime #Strelka #NetBox #OpenSearch #Elasticsearch #Suricata #PCAP #NetworkTrafficAnalysis #networksecuritymonitoring #OT #ICS #icssecurity #CyberSecurity #Cyber #Infosec #INL
- ✨ Features and enhancements
-
CW: Release notes for v26.04.1 of Malcolm, a powerful, easily deployable network traffic analysis tool suite for network security monitoring
Malcolm v26.04.1 contains improvements, bug fixes, security updates, and component bumps.
If you are upgrading from an existing Malcolm installation, run
./scripts/statusfor Malcolm to migrate some settings prior to running./scripts/configure,./scripts/start, or other Malcolm control scripts.Note that v26.04.1 is the same as v26.04.0 released last week, apart from the fix for bug #943. If you're already running v26.04.0 and don't use the encrypted install option in the installer ISO, you probably don't need to worry about updating to v26.04.1. The full release notes from v26.04.0 are also included here.
- ✨ Features and enhancements
- implemented easier way to enable/disable Strelka scanners #935
- Handle nested file scanning (e.g., from ZIP files) with Strelka #922
- index selected Strelka result fields #919
- ✅ Component version updates
- Zeek to v8.1.1
- Arkime to v6.1.1
- crytography to v46.0.6 (for CVE-2026-34073)
- evtx to v0.11.2
- Flask to v3.1.3 (for CVE-2026-27205)
- Fluent Bit to v5.0.2
- Logstash to v9.2.7
- Requests to v2.33.1 (for CVE-2026-25645)
- supercronic to v0.2.43
- yq to v4.52.5
- Updates for ICSNPP Hart IP parser #924
- 🐛 Bug fixes
- Hedgehog Linux Breaking on Reboot after Encrypted Quick Install with Multiple Drives #943
- Fix YAML syntax error in kubernetes/15-redis.yml due to missing end quote #926
- Using remote elasticsearch data store uses deprecated
ssl_certificate_verificationsetting [https://github.com/cisagov/Malcolm/issues/915] - fix Malcolm API loopback webhook to handle RBAC and non-JSON formatted events #916
- fix issues in zeekdeploy.sh to handle long crypto handshakes and Zeek's state DB getting out of sync
- 🧹 Code and project maintenance
- swap redis out for valkey #882
- pin all third-party GitHub CI actions at known good SHA sums to mitigate things like the Trivy supply chain attack #933
- some minor tweaks to various Dockerfiles and ISO build scripts to address vulnerability scanner findings
- some documentation updates
- 📄 Configuration changes for Malcolm (in environment variables in
./config/). The Malcolm control script (e.g.,./scripts/status,./scripts/start) automatically handles creation and migration of variables according to./config/env-var-actions.yml.- Added
ARKIME_PCAP_LIBPCAPtoarkime.envshould uses wish to revert to older libpcap mode for PCAP file processing rather than faster scheme processing (defaultfalse) FILEBEAT_SCANNER_FINGERPRINT_LENGTH's default infilescan.envhas been changed from1024to512redis.envhas been renamed tovalkey.envand its variables also have been renamed accordinglySTRELKA_SCANNERShas been added topipeline.envfor #935ZEEK_DISABLE_SPICY_ZIPhas been added tozeek.envfor #922 (defaulttrue)
- Added
Malcolm is a powerful, easily deployable network 🖧 traffic analysis tool suite for network security monitoring 🕵🏻♀️.
Malcolm operates as a cluster of containers 📦, isolated sandboxes which each serve a dedicated function of the system. This makes Malcolm deployable with frameworks like Docker 🐋, Podman 🦭, and Kubernetes ⎈. Check out the Quick Start guide for examples on how to get up and running.
Alternatively, dedicated official ISO installer images 💿 for Malcolm and Hedgehog Linux 🦔 can be downloaded from Malcolm's releases page on GitHub. Due to limits on individual files in GitHub releases, these ISO files have been split 🪓 into 2GB chunks and can be reassembled with scripts provided for both Bash 🐧 (
release_cleaver.sh) and PowerShell 🪟 (release_cleaver.ps1). See Downloading Malcolm - Installer ISOs for instructions.As always, join us on the Malcolm discussions board 💬 to engage with the community, or pop some corn 🍿 and watch a video 📼.
#Malcolm #HedgehogLinux #Zeek #Arkime #Strelka #NetBox #OpenSearch #Elasticsearch #Suricata #PCAP #NetworkTrafficAnalysis #networksecuritymonitoring #OT #ICS #icssecurity #CyberSecurity #Cyber #Infosec #INL
- ✨ Features and enhancements
-
CW: Release notes for v26.04.1 of Malcolm, a powerful, easily deployable network traffic analysis tool suite for network security monitoring
Malcolm v26.04.1 contains improvements, bug fixes, security updates, and component bumps.
If you are upgrading from an existing Malcolm installation, run
./scripts/statusfor Malcolm to migrate some settings prior to running./scripts/configure,./scripts/start, or other Malcolm control scripts.Note that v26.04.1 is the same as v26.04.0 released last week, apart from the fix for bug #943. If you're already running v26.04.0 and don't use the encrypted install option in the installer ISO, you probably don't need to worry about updating to v26.04.1. The full release notes from v26.04.0 are also included here.
- ✨ Features and enhancements
- implemented easier way to enable/disable Strelka scanners #935
- Handle nested file scanning (e.g., from ZIP files) with Strelka #922
- index selected Strelka result fields #919
- ✅ Component version updates
- Zeek to v8.1.1
- Arkime to v6.1.1
- crytography to v46.0.6 (for CVE-2026-34073)
- evtx to v0.11.2
- Flask to v3.1.3 (for CVE-2026-27205)
- Fluent Bit to v5.0.2
- Logstash to v9.2.7
- Requests to v2.33.1 (for CVE-2026-25645)
- supercronic to v0.2.43
- yq to v4.52.5
- Updates for ICSNPP Hart IP parser #924
- 🐛 Bug fixes
- Hedgehog Linux Breaking on Reboot after Encrypted Quick Install with Multiple Drives #943
- Fix YAML syntax error in kubernetes/15-redis.yml due to missing end quote #926
- Using remote elasticsearch data store uses deprecated
ssl_certificate_verificationsetting [https://github.com/cisagov/Malcolm/issues/915] - fix Malcolm API loopback webhook to handle RBAC and non-JSON formatted events #916
- fix issues in zeekdeploy.sh to handle long crypto handshakes and Zeek's state DB getting out of sync
- 🧹 Code and project maintenance
- swap redis out for valkey #882
- pin all third-party GitHub CI actions at known good SHA sums to mitigate things like the Trivy supply chain attack #933
- some minor tweaks to various Dockerfiles and ISO build scripts to address vulnerability scanner findings
- some documentation updates
- 📄 Configuration changes for Malcolm (in environment variables in
./config/). The Malcolm control script (e.g.,./scripts/status,./scripts/start) automatically handles creation and migration of variables according to./config/env-var-actions.yml.- Added
ARKIME_PCAP_LIBPCAPtoarkime.envshould uses wish to revert to older libpcap mode for PCAP file processing rather than faster scheme processing (defaultfalse) FILEBEAT_SCANNER_FINGERPRINT_LENGTH's default infilescan.envhas been changed from1024to512redis.envhas been renamed tovalkey.envand its variables also have been renamed accordinglySTRELKA_SCANNERShas been added topipeline.envfor #935ZEEK_DISABLE_SPICY_ZIPhas been added tozeek.envfor #922 (defaulttrue)
- Added
Malcolm is a powerful, easily deployable network 🖧 traffic analysis tool suite for network security monitoring 🕵🏻♀️.
Malcolm operates as a cluster of containers 📦, isolated sandboxes which each serve a dedicated function of the system. This makes Malcolm deployable with frameworks like Docker 🐋, Podman 🦭, and Kubernetes ⎈. Check out the Quick Start guide for examples on how to get up and running.
Alternatively, dedicated official ISO installer images 💿 for Malcolm and Hedgehog Linux 🦔 can be downloaded from Malcolm's releases page on GitHub. Due to limits on individual files in GitHub releases, these ISO files have been split 🪓 into 2GB chunks and can be reassembled with scripts provided for both Bash 🐧 (
release_cleaver.sh) and PowerShell 🪟 (release_cleaver.ps1). See Downloading Malcolm - Installer ISOs for instructions.As always, join us on the Malcolm discussions board 💬 to engage with the community, or pop some corn 🍿 and watch a video 📼.
#Malcolm #HedgehogLinux #Zeek #Arkime #Strelka #NetBox #OpenSearch #Elasticsearch #Suricata #PCAP #NetworkTrafficAnalysis #networksecuritymonitoring #OT #ICS #icssecurity #CyberSecurity #Cyber #Infosec #INL
- ✨ Features and enhancements
-
CW: Release notes for v26.04.1 of Malcolm, a powerful, easily deployable network traffic analysis tool suite for network security monitoring
Malcolm v26.04.1 contains improvements, bug fixes, security updates, and component bumps.
If you are upgrading from an existing Malcolm installation, run
./scripts/statusfor Malcolm to migrate some settings prior to running./scripts/configure,./scripts/start, or other Malcolm control scripts.Note that v26.04.1 is the same as v26.04.0 released last week, apart from the fix for bug #943. If you're already running v26.04.0 and don't use the encrypted install option in the installer ISO, you probably don't need to worry about updating to v26.04.1. The full release notes from v26.04.0 are also included here.
- ✨ Features and enhancements
- implemented easier way to enable/disable Strelka scanners #935
- Handle nested file scanning (e.g., from ZIP files) with Strelka #922
- index selected Strelka result fields #919
- ✅ Component version updates
- Zeek to v8.1.1
- Arkime to v6.1.1
- crytography to v46.0.6 (for CVE-2026-34073)
- evtx to v0.11.2
- Flask to v3.1.3 (for CVE-2026-27205)
- Fluent Bit to v5.0.2
- Logstash to v9.2.7
- Requests to v2.33.1 (for CVE-2026-25645)
- supercronic to v0.2.43
- yq to v4.52.5
- Updates for ICSNPP Hart IP parser #924
- 🐛 Bug fixes
- Hedgehog Linux Breaking on Reboot after Encrypted Quick Install with Multiple Drives #943
- Fix YAML syntax error in kubernetes/15-redis.yml due to missing end quote #926
- Using remote elasticsearch data store uses deprecated
ssl_certificate_verificationsetting [https://github.com/cisagov/Malcolm/issues/915] - fix Malcolm API loopback webhook to handle RBAC and non-JSON formatted events #916
- fix issues in zeekdeploy.sh to handle long crypto handshakes and Zeek's state DB getting out of sync
- 🧹 Code and project maintenance
- swap redis out for valkey #882
- pin all third-party GitHub CI actions at known good SHA sums to mitigate things like the Trivy supply chain attack #933
- some minor tweaks to various Dockerfiles and ISO build scripts to address vulnerability scanner findings
- some documentation updates
- 📄 Configuration changes for Malcolm (in environment variables in
./config/). The Malcolm control script (e.g.,./scripts/status,./scripts/start) automatically handles creation and migration of variables according to./config/env-var-actions.yml.- Added
ARKIME_PCAP_LIBPCAPtoarkime.envshould uses wish to revert to older libpcap mode for PCAP file processing rather than faster scheme processing (defaultfalse) FILEBEAT_SCANNER_FINGERPRINT_LENGTH's default infilescan.envhas been changed from1024to512redis.envhas been renamed tovalkey.envand its variables also have been renamed accordinglySTRELKA_SCANNERShas been added topipeline.envfor #935ZEEK_DISABLE_SPICY_ZIPhas been added tozeek.envfor #922 (defaulttrue)
- Added
Malcolm is a powerful, easily deployable network 🖧 traffic analysis tool suite for network security monitoring 🕵🏻♀️.
Malcolm operates as a cluster of containers 📦, isolated sandboxes which each serve a dedicated function of the system. This makes Malcolm deployable with frameworks like Docker 🐋, Podman 🦭, and Kubernetes ⎈. Check out the Quick Start guide for examples on how to get up and running.
Alternatively, dedicated official ISO installer images 💿 for Malcolm and Hedgehog Linux 🦔 can be downloaded from Malcolm's releases page on GitHub. Due to limits on individual files in GitHub releases, these ISO files have been split 🪓 into 2GB chunks and can be reassembled with scripts provided for both Bash 🐧 (
release_cleaver.sh) and PowerShell 🪟 (release_cleaver.ps1). See Downloading Malcolm - Installer ISOs for instructions.As always, join us on the Malcolm discussions board 💬 to engage with the community, or pop some corn 🍿 and watch a video 📼.
#Malcolm #HedgehogLinux #Zeek #Arkime #Strelka #NetBox #OpenSearch #Elasticsearch #Suricata #PCAP #NetworkTrafficAnalysis #networksecuritymonitoring #OT #ICS #icssecurity #CyberSecurity #Cyber #Infosec #INL
- ✨ Features and enhancements
-
CW: Release notes for v26.04.1 of Malcolm, a powerful, easily deployable network traffic analysis tool suite for network security monitoring
Malcolm v26.04.1 contains improvements, bug fixes, security updates, and component bumps.
If you are upgrading from an existing Malcolm installation, run
./scripts/statusfor Malcolm to migrate some settings prior to running./scripts/configure,./scripts/start, or other Malcolm control scripts.Note that v26.04.1 is the same as v26.04.0 released last week, apart from the fix for bug #943. If you're already running v26.04.0 and don't use the encrypted install option in the installer ISO, you probably don't need to worry about updating to v26.04.1. The full release notes from v26.04.0 are also included here.
- ✨ Features and enhancements
- implemented easier way to enable/disable Strelka scanners #935
- Handle nested file scanning (e.g., from ZIP files) with Strelka #922
- index selected Strelka result fields #919
- ✅ Component version updates
- Zeek to v8.1.1
- Arkime to v6.1.1
- crytography to v46.0.6 (for CVE-2026-34073)
- evtx to v0.11.2
- Flask to v3.1.3 (for CVE-2026-27205)
- Fluent Bit to v5.0.2
- Logstash to v9.2.7
- Requests to v2.33.1 (for CVE-2026-25645)
- supercronic to v0.2.43
- yq to v4.52.5
- Updates for ICSNPP Hart IP parser #924
- 🐛 Bug fixes
- Hedgehog Linux Breaking on Reboot after Encrypted Quick Install with Multiple Drives #943
- Fix YAML syntax error in kubernetes/15-redis.yml due to missing end quote #926
- Using remote elasticsearch data store uses deprecated
ssl_certificate_verificationsetting [https://github.com/cisagov/Malcolm/issues/915] - fix Malcolm API loopback webhook to handle RBAC and non-JSON formatted events #916
- fix issues in zeekdeploy.sh to handle long crypto handshakes and Zeek's state DB getting out of sync
- 🧹 Code and project maintenance
- swap redis out for valkey #882
- pin all third-party GitHub CI actions at known good SHA sums to mitigate things like the Trivy supply chain attack #933
- some minor tweaks to various Dockerfiles and ISO build scripts to address vulnerability scanner findings
- some documentation updates
- 📄 Configuration changes for Malcolm (in environment variables in
./config/). The Malcolm control script (e.g.,./scripts/status,./scripts/start) automatically handles creation and migration of variables according to./config/env-var-actions.yml.- Added
ARKIME_PCAP_LIBPCAPtoarkime.envshould uses wish to revert to older libpcap mode for PCAP file processing rather than faster scheme processing (defaultfalse) FILEBEAT_SCANNER_FINGERPRINT_LENGTH's default infilescan.envhas been changed from1024to512redis.envhas been renamed tovalkey.envand its variables also have been renamed accordinglySTRELKA_SCANNERShas been added topipeline.envfor #935ZEEK_DISABLE_SPICY_ZIPhas been added tozeek.envfor #922 (defaulttrue)
- Added
Malcolm is a powerful, easily deployable network 🖧 traffic analysis tool suite for network security monitoring 🕵🏻♀️.
Malcolm operates as a cluster of containers 📦, isolated sandboxes which each serve a dedicated function of the system. This makes Malcolm deployable with frameworks like Docker 🐋, Podman 🦭, and Kubernetes ⎈. Check out the Quick Start guide for examples on how to get up and running.
Alternatively, dedicated official ISO installer images 💿 for Malcolm and Hedgehog Linux 🦔 can be downloaded from Malcolm's releases page on GitHub. Due to limits on individual files in GitHub releases, these ISO files have been split 🪓 into 2GB chunks and can be reassembled with scripts provided for both Bash 🐧 (
release_cleaver.sh) and PowerShell 🪟 (release_cleaver.ps1). See Downloading Malcolm - Installer ISOs for instructions.As always, join us on the Malcolm discussions board 💬 to engage with the community, or pop some corn 🍿 and watch a video 📼.
#Malcolm #HedgehogLinux #Zeek #Arkime #Strelka #NetBox #OpenSearch #Elasticsearch #Suricata #PCAP #NetworkTrafficAnalysis #networksecuritymonitoring #OT #ICS #icssecurity #CyberSecurity #Cyber #Infosec #INL
- ✨ Features and enhancements
-
Did you know that #OpenSearch nodes have native support for #gRPC and #Protobuf?
We ran benchmarks comparing gRPC and REST, and saw significant reduction in:
📉 payload size
📉 latency
📉 CPU utilization (on both client & server sides)
📉 client-side processing timeWe also auto-generate the Protobuf definitions from the OpenSearch Project OpenAPI specifications to keep consistency across REST and gRPC APIs.
Check out the @OpenSearchProject blog:
https://opensearch.org/blog/advancing-opensearch-with-grpc-and-protocol-buffers/ -
Stoked seeing the OpenSearch Project featured by Jensen Huang on #NVIDIA #GTC keynote! 😍
One of the innovations in #OpenSearch V3 has been adding GPU acceleration based on NVIDIA's cuVS. Our #VectorSearch benchmarks, using CAGRA algorithm integrated through Facebook's Faiss library, showed:
✅ 9.3x faster index builds
✅ 3.75x lower cost
✅ 2x higher throughput
✅ 2.5x lower CPU usagehttps://www.linkedin.com/feed/update/urn:li:activity:7439600547852189697/
#OpenSearchAmbassador #opensource #gtc2026 #gtc26 #cuvs #vectordb
-
You already know that you can visualize your metrics from #Prometheus in #OpenSearch Dashboard's Discover Metrics experience (if not, check the comments).
But what if we could add some #AI sauce to detect anomalies and extrapolate forecasts?
Check out the new RFC for time series #anomalyDetection and #forecasting in @OpenSearchProject and chime in with your feedback.
https://github.com/opensearch-project/OpenSearch-Dashboards/issues/11439#OpenSearchAmbassador #timeseries #metrics #monitoring #cloudnative
@Prometheus -
You already know that you can visualize your metrics from #Prometheus in #OpenSearch Dashboard's Discover Metrics experience (if not, check the comments).
But what if we could add some #AI sauce to detect anomalies and extrapolate forecasts?
Check out the new RFC for time series #anomalyDetection and #forecasting in @OpenSearchProject and chime in with your feedback.
https://github.com/opensearch-project/OpenSearch-Dashboards/issues/11439#OpenSearchAmbassador #timeseries #metrics #monitoring #cloudnative
@Prometheus -
You already know that you can visualize your metrics from #Prometheus in #OpenSearch Dashboard's Discover Metrics experience (if not, check the comments).
But what if we could add some #AI sauce to detect anomalies and extrapolate forecasts?
Check out the new RFC for time series #anomalyDetection and #forecasting in @OpenSearchProject and chime in with your feedback.
https://github.com/opensearch-project/OpenSearch-Dashboards/issues/11439#OpenSearchAmbassador #timeseries #metrics #monitoring #cloudnative
@Prometheus -
You already know that you can visualize your metrics from #Prometheus in #OpenSearch Dashboard's Discover Metrics experience (if not, check the comments).
But what if we could add some #AI sauce to detect anomalies and extrapolate forecasts?
Check out the new RFC for time series #anomalyDetection and #forecasting in @OpenSearchProject and chime in with your feedback.
https://github.com/opensearch-project/OpenSearch-Dashboards/issues/11439#OpenSearchAmbassador #timeseries #metrics #monitoring #cloudnative
@Prometheus -
You already know that you can visualize your metrics from #Prometheus in #OpenSearch Dashboard's Discover Metrics experience (if not, check the comments).
But what if we could add some #AI sauce to detect anomalies and extrapolate forecasts?
Check out the new RFC for time series #anomalyDetection and #forecasting in @OpenSearchProject and chime in with your feedback.
https://github.com/opensearch-project/OpenSearch-Dashboards/issues/11439#OpenSearchAmbassador #timeseries #metrics #monitoring #cloudnative
@Prometheus -
Du kriegst #Cisco raus aus der Technik
#soniclinux auf den Switches https://sonicfoundation.dev/ 💪
@OpenTalkMeeting statt #Webex 💪💪
#elasticsearch oder #opensearch statt #splunk 💪
Aber wie kriegst Du Cisco raus aus den Köpfen 🤷
-
🇪🇺 Das Forschungsprojekt @openwebsearcheu bringt mit dem Open Web-Index OWI die digitale Souveränität in #Europa voran.
🔍 Universitäten, Bibliotheken und Unternehmen können OWI nutzen, um Angebote zur #Recherche von Inhalten zu entwickeln.
🤖 @DLR nutzt OWI für die interne #suche
💡 Das Interview zeigt auf, was #OWI kann und warum digitale #souveranitat nicht nur ein Schlagwort bleiben sollte: OWI hilft beim Machen 🤖: https://en.reset.org/fighting-the-search-monopoly-with-an-open-source-index-an-interview-with-michael-granitzer-from-openwebsearch/ -
OpenSearch Project ❤️ OpenTelemetry's GenAI semantic conventions!
This new RFC brings agent tracing experience to OpenSearch Dashboards.
@OpenSearchProject @opentelemetry #opensearch #opentelemetry #otel
-
AWS Weekly Roundup: Amazon EC2 M8azn instances, new open weights models in Amazon Bedrock, and more (February 16, 2026) I joined AWS in 2021, and since then I’ve watched the Amazon Elastic Comput...
#Amazon #Bedrock #Amazon #Elastic #Kubernetes #Service #Amazon #OpenSearch #Service #Amazon #RDS
Origin | Interest | Match -
Elasticsearch vs. OpenSearch: Performance and resource utilization analysis | Elastic Blog
https://www.elastic.co/blog/elasticsearch-opensearch-performance-gap
-
Elasticsearch vs. OpenSearch: Performance and resource utilization analysis | Elastic Blog
https://www.elastic.co/blog/elasticsearch-opensearch-performance-gap
-
Elasticsearch vs. OpenSearch: Performance and resource utilization analysis | Elastic Blog
https://www.elastic.co/blog/elasticsearch-opensearch-performance-gap
-
Elasticsearch vs. OpenSearch: Performance and resource utilization analysis | Elastic Blog
https://www.elastic.co/blog/elasticsearch-opensearch-performance-gap
-
Elasticsearch vs. OpenSearch: Performance and resource utilization analysis | Elastic Blog
https://www.elastic.co/blog/elasticsearch-opensearch-performance-gap
-
#OTel Unplugged is coming to Europe, as a #FOSDEM fringe!
I'm glad we're bringing this important #OpenTelemetry unconference to Europe for the first time, and I'm proud that @OpenSearchProject is sponsoring it.Join @opentelemetry community @fosdem
🔗 https://events.humanitix.com/otelunplugged-eu2026 -
CW: Release notes for v25.12.1 of Malcolm, a powerful, easily deployable network traffic analysis tool suite for network security monitoring
Malcolm v25.12.1 contains a few critical bug fixes and component version updates.
https://github.com/idaholab/Malcolm/compare/v25.12.0...v25.12.1
- ✨ Features and enhancements
- Installer splash screen shows "HEDGEHOG" when using Hedgehog run profile
- ✅ Component version updates
- supercronic to v0.2.40
- Alpine (Docker base image) to v3.23
- NetBox to v4.4.8
- urllib3 to v2.6.0 (CVE-2025-66471, 8.9 High, GHSA-2xpw-w6gg-jr37)
- 🐛 Bug fixes
- Changed field used in Threat Intelligence dashboard's file type table from
zeek.intel.file_mime_typetofile.mime_typeso filters created from it can work on other dashboards - link for threat intelligence URL doesn't work correctly from dashboards (behind reverse proxy) (#832)
- self-signed certificates not accepted by Chrome (#833)
- Malcolm ISO installer's automatic partitioning may create too-small
/varpartition (#835)
- Changed field used in Threat Intelligence dashboard's file type table from
- 🧹 Code and project maintenance
- Added new Analytics section to documentation
Malcolm is a powerful, easily deployable network 🖧 traffic analysis tool suite for network security monitoring 🕵🏻♀️.
Malcolm operates as a cluster of containers 📦, isolated sandboxes which each serve a dedicated function of the system. This makes Malcolm deployable with frameworks like Docker 🐋, Podman 🦭, and Kubernetes ⎈. Check out the Quick Start guide for examples on how to get up and running.
Alternatively, dedicated official ISO installer images 💿 for Malcolm and Hedgehog Linux 🦔 can be downloaded from Malcolm's releases page on GitHub. Due to limits on individual files in GitHub releases, these ISO files have been split 🪓 into 2GB chunks and can be reassembled with scripts provided for both Bash 🐧 (
release_cleaver.sh) and PowerShell 🪟 (release_cleaver.ps1). See Downloading Malcolm - Installer ISOs for instructions.As always, join us on the Malcolm discussions board 💬 to engage with the community, or pop some corn 🍿 and watch a video 📼.
#Malcolm #HedgehogLinux #Zeek #Arkime #NetBox #OpenSearch #Elasticsearch #Suricata #PCAP #NetworkTrafficAnalysis #networksecuritymonitoring #OT #ICS #icssecurity #CyberSecurity #Cyber #Infosec #INL
- ✨ Features and enhancements
-
Excited to join Lisa Briggs to give the closing keynote at #OpenSearchCon Japan on December 11 in Tokyo.
📃 Explore the schedule: https://bit.ly/43WTL6N
📝 Register today! https://bit.ly/4nD3gz7
#OpenSearch #opensource #cmgr -
CW: Release notes for v25.11.0 of Malcolm, a powerful, easily deployable network traffic analysis tool suite for network security monitoring
Malcolm v25.11.0 includes an overhaul of the
install.pyinstallation/configuration script, a few bug fixes, and some component version updates.https://github.com/idaholab/Malcolm/compare/v25.09.0...v25.11.0
- ✨ Features and enhancements
- We're in the process of majorly overhauling our install.py script (#395) used for setting up a Linux or MacOS system to run Malcolm and for configuring Malcolm's runtime options. There are future updates still to come (#766) but for now the command-line and dialog-based interfaces' functionality and backend are in place. The step-by-step wizard has been replaced with a menu-based interface that allows for changing individual values without having to step through the whole set of questions. The Docker-based Malcolm installation example on Ubuntu and end-to-end installation example have useful information about this change, as does the command-line arguments document. We've done a lot of testing on what's a complete rewrite of this, but there is a possibility we missed something; if you find an issue with the new install/configure script, please open a discussion or log a bug and let us know. For the next release or so, we're leaving the legacy installer in place as
scripts/legacy_install.pywhich could be used in a pinch (e.g., runscripts/legacy_install.py --configurefor the old configuration menu). - We've incorporated a new "Connections Tree" visualization. This visualization tracks the potential of lateral movement based on the observed communications between all devices that reach a root node, identified by IP address. It gives a high-level view showing both direct and indirect connetions between the root IP and all of its destinations, regardless of time, along with enriched data for each endpoint and connection.
- Updates to the Validated Design Architecture Review (VADR) dashboards.
- The OpenSearch container now includes the
repository-s3plugin, useful for those who wish to configure OpenSearch's snapshots to save to S3-compatible buckets.
- We're in the process of majorly overhauling our install.py script (#395) used for setting up a Linux or MacOS system to run Malcolm and for configuring Malcolm's runtime options. There are future updates still to come (#766) but for now the command-line and dialog-based interfaces' functionality and backend are in place. The step-by-step wizard has been replaced with a menu-based interface that allows for changing individual values without having to step through the whole set of questions. The Docker-based Malcolm installation example on Ubuntu and end-to-end installation example have useful information about this change, as does the command-line arguments document. We've done a lot of testing on what's a complete rewrite of this, but there is a possibility we missed something; if you find an issue with the new install/configure script, please open a discussion or log a bug and let us know. For the next release or so, we're leaving the legacy installer in place as
- ✅ Component version updates
- 🐛 Bug fixes
- Double imports when restarting Malcolm (#588) (thanks @KchChr)
- 🧹 Code and project maintenance
- Refactored a number of Python functions to reduce cyclomatic complexity (#765, work ongoing)
- 📄 Configuration changes (in environment variables in
./config/) for Malcolm and incontrol_vars.conffor Hedgehog Linux. The Malcolm control script (e.g.,./scripts/status,./scripts/start, etc.) should take care of creating new variables and migrating existing ones as needed based on the rules in./config/env-var-actions.ymlwithout intervention on the user's part.
Malcolm is a powerful, easily deployable network 🖧 traffic analysis tool suite for network security monitoring 🕵🏻♀️.
Malcolm operates as a cluster of containers 📦, isolated sandboxes which each serve a dedicated function of the system. This makes Malcolm deployable with frameworks like Docker 🐋, Podman 🦭, and Kubernetes ⎈. Check out the Quick Start guide for examples on how to get up and running.
Alternatively, dedicated official ISO installer images 💿 for Malcolm and Hedgehog Linux 🦔 can be downloaded from Malcolm's releases page on GitHub. Due to limits on individual files in GitHub releases, these ISO files have been split 🪓 into 2GB chunks and can be reassembled with scripts provided for both Bash 🐧 (
release_cleaver.sh) and PowerShell 🪟 (release_cleaver.ps1). See Downloading Malcolm - Installer ISOs for instructions.As always, join us on the Malcolm discussions board 💬 to engage with the community, or pop some corn 🍿 and watch a video 📼.
#Malcolm #HedgehogLinux #Zeek #Arkime #NetBox #OpenSearch #Elasticsearch #Suricata #PCAP #NetworkTrafficAnalysis #networksecuritymonitoring #OT #ICS #icssecurity #CyberSecurity #Cyber #Infosec #INL
- ✨ Features and enhancements
-
Тренды DevOps 2025: Новые версии K8s и OpenSearch. Гид по главным изменениям
Привет, коллеги! Год продолжает радовать нас мощными апдейтами!) Делимся подборкой самого интересного, что случилось в мире DevOps-инструментов недавно. Динамическое обновление ресурсов Pod и Kubernetes Одна из самых крутых фич, которая стала стабильной в Kubernetes 1.33 , - это возможность изменять запросы и лимиты CPU/памяти у работающих подов без их перезапуска.
https://habr.com/ru/articles/961124/
#opensearch #elasticsearch #kubernetes #artificial_intelligence #искусственный_интеллект #инфраструктура #itинфраструктура #информационные_технологии #ml #mlops
-
This is a unique opportunity to help continue the momentum with the #OpenSearch Software Foundation.
Have you, or someone in the community made important technical contributions? Nominations are open for our Technical Steering Committee.
-
CW: Release notes for v25.09.0 of Malcolm, a powerful, easily deployable network traffic analysis tool suite for network security monitoring
Malcolm v25.09.0 includes new features and available customizations, improvements to Threat Intelligence, component version updates, and several important bug fixes.
https://github.com/idaholab/Malcolm/compare/v25.08.1...v25.09.0
- ✨ Features and enhancements
- improve Modbus register tracking with new
modbus_detailed.log(cisagov/Malcolm#762) - add non-LVM option(s) for Malcolm/Hedgehog Linux ISO installers (cisagov/Malcolm#725)
- allow configuring default search time frame for OpenSearch Dashboards (cisagov/Malcolm#724)
- allow customizing maximum upload file size (cisagov/Malcolm#769)
- add Arkime capture statistics to the Packet Capture Statistics dashboard (cisagov/Malcolm#703)
- integrate Validated Architecture Design Review (VADR) dashboards (cisagov/Malcolm#780)
- Threat Intelligence improvements
- support Google Threat Intelligence feed for building Zeek intel source (cisagov/Malcolm#758)
- renamed Zeek Intelligence dashboard to Threat Intelligence and improved it
- links from context menu items in Arkime and Dashboards (like reference URLs for IOCs) now ask the user before navigating to external sites
- Added icons with links to "ready" and "ingest statistics" APIs to landing page
- Include
tx-rx-secure.shin files packaged bymalcolm_appliance_packager.sh
- improve Modbus register tracking with new
- ✅ Component version updates
- 🐛 Bug fixes
- Python code handling
X-Forwarded-headers should do case insensitive lookup (cisagov/Malcolm#764) - uploaded PCAPs that result in no filename-derived tags erroneously end up with internal tags on them (cisagov/Malcolm#774)
- installer option for encrypted storage are not marking secondary data/artifact storage for encryption (cisagov/Malcolm#779)
- Malcolm/Hedgehog Linux ISO-installed environments'
auditdservice fails to start (cisagov/Malcolm#761) - Failed shard query error on Overview dashboard (cisagov/Malcolm#754)
- Python code handling
- 🧹 Code and project maintenance
- refactor GitHub build actions for Malcolm Docker images to reduce duplication (cisagov/Malcolm#717)
- 📄 Configuration changes (in environment variables in
./config/) for Malcolm and incontrol_vars.conffor Hedgehog Linux. The Malcolm control script (e.g.,./scripts/status,./scripts/start, etc.) should take care of creating new variables and migrating existing ones as needed based on the rules in./config/env-var-actions.yml.- Malcolm
PCAP_UPLOAD_MAX_FILE_GBadded toupload-common.envto allow configuring maximum PCAP upload size (cisagov/Malcolm#769)DASHBOARDS_TIMEPICKER_FROMandDASHBOARDS_TIMEPICKER_TOadded todashboards-helper.envto allow configuring default search time frame for OpenSearch Dashboards (cisagov/Malcolm#724)
- Malcolm
Malcolm is a powerful, easily deployable network 🖧 traffic analysis tool suite for network security monitoring 🕵🏻♀️.
Malcolm operates as a cluster of containers 📦, isolated sandboxes which each serve a dedicated function of the system. This makes Malcolm deployable with frameworks like Docker 🐋, Podman 🦭, and Kubernetes ⎈. Check out the Quick Start guide for examples on how to get up and running.
Alternatively, dedicated official ISO installer images 💿 for Malcolm and Hedgehog Linux 🦔 can be downloaded from Malcolm's releases page on GitHub. Due to limits on individual files in GitHub releases, these ISO files have been split 🪓 into 2GB chunks and can be reassembled with scripts provided for both Bash 🐧 (
release_cleaver.sh) and PowerShell 🪟 (release_cleaver.ps1). See Downloading Malcolm - Installer ISOs for instructions.As always, join us on the Malcolm discussions board 💬 to engage with the community, or pop some corn 🍿 and watch a video 📼.
#Malcolm #HedgehogLinux #Zeek #Arkime #NetBox #OpenSearch #Elasticsearch #Suricata #PCAP #NetworkTrafficAnalysis #networksecuritymonitoring #OT #ICS #icssecurity #CyberSecurity #Cyber #Infosec #INL
- ✨ Features and enhancements
-
As part of the final judgment, Google is now required to share click-through data with qualified competitors.
This is a historic move toward search engine interoperability and could reshape the competitive landscape of search and AI training data.
📄 Full judgment (286 pages):
https://www.documentcloud.org/documents/25032745-045110819896/#Google #Antitrust #SearchEngines #Interoperability #OpenSearch #DigitalMarkets #CompetitionLaw #TechPolicy #DataAccess #PlatformRegulation #SearchMonopoly
-
Building a network traffic analysis system: Deploying Malcolm on Amazon EC2
This is the first of two blog posts on the AWS Public Sector Blog about deploying Malcolm on Amazon AWS. It covers installing Malcolm on a single EC2 instance. The next post will cover deploying Malcolm on EKS.
For those of you more interested in scaling Malcolm using Kubernetes, you can check out our "still-in-beta" Helm chart and share your feedback in the issue tracker on that repo.
#AWS #EC2 #Malcolm #Zeek #Arkime #NetBox #OpenSearch #Elasticsearch #Suricata #PCAP #NetworkTrafficAnalysis #networksecuritymonitoring #OT #ICS #icssecurity #CyberSecurity #Cyber #Infosec #INL #DHS #CISA #CISAgov