home.social
Sign in Create account

#suricata — Public Fediverse posts

Live and recent posts from across the Fediverse tagged #suricata, aggregated by home.social.

  1. Larvitz :fedora: @[email protected] ·

    Mastodon Incident Report / Root cause analysis:

    Earlier today, users experienced timeouts with Search, Hashtags, and Autocomplete.

    Root Cause: Our setup separates the Mastodon frontend VPS (Hetzner) from backend services (for example Elasticsearch) via an OPNSense firewall. Suricata (our IPS) triggered a false-positive on internal traffic and aggressively blocked the VPS IP, severing the connection to the search database.

    Resolution: We identified the false-positive, added the frontend IP to the whitelist, and traffic immediately normalized. Everything is back to green!

    #mastodon #mastoadmin #burningboard #elasticsearch #firewall #opnsense #suricata #oopsie

    #mastodon #mastoadmin #burningboard #elasticsearch #firewall #opnsense
  2. Larvitz :fedora: @[email protected] ·

    Mastodon Incident Report / Root cause analysis:

    Earlier today, users experienced timeouts with Search, Hashtags, and Autocomplete.

    Root Cause: Our setup separates the Mastodon frontend VPS (Hetzner) from backend services (for example Elasticsearch) via an OPNSense firewall. Suricata (our IPS) triggered a false-positive on internal traffic and aggressively blocked the VPS IP, severing the connection to the search database.

    Resolution: We identified the false-positive, added the frontend IP to the whitelist, and traffic immediately normalized. Everything is back to green!

    #mastodon #mastoadmin #burningboard #elasticsearch #firewall #opnsense #suricata #oopsie

    #mastodon #mastoadmin #burningboard #elasticsearch #firewall #opnsense
  3. Larvitz :fedora: @[email protected] ·

    Mastodon Incident Report / Root cause analysis:

    Earlier today, users experienced timeouts with Search, Hashtags, and Autocomplete.

    Root Cause: Our setup separates the Mastodon frontend VPS (Hetzner) from backend services (for example Elasticsearch) via an OPNSense firewall. Suricata (our IPS) triggered a false-positive on internal traffic and aggressively blocked the VPS IP, severing the connection to the search database.

    Resolution: We identified the false-positive, added the frontend IP to the whitelist, and traffic immediately normalized. Everything is back to green!

    #mastodon #mastoadmin #burningboard #elasticsearch #firewall #opnsense #suricata #oopsie

    #mastodon #mastoadmin #burningboard #elasticsearch #firewall #opnsense
  4. Larvitz :fedora: @[email protected] ·

    Mastodon Incident Report / Root cause analysis:

    Earlier today, users experienced timeouts with Search, Hashtags, and Autocomplete.

    Root Cause: Our setup separates the Mastodon frontend VPS (Hetzner) from backend services (for example Elasticsearch) via an OPNSense firewall. Suricata (our IPS) triggered a false-positive on internal traffic and aggressively blocked the VPS IP, severing the connection to the search database.

    Resolution: We identified the false-positive, added the frontend IP to the whitelist, and traffic immediately normalized. Everything is back to green!

    #mastodon #mastoadmin #burningboard #elasticsearch #firewall #opnsense #suricata #oopsie

    #oopsie #suricata #opnsense #firewall #elasticsearch #burningboard
  5. Larvitz :fedora: @[email protected] ·

    Mastodon Incident Report / Root cause analysis:

    Earlier today, users experienced timeouts with Search, Hashtags, and Autocomplete.

    Root Cause: Our setup separates the Mastodon frontend VPS (Hetzner) from backend services (for example Elasticsearch) via an OPNSense firewall. Suricata (our IPS) triggered a false-positive on internal traffic and aggressively blocked the VPS IP, severing the connection to the search database.

    Resolution: We identified the false-positive, added the frontend IP to the whitelist, and traffic immediately normalized. Everything is back to green!

    #mastodon #mastoadmin #burningboard #elasticsearch #firewall #opnsense #suricata #oopsie

    #mastodon #mastoadmin #burningboard #elasticsearch #firewall #opnsense
  6. Santiago :arandela: @[email protected] ·

    Bueno, parece que los ataques de scraping estan cesando o por lo menos el bloqueo del firewall está siendo exitoso y permite más o menos respirar al servidor. Como últimas novedades, ayer terminé de migrar las listas de bloque de Alias y reglas manuales, a listas dinámicas automáticas, aparte de que agregué algunas más que estaban faltando. Las listas dinámicas corren en bajo nivel en el firewall y aprovechan el motor pf packet filter que hace famoso a pf-Sense. Eso quedó lujo y los tests que corrí muestran que el firewall ni se despeina filtrando unas 50k IPs. También en el proxy Nginx dejé corriendo CrowdSec junto con Fail2ban y ahora ambos alimentan de IPs maliciosas que detectan, al pf-Sense que las bloquea para toda la red. CrowdSec fue sugerencia de @j3j5 y luego de @ElenaMusk y valió la pena porque solo lo conocía de nombre, nunca lo había probado, muchas gracias por el apoyo y la ayuda. Pensé que era similar a Fail2ban pero se nota que es mucho más moderno y agarra IPs que Fail2ban no agarra, justamente por el análisis decomportamiento. Yo creo que estamos bastante bien ahora, con pfBlocker-NG, Suricata y DNSBL corriendo en pf-Sense y Fail2ban y CrowdSec corriendo en el proxy que a su vez retroalimenta a pf-Sense. #pfsense #crowdsec #dnsbl #suricata #seguridad #undernet #mastodon

    #pfsense #crowdsec #dnsbl #suricata #seguridad #undernet
  7. Santiago :arandela: @[email protected] ·

    Bueno, parece que los ataques de scraping estan cesando o por lo menos el bloqueo del firewall está siendo exitoso y permite más o menos respirar al servidor. Como últimas novedades, ayer terminé de migrar las listas de bloque de Alias y reglas manuales, a listas dinámicas automáticas, aparte de que agregué algunas más que estaban faltando. Las listas dinámicas corren en bajo nivel en el firewall y aprovechan el motor pf packet filter que hace famoso a pf-Sense. Eso quedó lujo y los tests que corrí muestran que el firewall ni se despeina filtrando unas 50k IPs. También en el proxy Nginx dejé corriendo CrowdSec junto con Fail2ban y ahora ambos alimentan de IPs maliciosas que detectan, al pf-Sense que las bloquea para toda la red. CrowdSec fue sugerencia de @j3j5 y luego de @ElenaMusk y valió la pena porque solo lo conocía de nombre, nunca lo había probado, muchas gracias por el apoyo y la ayuda. Pensé que era similar a Fail2ban pero se nota que es mucho más moderno y agarra IPs que Fail2ban no agarra, justamente por el análisis decomportamiento. Yo creo que estamos bastante bien ahora, con pfBlocker-NG, Suricata y DNSBL corriendo en pf-Sense y Fail2ban y CrowdSec corriendo en el proxy que a su vez retroalimenta a pf-Sense. #pfsense #crowdsec #dnsbl #suricata #seguridad #undernet #mastodon

    #pfsense #crowdsec #dnsbl #suricata #seguridad #undernet
  8. Santiago :arandela: @[email protected] ·

    Bueno, parece que los ataques de scraping estan cesando o por lo menos el bloqueo del firewall está siendo exitoso y permite más o menos respirar al servidor. Como últimas novedades, ayer terminé de migrar las listas de bloque de Alias y reglas manuales, a listas dinámicas automáticas, aparte de que agregué algunas más que estaban faltando. Las listas dinámicas corren en bajo nivel en el firewall y aprovechan el motor pf packet filter que hace famoso a pf-Sense. Eso quedó lujo y los tests que corrí muestran que el firewall ni se despeina filtrando unas 50k IPs. También en el proxy Nginx dejé corriendo CrowdSec junto con Fail2ban y ahora ambos alimentan de IPs maliciosas que detectan, al pf-Sense que las bloquea para toda la red. CrowdSec fue sugerencia de @j3j5 y luego de @ElenaMusk y valió la pena porque solo lo conocía de nombre, nunca lo había probado, muchas gracias por el apoyo y la ayuda. Pensé que era similar a Fail2ban pero se nota que es mucho más moderno y agarra IPs que Fail2ban no agarra, justamente por el análisis decomportamiento. Yo creo que estamos bastante bien ahora, con pfBlocker-NG, Suricata y DNSBL corriendo en pf-Sense y Fail2ban y CrowdSec corriendo en el proxy que a su vez retroalimenta a pf-Sense. #pfsense #crowdsec #dnsbl #suricata #seguridad #undernet #mastodon

    #pfsense #crowdsec #dnsbl #suricata #seguridad #undernet
  9. Santiago :arandela: @[email protected] ·

    Bueno, parece que los ataques de scraping estan cesando o por lo menos el bloqueo del firewall está siendo exitoso y permite más o menos respirar al servidor. Como últimas novedades, ayer terminé de migrar las listas de bloque de Alias y reglas manuales, a listas dinámicas automáticas, aparte de que agregué algunas más que estaban faltando. Las listas dinámicas corren en bajo nivel en el firewall y aprovechan el motor pf packet filter que hace famoso a pf-Sense. Eso quedó lujo y los tests que corrí muestran que el firewall ni se despeina filtrando unas 50k IPs. También en el proxy Nginx dejé corriendo CrowdSec junto con Fail2ban y ahora ambos alimentan de IPs maliciosas que detectan, al pf-Sense que las bloquea para toda la red. CrowdSec fue sugerencia de @j3j5 y luego de @ElenaMusk y valió la pena porque solo lo conocía de nombre, nunca lo había probado, muchas gracias por el apoyo y la ayuda. Pensé que era similar a Fail2ban pero se nota que es mucho más moderno y agarra IPs que Fail2ban no agarra, justamente por el análisis decomportamiento. Yo creo que estamos bastante bien ahora, con pfBlocker-NG, Suricata y DNSBL corriendo en pf-Sense y Fail2ban y CrowdSec corriendo en el proxy que a su vez retroalimenta a pf-Sense. #pfsense #crowdsec #dnsbl #suricata #seguridad #undernet #mastodon

    #mastodon #undernet #seguridad #suricata #dnsbl #crowdsec
  10. Santiago :arandela: @[email protected] ·

    Bueno, parece que los ataques de scraping estan cesando o por lo menos el bloqueo del firewall está siendo exitoso y permite más o menos respirar al servidor. Como últimas novedades, ayer terminé de migrar las listas de bloque de Alias y reglas manuales, a listas dinámicas automáticas, aparte de que agregué algunas más que estaban faltando. Las listas dinámicas corren en bajo nivel en el firewall y aprovechan el motor pf packet filter que hace famoso a pf-Sense. Eso quedó lujo y los tests que corrí muestran que el firewall ni se despeina filtrando unas 50k IPs. También en el proxy Nginx dejé corriendo CrowdSec junto con Fail2ban y ahora ambos alimentan de IPs maliciosas que detectan, al pf-Sense que las bloquea para toda la red. CrowdSec fue sugerencia de @j3j5 y luego de @ElenaMusk y valió la pena porque solo lo conocía de nombre, nunca lo había probado, muchas gracias por el apoyo y la ayuda. Pensé que era similar a Fail2ban pero se nota que es mucho más moderno y agarra IPs que Fail2ban no agarra, justamente por el análisis decomportamiento. Yo creo que estamos bastante bien ahora, con pfBlocker-NG, Suricata y DNSBL corriendo en pf-Sense y Fail2ban y CrowdSec corriendo en el proxy que a su vez retroalimenta a pf-Sense. #pfsense #crowdsec #dnsbl #suricata #seguridad #undernet #mastodon

    #pfsense #crowdsec #dnsbl #suricata #seguridad #undernet
  11. Seth Grover @[email protected] ·
    CW: release notes for Malcolm v26.05.0, a network traffic analysis tool suite for network security monitoring

    Malcolm v26.05.0 delivers a mix of feature improvements, performance improvements, bug fixes, dependency updates, and deployment refinements across Malcolm and Hedgehog for both Docker- and Kubernetes-based workflows.

    If you are upgrading from an existing Malcolm installation, run ./scripts/status for Malcolm to migrate some settings prior to running ./scripts/configure, ./scripts/start, or other Malcolm control scripts.

    github.com/idaholab/Malcolm/co

    • ✨ Features and enhancements
      • #726 — use hierarchical structure for NetBox device roles
        • Expanded/reworked NetBox preloaded device roles into a hierarchical taxonomy (thanks Crubumble)
      • #867 — examine large chown'ed directories in container images and see if they can be reduced
      • #954 — allow users to provide custom netbox scripts to be automatically registered on startup (thanks PrudhviChanda)
        • Added NetBox custom script support in the container/runtime and docs, including bind-mounting ./netbox/custom-scripts and automatic script registration at startup
        • Renamed NetBox startup/control scripts from netbox/scripts to netbox/control-scripts
      • Added file.strings extraction/indexing/search support across Strelka → Logstash → OpenSearch templates (wildcard field mapping type) → Arkime/WISE
      • Added configurable Zeek file analyzer timeout via ZEEK_FILE_ANALYZER_TIMEOUT_SEC
      • netdev users in ISO-installed environment can run nmcli and nmtui to configure network interfaces.
      • the malcolm_appliance_packager.sh script that creates a tarball of Malcolm images can now package for both Malcolm and Hedgehog profiles.
    • ✅ Component version updates
    • 🐛 Bug fixes
      • #757 — multiple OpenSearch nodes (using Malcolm-Helm) fail to communicate with each other due to self-signed certs (thanks scott-jeffery)
        • OpenSearch post-start setup now supports configurable default replica counts instead of always forcing single-node replicas to 0
        • OpenSearch self-signed internal cert generation can now be skipped when external/preexisting certs are being used
      • #827 — Fix raspberry pi build which is broken since v25.12.0 Hedgehog/Malcolm platform unification
        • Updated Hedgehog Raspberry Pi docs and first-boot behavior/documentation
        • Hedgehog Raspberry Pi image now forces password change for sensor on first login and disables direct root password login by default
        • Refactored Raspberry Pi GitHub Actions build into reusable workflow .github/workflows/raspi-build-push.yml
      • #878 — Arkime capture Fails to Start on Hedgehog When WISE Web Config Is Enabled
        • Arkime RBAC role-mapping injection is now only applied when role-based access control is enabled
        • Arkime WISE configuration initialization now handles missing/empty persistent config files more robustly
        • Arkime live capture now normalizes WISE URLs better, follows redirects when probing, and avoids some bad URL construction edge cases
      • #957 — configuration script can disable ICS parsers unintentionally
      • #959 — Arkime sessions view attempts to load PCAP for Zeek and Suricata logs (which don't have PCAP) (see also arkime/arkime#3934)
      • Fixed one-off cleanup of interrupted Zeek intel files during stop --wipe
    • 🧹 Code and project maintenance
      • Documentation improvements
      • #913 — replace ingress-nginx which is EOL
        • Switched Kubernetes ingress example/docs from ingress-nginx to Traefik and replaced the old Vagrant example with a new RKE2/Traefik-based environment
        • Fixed malformed indentation in kubernetes/01-volumes-nfs.yml.example for the filescan volume section
        • Removed deprecated Kubernetes example files for ingress-nginx and the old separate NFS-server Vagrant setup
        • opensearch is no longer part of the hedgehog Docker Compose profile, and some depends_on relationships were adjusted accordingly
      • #942 - Fixed mutable default argument usage in Zeek threat feed helper functions (thanks @stef41)
      • #917 — develop IronBank (US DoD) images for Malcolm
    • 📄 Configuration changes for Malcolm (in environment variables in ./config/). The Malcolm control script (e.g., ./scripts/status, ./scripts/start) automatically handles creation and migration of variables according to ./config/env-var-actions.yml.
      • Added ZEEK_FILE_ANALYZER_TIMEOUT_SEC (default 5) to zeek.env. This is the default amount of time a file can be inactive before the file analysis gives up and discards any internal state related to the file.
      • ZEEK_CLUSTER_BACKEND can be specified in zeek.env to specify the Zeek cluster backend (ZeroMQ vs Broker).
    • ❌ Errata
      • Under NetBox → Plugins → NetBox HealthCheck Plugin → HealthCheck the error "unavailable: Unable to connect to Redis: Connection Error" is displayed. This is a side effect of #882 and does not actually indicate a problem with NetBox or its connection to Valkey. This will be fixed in the next release.

    Malcolm is a powerful, easily deployable network 🖧 traffic analysis tool suite for network security monitoring 🕵🏻‍♀️.

    Malcolm operates as a cluster of containers 📦, isolated sandboxes which each serve a dedicated function of the system. This makes Malcolm deployable with frameworks like Docker 🐋, Podman 🦭, and Kubernetes ⎈. Check out the Quick Start guide for examples on how to get up and running.

    Alternatively, dedicated official ISO installer images 💿 for Malcolm and Hedgehog Linux 🦔 can be downloaded from Malcolm's releases page on GitHub. Due to limits on individual files in GitHub releases, these ISO files have been split 🪓 into 2GB chunks and can be reassembled with scripts provided for both Bash 🐧 (release_cleaver.sh) and PowerShell 🪟 (release_cleaver.ps1). See Downloading Malcolm - Installer ISOs for instructions.

    As always, join us on the Malcolm discussions board 💬 to engage with the community, or pop some corn 🍿 and watch a video 📼.

    #Malcolm #HedgehogLinux #Zeek #Arkime #Strelka #NetBox #OpenSearch #Elasticsearch #Suricata #PCAP #NetworkTrafficAnalysis #networksecuritymonitoring #OT #ICS #icssecurity #CyberSecurity #Cyber #Infosec #INL

    #malcolm #hedgehoglinux #zeek #arkime #strelka #netbox
  12. Seth Grover @[email protected] ·
    CW: release notes for Malcolm v26.05.0, a network traffic analysis tool suite for network security monitoring

    Malcolm v26.05.0 delivers a mix of feature improvements, performance improvements, bug fixes, dependency updates, and deployment refinements across Malcolm and Hedgehog for both Docker- and Kubernetes-based workflows.

    If you are upgrading from an existing Malcolm installation, run ./scripts/status for Malcolm to migrate some settings prior to running ./scripts/configure, ./scripts/start, or other Malcolm control scripts.

    github.com/idaholab/Malcolm/co

    • ✨ Features and enhancements
      • #726 — use hierarchical structure for NetBox device roles
        • Expanded/reworked NetBox preloaded device roles into a hierarchical taxonomy (thanks Crubumble)
      • #867 — examine large chown'ed directories in container images and see if they can be reduced
      • #954 — allow users to provide custom netbox scripts to be automatically registered on startup (thanks PrudhviChanda)
        • Added NetBox custom script support in the container/runtime and docs, including bind-mounting ./netbox/custom-scripts and automatic script registration at startup
        • Renamed NetBox startup/control scripts from netbox/scripts to netbox/control-scripts
      • Added file.strings extraction/indexing/search support across Strelka → Logstash → OpenSearch templates (wildcard field mapping type) → Arkime/WISE
      • Added configurable Zeek file analyzer timeout via ZEEK_FILE_ANALYZER_TIMEOUT_SEC
      • netdev users in ISO-installed environment can run nmcli and nmtui to configure network interfaces.
      • the malcolm_appliance_packager.sh script that creates a tarball of Malcolm images can now package for both Malcolm and Hedgehog profiles.
    • ✅ Component version updates
    • 🐛 Bug fixes
      • #757 — multiple OpenSearch nodes (using Malcolm-Helm) fail to communicate with each other due to self-signed certs (thanks scott-jeffery)
        • OpenSearch post-start setup now supports configurable default replica counts instead of always forcing single-node replicas to 0
        • OpenSearch self-signed internal cert generation can now be skipped when external/preexisting certs are being used
      • #827 — Fix raspberry pi build which is broken since v25.12.0 Hedgehog/Malcolm platform unification
        • Updated Hedgehog Raspberry Pi docs and first-boot behavior/documentation
        • Hedgehog Raspberry Pi image now forces password change for sensor on first login and disables direct root password login by default
        • Refactored Raspberry Pi GitHub Actions build into reusable workflow .github/workflows/raspi-build-push.yml
      • #878 — Arkime capture Fails to Start on Hedgehog When WISE Web Config Is Enabled
        • Arkime RBAC role-mapping injection is now only applied when role-based access control is enabled
        • Arkime WISE configuration initialization now handles missing/empty persistent config files more robustly
        • Arkime live capture now normalizes WISE URLs better, follows redirects when probing, and avoids some bad URL construction edge cases
      • #957 — configuration script can disable ICS parsers unintentionally
      • #959 — Arkime sessions view attempts to load PCAP for Zeek and Suricata logs (which don't have PCAP) (see also arkime/arkime#3934)
      • Fixed one-off cleanup of interrupted Zeek intel files during stop --wipe
    • 🧹 Code and project maintenance
      • Documentation improvements
      • #913 — replace ingress-nginx which is EOL
        • Switched Kubernetes ingress example/docs from ingress-nginx to Traefik and replaced the old Vagrant example with a new RKE2/Traefik-based environment
        • Fixed malformed indentation in kubernetes/01-volumes-nfs.yml.example for the filescan volume section
        • Removed deprecated Kubernetes example files for ingress-nginx and the old separate NFS-server Vagrant setup
        • opensearch is no longer part of the hedgehog Docker Compose profile, and some depends_on relationships were adjusted accordingly
      • #942 - Fixed mutable default argument usage in Zeek threat feed helper functions (thanks @stef41)
      • #917 — develop IronBank (US DoD) images for Malcolm
    • 📄 Configuration changes for Malcolm (in environment variables in ./config/). The Malcolm control script (e.g., ./scripts/status, ./scripts/start) automatically handles creation and migration of variables according to ./config/env-var-actions.yml.
      • Added ZEEK_FILE_ANALYZER_TIMEOUT_SEC (default 5) to zeek.env. This is the default amount of time a file can be inactive before the file analysis gives up and discards any internal state related to the file.
      • ZEEK_CLUSTER_BACKEND can be specified in zeek.env to specify the Zeek cluster backend (ZeroMQ vs Broker).
    • ❌ Errata
      • Under NetBox → Plugins → NetBox HealthCheck Plugin → HealthCheck the error "unavailable: Unable to connect to Redis: Connection Error" is displayed. This is a side effect of #882 and does not actually indicate a problem with NetBox or its connection to Valkey. This will be fixed in the next release.

    Malcolm is a powerful, easily deployable network 🖧 traffic analysis tool suite for network security monitoring 🕵🏻‍♀️.

    Malcolm operates as a cluster of containers 📦, isolated sandboxes which each serve a dedicated function of the system. This makes Malcolm deployable with frameworks like Docker 🐋, Podman 🦭, and Kubernetes ⎈. Check out the Quick Start guide for examples on how to get up and running.

    Alternatively, dedicated official ISO installer images 💿 for Malcolm and Hedgehog Linux 🦔 can be downloaded from Malcolm's releases page on GitHub. Due to limits on individual files in GitHub releases, these ISO files have been split 🪓 into 2GB chunks and can be reassembled with scripts provided for both Bash 🐧 (release_cleaver.sh) and PowerShell 🪟 (release_cleaver.ps1). See Downloading Malcolm - Installer ISOs for instructions.

    As always, join us on the Malcolm discussions board 💬 to engage with the community, or pop some corn 🍿 and watch a video 📼.

    #Malcolm #HedgehogLinux #Zeek #Arkime #Strelka #NetBox #OpenSearch #Elasticsearch #Suricata #PCAP #NetworkTrafficAnalysis #networksecuritymonitoring #OT #ICS #icssecurity #CyberSecurity #Cyber #Infosec #INL

    #malcolm #hedgehoglinux #zeek #arkime #strelka #netbox
  13. Seth Grover @[email protected] ·
    CW: release notes for Malcolm v26.05.0, a network traffic analysis tool suite for network security monitoring

    Malcolm v26.05.0 delivers a mix of feature improvements, performance improvements, bug fixes, dependency updates, and deployment refinements across Malcolm and Hedgehog for both Docker- and Kubernetes-based workflows.

    If you are upgrading from an existing Malcolm installation, run ./scripts/status for Malcolm to migrate some settings prior to running ./scripts/configure, ./scripts/start, or other Malcolm control scripts.

    github.com/idaholab/Malcolm/co

    • ✨ Features and enhancements
      • #726 — use hierarchical structure for NetBox device roles
        • Expanded/reworked NetBox preloaded device roles into a hierarchical taxonomy (thanks Crubumble)
      • #867 — examine large chown'ed directories in container images and see if they can be reduced
      • #954 — allow users to provide custom netbox scripts to be automatically registered on startup (thanks PrudhviChanda)
        • Added NetBox custom script support in the container/runtime and docs, including bind-mounting ./netbox/custom-scripts and automatic script registration at startup
        • Renamed NetBox startup/control scripts from netbox/scripts to netbox/control-scripts
      • Added file.strings extraction/indexing/search support across Strelka → Logstash → OpenSearch templates (wildcard field mapping type) → Arkime/WISE
      • Added configurable Zeek file analyzer timeout via ZEEK_FILE_ANALYZER_TIMEOUT_SEC
      • netdev users in ISO-installed environment can run nmcli and nmtui to configure network interfaces.
      • the malcolm_appliance_packager.sh script that creates a tarball of Malcolm images can now package for both Malcolm and Hedgehog profiles.
    • ✅ Component version updates
    • 🐛 Bug fixes
      • #757 — multiple OpenSearch nodes (using Malcolm-Helm) fail to communicate with each other due to self-signed certs (thanks scott-jeffery)
        • OpenSearch post-start setup now supports configurable default replica counts instead of always forcing single-node replicas to 0
        • OpenSearch self-signed internal cert generation can now be skipped when external/preexisting certs are being used
      • #827 — Fix raspberry pi build which is broken since v25.12.0 Hedgehog/Malcolm platform unification
        • Updated Hedgehog Raspberry Pi docs and first-boot behavior/documentation
        • Hedgehog Raspberry Pi image now forces password change for sensor on first login and disables direct root password login by default
        • Refactored Raspberry Pi GitHub Actions build into reusable workflow .github/workflows/raspi-build-push.yml
      • #878 — Arkime capture Fails to Start on Hedgehog When WISE Web Config Is Enabled
        • Arkime RBAC role-mapping injection is now only applied when role-based access control is enabled
        • Arkime WISE configuration initialization now handles missing/empty persistent config files more robustly
        • Arkime live capture now normalizes WISE URLs better, follows redirects when probing, and avoids some bad URL construction edge cases
      • #957 — configuration script can disable ICS parsers unintentionally
      • #959 — Arkime sessions view attempts to load PCAP for Zeek and Suricata logs (which don't have PCAP) (see also arkime/arkime#3934)
      • Fixed one-off cleanup of interrupted Zeek intel files during stop --wipe
    • 🧹 Code and project maintenance
      • Documentation improvements
      • #913 — replace ingress-nginx which is EOL
        • Switched Kubernetes ingress example/docs from ingress-nginx to Traefik and replaced the old Vagrant example with a new RKE2/Traefik-based environment
        • Fixed malformed indentation in kubernetes/01-volumes-nfs.yml.example for the filescan volume section
        • Removed deprecated Kubernetes example files for ingress-nginx and the old separate NFS-server Vagrant setup
        • opensearch is no longer part of the hedgehog Docker Compose profile, and some depends_on relationships were adjusted accordingly
      • #942 - Fixed mutable default argument usage in Zeek threat feed helper functions (thanks @stef41)
      • #917 — develop IronBank (US DoD) images for Malcolm
    • 📄 Configuration changes for Malcolm (in environment variables in ./config/). The Malcolm control script (e.g., ./scripts/status, ./scripts/start) automatically handles creation and migration of variables according to ./config/env-var-actions.yml.
      • Added ZEEK_FILE_ANALYZER_TIMEOUT_SEC (default 5) to zeek.env. This is the default amount of time a file can be inactive before the file analysis gives up and discards any internal state related to the file.
      • ZEEK_CLUSTER_BACKEND can be specified in zeek.env to specify the Zeek cluster backend (ZeroMQ vs Broker).
    • ❌ Errata
      • Under NetBox → Plugins → NetBox HealthCheck Plugin → HealthCheck the error "unavailable: Unable to connect to Redis: Connection Error" is displayed. This is a side effect of #882 and does not actually indicate a problem with NetBox or its connection to Valkey. This will be fixed in the next release.

    Malcolm is a powerful, easily deployable network 🖧 traffic analysis tool suite for network security monitoring 🕵🏻‍♀️.

    Malcolm operates as a cluster of containers 📦, isolated sandboxes which each serve a dedicated function of the system. This makes Malcolm deployable with frameworks like Docker 🐋, Podman 🦭, and Kubernetes ⎈. Check out the Quick Start guide for examples on how to get up and running.

    Alternatively, dedicated official ISO installer images 💿 for Malcolm and Hedgehog Linux 🦔 can be downloaded from Malcolm's releases page on GitHub. Due to limits on individual files in GitHub releases, these ISO files have been split 🪓 into 2GB chunks and can be reassembled with scripts provided for both Bash 🐧 (release_cleaver.sh) and PowerShell 🪟 (release_cleaver.ps1). See Downloading Malcolm - Installer ISOs for instructions.

    As always, join us on the Malcolm discussions board 💬 to engage with the community, or pop some corn 🍿 and watch a video 📼.

    #Malcolm #HedgehogLinux #Zeek #Arkime #Strelka #NetBox #OpenSearch #Elasticsearch #Suricata #PCAP #NetworkTrafficAnalysis #networksecuritymonitoring #OT #ICS #icssecurity #CyberSecurity #Cyber #Infosec #INL

    #malcolm #hedgehoglinux #zeek #arkime #strelka #netbox
  14. Seth Grover @[email protected] ·
    CW: release notes for Malcolm v26.05.0, a network traffic analysis tool suite for network security monitoring

    Malcolm v26.05.0 delivers a mix of feature improvements, performance improvements, bug fixes, dependency updates, and deployment refinements across Malcolm and Hedgehog for both Docker- and Kubernetes-based workflows.

    If you are upgrading from an existing Malcolm installation, run ./scripts/status for Malcolm to migrate some settings prior to running ./scripts/configure, ./scripts/start, or other Malcolm control scripts.

    github.com/idaholab/Malcolm/co

    • ✨ Features and enhancements
      • #726 — use hierarchical structure for NetBox device roles
        • Expanded/reworked NetBox preloaded device roles into a hierarchical taxonomy (thanks Crubumble)
      • #867 — examine large chown'ed directories in container images and see if they can be reduced
      • #954 — allow users to provide custom netbox scripts to be automatically registered on startup (thanks PrudhviChanda)
        • Added NetBox custom script support in the container/runtime and docs, including bind-mounting ./netbox/custom-scripts and automatic script registration at startup
        • Renamed NetBox startup/control scripts from netbox/scripts to netbox/control-scripts
      • Added file.strings extraction/indexing/search support across Strelka → Logstash → OpenSearch templates (wildcard field mapping type) → Arkime/WISE
      • Added configurable Zeek file analyzer timeout via ZEEK_FILE_ANALYZER_TIMEOUT_SEC
      • netdev users in ISO-installed environment can run nmcli and nmtui to configure network interfaces.
      • the malcolm_appliance_packager.sh script that creates a tarball of Malcolm images can now package for both Malcolm and Hedgehog profiles.
    • ✅ Component version updates
    • 🐛 Bug fixes
      • #757 — multiple OpenSearch nodes (using Malcolm-Helm) fail to communicate with each other due to self-signed certs (thanks scott-jeffery)
        • OpenSearch post-start setup now supports configurable default replica counts instead of always forcing single-node replicas to 0
        • OpenSearch self-signed internal cert generation can now be skipped when external/preexisting certs are being used
      • #827 — Fix raspberry pi build which is broken since v25.12.0 Hedgehog/Malcolm platform unification
        • Updated Hedgehog Raspberry Pi docs and first-boot behavior/documentation
        • Hedgehog Raspberry Pi image now forces password change for sensor on first login and disables direct root password login by default
        • Refactored Raspberry Pi GitHub Actions build into reusable workflow .github/workflows/raspi-build-push.yml
      • #878 — Arkime capture Fails to Start on Hedgehog When WISE Web Config Is Enabled
        • Arkime RBAC role-mapping injection is now only applied when role-based access control is enabled
        • Arkime WISE configuration initialization now handles missing/empty persistent config files more robustly
        • Arkime live capture now normalizes WISE URLs better, follows redirects when probing, and avoids some bad URL construction edge cases
      • #957 — configuration script can disable ICS parsers unintentionally
      • #959 — Arkime sessions view attempts to load PCAP for Zeek and Suricata logs (which don't have PCAP) (see also arkime/arkime#3934)
      • Fixed one-off cleanup of interrupted Zeek intel files during stop --wipe
    • 🧹 Code and project maintenance
      • Documentation improvements
      • #913 — replace ingress-nginx which is EOL
        • Switched Kubernetes ingress example/docs from ingress-nginx to Traefik and replaced the old Vagrant example with a new RKE2/Traefik-based environment
        • Fixed malformed indentation in kubernetes/01-volumes-nfs.yml.example for the filescan volume section
        • Removed deprecated Kubernetes example files for ingress-nginx and the old separate NFS-server Vagrant setup
        • opensearch is no longer part of the hedgehog Docker Compose profile, and some depends_on relationships were adjusted accordingly
      • #942 - Fixed mutable default argument usage in Zeek threat feed helper functions (thanks @stef41)
      • #917 — develop IronBank (US DoD) images for Malcolm
    • 📄 Configuration changes for Malcolm (in environment variables in ./config/). The Malcolm control script (e.g., ./scripts/status, ./scripts/start) automatically handles creation and migration of variables according to ./config/env-var-actions.yml.
      • Added ZEEK_FILE_ANALYZER_TIMEOUT_SEC (default 5) to zeek.env. This is the default amount of time a file can be inactive before the file analysis gives up and discards any internal state related to the file.
      • ZEEK_CLUSTER_BACKEND can be specified in zeek.env to specify the Zeek cluster backend (ZeroMQ vs Broker).
    • ❌ Errata
      • Under NetBox → Plugins → NetBox HealthCheck Plugin → HealthCheck the error "unavailable: Unable to connect to Redis: Connection Error" is displayed. This is a side effect of #882 and does not actually indicate a problem with NetBox or its connection to Valkey. This will be fixed in the next release.

    Malcolm is a powerful, easily deployable network 🖧 traffic analysis tool suite for network security monitoring 🕵🏻‍♀️.

    Malcolm operates as a cluster of containers 📦, isolated sandboxes which each serve a dedicated function of the system. This makes Malcolm deployable with frameworks like Docker 🐋, Podman 🦭, and Kubernetes ⎈. Check out the Quick Start guide for examples on how to get up and running.

    Alternatively, dedicated official ISO installer images 💿 for Malcolm and Hedgehog Linux 🦔 can be downloaded from Malcolm's releases page on GitHub. Due to limits on individual files in GitHub releases, these ISO files have been split 🪓 into 2GB chunks and can be reassembled with scripts provided for both Bash 🐧 (release_cleaver.sh) and PowerShell 🪟 (release_cleaver.ps1). See Downloading Malcolm - Installer ISOs for instructions.

    As always, join us on the Malcolm discussions board 💬 to engage with the community, or pop some corn 🍿 and watch a video 📼.

    #Malcolm #HedgehogLinux #Zeek #Arkime #Strelka #NetBox #OpenSearch #Elasticsearch #Suricata #PCAP #NetworkTrafficAnalysis #networksecuritymonitoring #OT #ICS #icssecurity #CyberSecurity #Cyber #Infosec #INL

    #inl #infosec #cyber #cybersecurity #icssecurity #ics
  15. Seth Grover @[email protected] ·
    CW: release notes for Malcolm v26.05.0, a network traffic analysis tool suite for network security monitoring

    Malcolm v26.05.0 delivers a mix of feature improvements, performance improvements, bug fixes, dependency updates, and deployment refinements across Malcolm and Hedgehog for both Docker- and Kubernetes-based workflows.

    If you are upgrading from an existing Malcolm installation, run ./scripts/status for Malcolm to migrate some settings prior to running ./scripts/configure, ./scripts/start, or other Malcolm control scripts.

    github.com/idaholab/Malcolm/co

    • ✨ Features and enhancements
      • #726 — use hierarchical structure for NetBox device roles
        • Expanded/reworked NetBox preloaded device roles into a hierarchical taxonomy (thanks Crubumble)
      • #867 — examine large chown'ed directories in container images and see if they can be reduced
      • #954 — allow users to provide custom netbox scripts to be automatically registered on startup (thanks PrudhviChanda)
        • Added NetBox custom script support in the container/runtime and docs, including bind-mounting ./netbox/custom-scripts and automatic script registration at startup
        • Renamed NetBox startup/control scripts from netbox/scripts to netbox/control-scripts
      • Added file.strings extraction/indexing/search support across Strelka → Logstash → OpenSearch templates (wildcard field mapping type) → Arkime/WISE
      • Added configurable Zeek file analyzer timeout via ZEEK_FILE_ANALYZER_TIMEOUT_SEC
      • netdev users in ISO-installed environment can run nmcli and nmtui to configure network interfaces.
      • the malcolm_appliance_packager.sh script that creates a tarball of Malcolm images can now package for both Malcolm and Hedgehog profiles.
    • ✅ Component version updates
    • 🐛 Bug fixes
      • #757 — multiple OpenSearch nodes (using Malcolm-Helm) fail to communicate with each other due to self-signed certs (thanks scott-jeffery)
        • OpenSearch post-start setup now supports configurable default replica counts instead of always forcing single-node replicas to 0
        • OpenSearch self-signed internal cert generation can now be skipped when external/preexisting certs are being used
      • #827 — Fix raspberry pi build which is broken since v25.12.0 Hedgehog/Malcolm platform unification
        • Updated Hedgehog Raspberry Pi docs and first-boot behavior/documentation
        • Hedgehog Raspberry Pi image now forces password change for sensor on first login and disables direct root password login by default
        • Refactored Raspberry Pi GitHub Actions build into reusable workflow .github/workflows/raspi-build-push.yml
      • #878 — Arkime capture Fails to Start on Hedgehog When WISE Web Config Is Enabled
        • Arkime RBAC role-mapping injection is now only applied when role-based access control is enabled
        • Arkime WISE configuration initialization now handles missing/empty persistent config files more robustly
        • Arkime live capture now normalizes WISE URLs better, follows redirects when probing, and avoids some bad URL construction edge cases
      • #957 — configuration script can disable ICS parsers unintentionally
      • #959 — Arkime sessions view attempts to load PCAP for Zeek and Suricata logs (which don't have PCAP) (see also arkime/arkime#3934)
      • Fixed one-off cleanup of interrupted Zeek intel files during stop --wipe
    • 🧹 Code and project maintenance
      • Documentation improvements
      • #913 — replace ingress-nginx which is EOL
        • Switched Kubernetes ingress example/docs from ingress-nginx to Traefik and replaced the old Vagrant example with a new RKE2/Traefik-based environment
        • Fixed malformed indentation in kubernetes/01-volumes-nfs.yml.example for the filescan volume section
        • Removed deprecated Kubernetes example files for ingress-nginx and the old separate NFS-server Vagrant setup
        • opensearch is no longer part of the hedgehog Docker Compose profile, and some depends_on relationships were adjusted accordingly
      • #942 - Fixed mutable default argument usage in Zeek threat feed helper functions (thanks @stef41)
      • #917 — develop IronBank (US DoD) images for Malcolm
    • 📄 Configuration changes for Malcolm (in environment variables in ./config/). The Malcolm control script (e.g., ./scripts/status, ./scripts/start) automatically handles creation and migration of variables according to ./config/env-var-actions.yml.
      • Added ZEEK_FILE_ANALYZER_TIMEOUT_SEC (default 5) to zeek.env. This is the default amount of time a file can be inactive before the file analysis gives up and discards any internal state related to the file.
      • ZEEK_CLUSTER_BACKEND can be specified in zeek.env to specify the Zeek cluster backend (ZeroMQ vs Broker).
    • ❌ Errata
      • Under NetBox → Plugins → NetBox HealthCheck Plugin → HealthCheck the error "unavailable: Unable to connect to Redis: Connection Error" is displayed. This is a side effect of #882 and does not actually indicate a problem with NetBox or its connection to Valkey. This will be fixed in the next release.

    Malcolm is a powerful, easily deployable network 🖧 traffic analysis tool suite for network security monitoring 🕵🏻‍♀️.

    Malcolm operates as a cluster of containers 📦, isolated sandboxes which each serve a dedicated function of the system. This makes Malcolm deployable with frameworks like Docker 🐋, Podman 🦭, and Kubernetes ⎈. Check out the Quick Start guide for examples on how to get up and running.

    Alternatively, dedicated official ISO installer images 💿 for Malcolm and Hedgehog Linux 🦔 can be downloaded from Malcolm's releases page on GitHub. Due to limits on individual files in GitHub releases, these ISO files have been split 🪓 into 2GB chunks and can be reassembled with scripts provided for both Bash 🐧 (release_cleaver.sh) and PowerShell 🪟 (release_cleaver.ps1). See Downloading Malcolm - Installer ISOs for instructions.

    As always, join us on the Malcolm discussions board 💬 to engage with the community, or pop some corn 🍿 and watch a video 📼.

    #Malcolm #HedgehogLinux #Zeek #Arkime #Strelka #NetBox #OpenSearch #Elasticsearch #Suricata #PCAP #NetworkTrafficAnalysis #networksecuritymonitoring #OT #ICS #icssecurity #CyberSecurity #Cyber #Infosec #INL

    #malcolm #hedgehoglinux #zeek #arkime #strelka #netbox
  16. Habr @[email protected] ·

    ML IPS в Ideco NGFW: бессигнатурная защита от атак нулевого дня

    В 2020-ом году отправившись на рекомендованную всем «удаленку» мы в Айдеко перекроили весь роадмап продукта и быстро выпустили Ideco UTM VPN Edition – версию с расширенными возможностями по организации, защите и контролю доступа удаленных сотрудников. Делать что-то другое в IT-продукте в это время казалось несвоевременным. Примерно, как сейчас – не использовать AI-инструменты в работе и AI-функциональность в продукте для защиты. В то время, когда злоумышленники вовсю используют AI-инструменты. И атаки становятся все изощреннее и быстрее . В 2025 году зафиксировано 90 zero-day эксплойтов в дикой природе. 44% атак нулевого дня нацелены на корпоративные сетевые устройства - NGFW и VPN-шлюзы. Среднее время от публикации CVE до первой эксплуатации в реальных атаках сократилось до 5 дней и еще более сократится . Ни одна сигнатурная база не успевает за этим темпом. Рассказываем, как мы работаем над ML-модулем обнаружения вторжений в Ideco NGFW, что показал натурный эксперимент с ИСП РАН на 73 миллионах сессий и какие ограничения у этого подхода. Почему сигнатуры перестают справляться Сигнатурный IPS работает принципиально так же, как антивирус в 1990-х: есть база известных угроз, есть входящий трафик, есть сравнение. IPS - при всей мощи, работает с заранее описанными паттернами. Проблема не в самом подходе - проблема в скорости появления угроз. По данным Google Threat Intelligence Group , в 2025 году в дикой природе было зафиксировано 90 zero-day эксплойтов. По данным RAND Corporation, среднее время жизни zero-day атаки до её обнаружения составляет 312 дней. За это время сигнатура не появится: её невозможно написать на то, что ещё не обнаружено.

    habr.com/ru/companies/ideco/ar

    #IPS #NGFW #ml #suricata #машинное_обучение

    #машинное_обучение #suricata #ml #ngfw #ips
  17. Habr @[email protected] ·

    ML IPS в Ideco NGFW: бессигнатурная защита от атак нулевого дня

    В 2020-ом году отправившись на рекомендованную всем «удаленку» мы в Айдеко перекроили весь роадмап продукта и быстро выпустили Ideco UTM VPN Edition – версию с расширенными возможностями по организации, защите и контролю доступа удаленных сотрудников. Делать что-то другое в IT-продукте в это время казалось несвоевременным. Примерно, как сейчас – не использовать AI-инструменты в работе и AI-функциональность в продукте для защиты. В то время, когда злоумышленники вовсю используют AI-инструменты. И атаки становятся все изощреннее и быстрее . В 2025 году зафиксировано 90 zero-day эксплойтов в дикой природе. 44% атак нулевого дня нацелены на корпоративные сетевые устройства - NGFW и VPN-шлюзы. Среднее время от публикации CVE до первой эксплуатации в реальных атаках сократилось до 5 дней и еще более сократится . Ни одна сигнатурная база не успевает за этим темпом. Рассказываем, как мы работаем над ML-модулем обнаружения вторжений в Ideco NGFW, что показал натурный эксперимент с ИСП РАН на 73 миллионах сессий и какие ограничения у этого подхода. Почему сигнатуры перестают справляться Сигнатурный IPS работает принципиально так же, как антивирус в 1990-х: есть база известных угроз, есть входящий трафик, есть сравнение. IPS - при всей мощи, работает с заранее описанными паттернами. Проблема не в самом подходе - проблема в скорости появления угроз. По данным Google Threat Intelligence Group , в 2025 году в дикой природе было зафиксировано 90 zero-day эксплойтов. По данным RAND Corporation, среднее время жизни zero-day атаки до её обнаружения составляет 312 дней. За это время сигнатура не появится: её невозможно написать на то, что ещё не обнаружено.

    habr.com/ru/companies/ideco/ar

    #IPS #NGFW #ml #suricata #машинное_обучение

    #машинное_обучение #suricata #ml #ngfw #ips
  18. Habr @[email protected] ·

    ML IPS в Ideco NGFW: бессигнатурная защита от атак нулевого дня

    В 2020-ом году отправившись на рекомендованную всем «удаленку» мы в Айдеко перекроили весь роадмап продукта и быстро выпустили Ideco UTM VPN Edition – версию с расширенными возможностями по организации, защите и контролю доступа удаленных сотрудников. Делать что-то другое в IT-продукте в это время казалось несвоевременным. Примерно, как сейчас – не использовать AI-инструменты в работе и AI-функциональность в продукте для защиты. В то время, когда злоумышленники вовсю используют AI-инструменты. И атаки становятся все изощреннее и быстрее . В 2025 году зафиксировано 90 zero-day эксплойтов в дикой природе. 44% атак нулевого дня нацелены на корпоративные сетевые устройства - NGFW и VPN-шлюзы. Среднее время от публикации CVE до первой эксплуатации в реальных атаках сократилось до 5 дней и еще более сократится . Ни одна сигнатурная база не успевает за этим темпом. Рассказываем, как мы работаем над ML-модулем обнаружения вторжений в Ideco NGFW, что показал натурный эксперимент с ИСП РАН на 73 миллионах сессий и какие ограничения у этого подхода. Почему сигнатуры перестают справляться Сигнатурный IPS работает принципиально так же, как антивирус в 1990-х: есть база известных угроз, есть входящий трафик, есть сравнение. IPS - при всей мощи, работает с заранее описанными паттернами. Проблема не в самом подходе - проблема в скорости появления угроз. По данным Google Threat Intelligence Group , в 2025 году в дикой природе было зафиксировано 90 zero-day эксплойтов. По данным RAND Corporation, среднее время жизни zero-day атаки до её обнаружения составляет 312 дней. За это время сигнатура не появится: её невозможно написать на то, что ещё не обнаружено.

    habr.com/ru/companies/ideco/ar

    #IPS #NGFW #ml #suricata #машинное_обучение

    #машинное_обучение #suricata #ml #ngfw #ips
  19. Habr @[email protected] ·

    ML IPS в Ideco NGFW: бессигнатурная защита от атак нулевого дня

    В 2020-ом году отправившись на рекомендованную всем «удаленку» мы в Айдеко перекроили весь роадмап продукта и быстро выпустили Ideco UTM VPN Edition – версию с расширенными возможностями по организации, защите и контролю доступа удаленных сотрудников. Делать что-то другое в IT-продукте в это время казалось несвоевременным. Примерно, как сейчас – не использовать AI-инструменты в работе и AI-функциональность в продукте для защиты. В то время, когда злоумышленники вовсю используют AI-инструменты. И атаки становятся все изощреннее и быстрее . В 2025 году зафиксировано 90 zero-day эксплойтов в дикой природе. 44% атак нулевого дня нацелены на корпоративные сетевые устройства - NGFW и VPN-шлюзы. Среднее время от публикации CVE до первой эксплуатации в реальных атаках сократилось до 5 дней и еще более сократится . Ни одна сигнатурная база не успевает за этим темпом. Рассказываем, как мы работаем над ML-модулем обнаружения вторжений в Ideco NGFW, что показал натурный эксперимент с ИСП РАН на 73 миллионах сессий и какие ограничения у этого подхода. Почему сигнатуры перестают справляться Сигнатурный IPS работает принципиально так же, как антивирус в 1990-х: есть база известных угроз, есть входящий трафик, есть сравнение. IPS - при всей мощи, работает с заранее описанными паттернами. Проблема не в самом подходе - проблема в скорости появления угроз. По данным Google Threat Intelligence Group , в 2025 году в дикой природе было зафиксировано 90 zero-day эксплойтов. По данным RAND Corporation, среднее время жизни zero-day атаки до её обнаружения составляет 312 дней. За это время сигнатура не появится: её невозможно написать на то, что ещё не обнаружено.

    habr.com/ru/companies/ideco/ar

    #IPS #NGFW #ml #suricata #машинное_обучение

    #ips #ngfw #ml #suricata #машинное_обучение
  20. Seth Grover @[email protected] ·
    CW: Release notes for v26.04.1 of Malcolm, a powerful, easily deployable network traffic analysis tool suite for network security monitoring

    Malcolm v26.04.1 contains improvements, bug fixes, security updates, and component bumps.

    If you are upgrading from an existing Malcolm installation, run ./scripts/status for Malcolm to migrate some settings prior to running ./scripts/configure, ./scripts/start, or other Malcolm control scripts.

    v26.02.0...v26.04.1

    Note that v26.04.1 is the same as v26.04.0 released last week, apart from the fix for bug #943. If you're already running v26.04.0 and don't use the encrypted install option in the installer ISO, you probably don't need to worry about updating to v26.04.1. The full release notes from v26.04.0 are also included here.

    • ✨ Features and enhancements
      • implemented easier way to enable/disable Strelka scanners #935
      • Handle nested file scanning (e.g., from ZIP files) with Strelka #922
      • index selected Strelka result fields #919
    • ✅ Component version updates
    • 🐛 Bug fixes
      • Hedgehog Linux Breaking on Reboot after Encrypted Quick Install with Multiple Drives #943
      • Fix YAML syntax error in kubernetes/15-redis.yml due to missing end quote #926
      • Using remote elasticsearch data store uses deprecated ssl_certificate_verification setting [github.com/cisagov/Malcolm/iss]
      • fix Malcolm API loopback webhook to handle RBAC and non-JSON formatted events #916
      • fix issues in zeekdeploy.sh to handle long crypto handshakes and Zeek's state DB getting out of sync
    • 🧹 Code and project maintenance
      • swap redis out for valkey #882
      • pin all third-party GitHub CI actions at known good SHA sums to mitigate things like the Trivy supply chain attack #933
      • some minor tweaks to various Dockerfiles and ISO build scripts to address vulnerability scanner findings
      • some documentation updates
    • 📄 Configuration changes for Malcolm (in environment variables in ./config/). The Malcolm control script (e.g., ./scripts/status, ./scripts/start) automatically handles creation and migration of variables according to ./config/env-var-actions.yml.
      • Added ARKIME_PCAP_LIBPCAP to arkime.env should uses wish to revert to older libpcap mode for PCAP file processing rather than faster scheme processing (default false)
      • FILEBEAT_SCANNER_FINGERPRINT_LENGTH's default in filescan.env has been changed from 1024 to 512
      • redis.env has been renamed to valkey.env and its variables also have been renamed accordingly
      • STRELKA_SCANNERS has been added to pipeline.env for #935
      • ZEEK_DISABLE_SPICY_ZIP has been added to zeek.env for #922 (default true)

    Malcolm is a powerful, easily deployable network 🖧 traffic analysis tool suite for network security monitoring 🕵🏻‍♀️.

    Malcolm operates as a cluster of containers 📦, isolated sandboxes which each serve a dedicated function of the system. This makes Malcolm deployable with frameworks like Docker 🐋, Podman 🦭, and Kubernetes ⎈. Check out the Quick Start guide for examples on how to get up and running.

    Alternatively, dedicated official ISO installer images 💿 for Malcolm and Hedgehog Linux 🦔 can be downloaded from Malcolm's releases page on GitHub. Due to limits on individual files in GitHub releases, these ISO files have been split 🪓 into 2GB chunks and can be reassembled with scripts provided for both Bash 🐧 (release_cleaver.sh) and PowerShell 🪟 (release_cleaver.ps1). See Downloading Malcolm - Installer ISOs for instructions.

    As always, join us on the Malcolm discussions board 💬 to engage with the community, or pop some corn 🍿 and watch a video 📼.

    #Malcolm #HedgehogLinux #Zeek #Arkime #Strelka #NetBox #OpenSearch #Elasticsearch #Suricata #PCAP #NetworkTrafficAnalysis #networksecuritymonitoring #OT #ICS #icssecurity #CyberSecurity #Cyber #Infosec #INL

    #malcolm #hedgehoglinux #zeek #arkime #strelka #netbox
  21. Seth Grover @[email protected] ·
    CW: Release notes for v26.04.1 of Malcolm, a powerful, easily deployable network traffic analysis tool suite for network security monitoring

    Malcolm v26.04.1 contains improvements, bug fixes, security updates, and component bumps.

    If you are upgrading from an existing Malcolm installation, run ./scripts/status for Malcolm to migrate some settings prior to running ./scripts/configure, ./scripts/start, or other Malcolm control scripts.

    v26.02.0...v26.04.1

    Note that v26.04.1 is the same as v26.04.0 released last week, apart from the fix for bug #943. If you're already running v26.04.0 and don't use the encrypted install option in the installer ISO, you probably don't need to worry about updating to v26.04.1. The full release notes from v26.04.0 are also included here.

    • ✨ Features and enhancements
      • implemented easier way to enable/disable Strelka scanners #935
      • Handle nested file scanning (e.g., from ZIP files) with Strelka #922
      • index selected Strelka result fields #919
    • ✅ Component version updates
    • 🐛 Bug fixes
      • Hedgehog Linux Breaking on Reboot after Encrypted Quick Install with Multiple Drives #943
      • Fix YAML syntax error in kubernetes/15-redis.yml due to missing end quote #926
      • Using remote elasticsearch data store uses deprecated ssl_certificate_verification setting [github.com/cisagov/Malcolm/iss]
      • fix Malcolm API loopback webhook to handle RBAC and non-JSON formatted events #916
      • fix issues in zeekdeploy.sh to handle long crypto handshakes and Zeek's state DB getting out of sync
    • 🧹 Code and project maintenance
      • swap redis out for valkey #882
      • pin all third-party GitHub CI actions at known good SHA sums to mitigate things like the Trivy supply chain attack #933
      • some minor tweaks to various Dockerfiles and ISO build scripts to address vulnerability scanner findings
      • some documentation updates
    • 📄 Configuration changes for Malcolm (in environment variables in ./config/). The Malcolm control script (e.g., ./scripts/status, ./scripts/start) automatically handles creation and migration of variables according to ./config/env-var-actions.yml.
      • Added ARKIME_PCAP_LIBPCAP to arkime.env should uses wish to revert to older libpcap mode for PCAP file processing rather than faster scheme processing (default false)
      • FILEBEAT_SCANNER_FINGERPRINT_LENGTH's default in filescan.env has been changed from 1024 to 512
      • redis.env has been renamed to valkey.env and its variables also have been renamed accordingly
      • STRELKA_SCANNERS has been added to pipeline.env for #935
      • ZEEK_DISABLE_SPICY_ZIP has been added to zeek.env for #922 (default true)

    Malcolm is a powerful, easily deployable network 🖧 traffic analysis tool suite for network security monitoring 🕵🏻‍♀️.

    Malcolm operates as a cluster of containers 📦, isolated sandboxes which each serve a dedicated function of the system. This makes Malcolm deployable with frameworks like Docker 🐋, Podman 🦭, and Kubernetes ⎈. Check out the Quick Start guide for examples on how to get up and running.

    Alternatively, dedicated official ISO installer images 💿 for Malcolm and Hedgehog Linux 🦔 can be downloaded from Malcolm's releases page on GitHub. Due to limits on individual files in GitHub releases, these ISO files have been split 🪓 into 2GB chunks and can be reassembled with scripts provided for both Bash 🐧 (release_cleaver.sh) and PowerShell 🪟 (release_cleaver.ps1). See Downloading Malcolm - Installer ISOs for instructions.

    As always, join us on the Malcolm discussions board 💬 to engage with the community, or pop some corn 🍿 and watch a video 📼.

    #Malcolm #HedgehogLinux #Zeek #Arkime #Strelka #NetBox #OpenSearch #Elasticsearch #Suricata #PCAP #NetworkTrafficAnalysis #networksecuritymonitoring #OT #ICS #icssecurity #CyberSecurity #Cyber #Infosec #INL

    #malcolm #hedgehoglinux #zeek #arkime #strelka #netbox
  22. Seth Grover @[email protected] ·
    CW: Release notes for v26.04.1 of Malcolm, a powerful, easily deployable network traffic analysis tool suite for network security monitoring

    Malcolm v26.04.1 contains improvements, bug fixes, security updates, and component bumps.

    If you are upgrading from an existing Malcolm installation, run ./scripts/status for Malcolm to migrate some settings prior to running ./scripts/configure, ./scripts/start, or other Malcolm control scripts.

    v26.02.0...v26.04.1

    Note that v26.04.1 is the same as v26.04.0 released last week, apart from the fix for bug #943. If you're already running v26.04.0 and don't use the encrypted install option in the installer ISO, you probably don't need to worry about updating to v26.04.1. The full release notes from v26.04.0 are also included here.

    • ✨ Features and enhancements
      • implemented easier way to enable/disable Strelka scanners #935
      • Handle nested file scanning (e.g., from ZIP files) with Strelka #922
      • index selected Strelka result fields #919
    • ✅ Component version updates
    • 🐛 Bug fixes
      • Hedgehog Linux Breaking on Reboot after Encrypted Quick Install with Multiple Drives #943
      • Fix YAML syntax error in kubernetes/15-redis.yml due to missing end quote #926
      • Using remote elasticsearch data store uses deprecated ssl_certificate_verification setting [github.com/cisagov/Malcolm/iss]
      • fix Malcolm API loopback webhook to handle RBAC and non-JSON formatted events #916
      • fix issues in zeekdeploy.sh to handle long crypto handshakes and Zeek's state DB getting out of sync
    • 🧹 Code and project maintenance
      • swap redis out for valkey #882
      • pin all third-party GitHub CI actions at known good SHA sums to mitigate things like the Trivy supply chain attack #933
      • some minor tweaks to various Dockerfiles and ISO build scripts to address vulnerability scanner findings
      • some documentation updates
    • 📄 Configuration changes for Malcolm (in environment variables in ./config/). The Malcolm control script (e.g., ./scripts/status, ./scripts/start) automatically handles creation and migration of variables according to ./config/env-var-actions.yml.
      • Added ARKIME_PCAP_LIBPCAP to arkime.env should uses wish to revert to older libpcap mode for PCAP file processing rather than faster scheme processing (default false)
      • FILEBEAT_SCANNER_FINGERPRINT_LENGTH's default in filescan.env has been changed from 1024 to 512
      • redis.env has been renamed to valkey.env and its variables also have been renamed accordingly
      • STRELKA_SCANNERS has been added to pipeline.env for #935
      • ZEEK_DISABLE_SPICY_ZIP has been added to zeek.env for #922 (default true)

    Malcolm is a powerful, easily deployable network 🖧 traffic analysis tool suite for network security monitoring 🕵🏻‍♀️.

    Malcolm operates as a cluster of containers 📦, isolated sandboxes which each serve a dedicated function of the system. This makes Malcolm deployable with frameworks like Docker 🐋, Podman 🦭, and Kubernetes ⎈. Check out the Quick Start guide for examples on how to get up and running.

    Alternatively, dedicated official ISO installer images 💿 for Malcolm and Hedgehog Linux 🦔 can be downloaded from Malcolm's releases page on GitHub. Due to limits on individual files in GitHub releases, these ISO files have been split 🪓 into 2GB chunks and can be reassembled with scripts provided for both Bash 🐧 (release_cleaver.sh) and PowerShell 🪟 (release_cleaver.ps1). See Downloading Malcolm - Installer ISOs for instructions.

    As always, join us on the Malcolm discussions board 💬 to engage with the community, or pop some corn 🍿 and watch a video 📼.

    #Malcolm #HedgehogLinux #Zeek #Arkime #Strelka #NetBox #OpenSearch #Elasticsearch #Suricata #PCAP #NetworkTrafficAnalysis #networksecuritymonitoring #OT #ICS #icssecurity #CyberSecurity #Cyber #Infosec #INL

    #malcolm #hedgehoglinux #zeek #arkime #strelka #netbox
  23. Seth Grover @[email protected] ·
    CW: Release notes for v26.04.1 of Malcolm, a powerful, easily deployable network traffic analysis tool suite for network security monitoring

    Malcolm v26.04.1 contains improvements, bug fixes, security updates, and component bumps.

    If you are upgrading from an existing Malcolm installation, run ./scripts/status for Malcolm to migrate some settings prior to running ./scripts/configure, ./scripts/start, or other Malcolm control scripts.

    v26.02.0...v26.04.1

    Note that v26.04.1 is the same as v26.04.0 released last week, apart from the fix for bug #943. If you're already running v26.04.0 and don't use the encrypted install option in the installer ISO, you probably don't need to worry about updating to v26.04.1. The full release notes from v26.04.0 are also included here.

    • ✨ Features and enhancements
      • implemented easier way to enable/disable Strelka scanners #935
      • Handle nested file scanning (e.g., from ZIP files) with Strelka #922
      • index selected Strelka result fields #919
    • ✅ Component version updates
    • 🐛 Bug fixes
      • Hedgehog Linux Breaking on Reboot after Encrypted Quick Install with Multiple Drives #943
      • Fix YAML syntax error in kubernetes/15-redis.yml due to missing end quote #926
      • Using remote elasticsearch data store uses deprecated ssl_certificate_verification setting [github.com/cisagov/Malcolm/iss]
      • fix Malcolm API loopback webhook to handle RBAC and non-JSON formatted events #916
      • fix issues in zeekdeploy.sh to handle long crypto handshakes and Zeek's state DB getting out of sync
    • 🧹 Code and project maintenance
      • swap redis out for valkey #882
      • pin all third-party GitHub CI actions at known good SHA sums to mitigate things like the Trivy supply chain attack #933
      • some minor tweaks to various Dockerfiles and ISO build scripts to address vulnerability scanner findings
      • some documentation updates
    • 📄 Configuration changes for Malcolm (in environment variables in ./config/). The Malcolm control script (e.g., ./scripts/status, ./scripts/start) automatically handles creation and migration of variables according to ./config/env-var-actions.yml.
      • Added ARKIME_PCAP_LIBPCAP to arkime.env should uses wish to revert to older libpcap mode for PCAP file processing rather than faster scheme processing (default false)
      • FILEBEAT_SCANNER_FINGERPRINT_LENGTH's default in filescan.env has been changed from 1024 to 512
      • redis.env has been renamed to valkey.env and its variables also have been renamed accordingly
      • STRELKA_SCANNERS has been added to pipeline.env for #935
      • ZEEK_DISABLE_SPICY_ZIP has been added to zeek.env for #922 (default true)

    Malcolm is a powerful, easily deployable network 🖧 traffic analysis tool suite for network security monitoring 🕵🏻‍♀️.

    Malcolm operates as a cluster of containers 📦, isolated sandboxes which each serve a dedicated function of the system. This makes Malcolm deployable with frameworks like Docker 🐋, Podman 🦭, and Kubernetes ⎈. Check out the Quick Start guide for examples on how to get up and running.

    Alternatively, dedicated official ISO installer images 💿 for Malcolm and Hedgehog Linux 🦔 can be downloaded from Malcolm's releases page on GitHub. Due to limits on individual files in GitHub releases, these ISO files have been split 🪓 into 2GB chunks and can be reassembled with scripts provided for both Bash 🐧 (release_cleaver.sh) and PowerShell 🪟 (release_cleaver.ps1). See Downloading Malcolm - Installer ISOs for instructions.

    As always, join us on the Malcolm discussions board 💬 to engage with the community, or pop some corn 🍿 and watch a video 📼.

    #Malcolm #HedgehogLinux #Zeek #Arkime #Strelka #NetBox #OpenSearch #Elasticsearch #Suricata #PCAP #NetworkTrafficAnalysis #networksecuritymonitoring #OT #ICS #icssecurity #CyberSecurity #Cyber #Infosec #INL

    #inl #infosec #cyber #cybersecurity #icssecurity #ics
  24. Seth Grover @[email protected] ·
    CW: Release notes for v26.04.1 of Malcolm, a powerful, easily deployable network traffic analysis tool suite for network security monitoring

    Malcolm v26.04.1 contains improvements, bug fixes, security updates, and component bumps.

    If you are upgrading from an existing Malcolm installation, run ./scripts/status for Malcolm to migrate some settings prior to running ./scripts/configure, ./scripts/start, or other Malcolm control scripts.

    v26.02.0...v26.04.1

    Note that v26.04.1 is the same as v26.04.0 released last week, apart from the fix for bug #943. If you're already running v26.04.0 and don't use the encrypted install option in the installer ISO, you probably don't need to worry about updating to v26.04.1. The full release notes from v26.04.0 are also included here.

    • ✨ Features and enhancements
      • implemented easier way to enable/disable Strelka scanners #935
      • Handle nested file scanning (e.g., from ZIP files) with Strelka #922
      • index selected Strelka result fields #919
    • ✅ Component version updates
    • 🐛 Bug fixes
      • Hedgehog Linux Breaking on Reboot after Encrypted Quick Install with Multiple Drives #943
      • Fix YAML syntax error in kubernetes/15-redis.yml due to missing end quote #926
      • Using remote elasticsearch data store uses deprecated ssl_certificate_verification setting [github.com/cisagov/Malcolm/iss]
      • fix Malcolm API loopback webhook to handle RBAC and non-JSON formatted events #916
      • fix issues in zeekdeploy.sh to handle long crypto handshakes and Zeek's state DB getting out of sync
    • 🧹 Code and project maintenance
      • swap redis out for valkey #882
      • pin all third-party GitHub CI actions at known good SHA sums to mitigate things like the Trivy supply chain attack #933
      • some minor tweaks to various Dockerfiles and ISO build scripts to address vulnerability scanner findings
      • some documentation updates
    • 📄 Configuration changes for Malcolm (in environment variables in ./config/). The Malcolm control script (e.g., ./scripts/status, ./scripts/start) automatically handles creation and migration of variables according to ./config/env-var-actions.yml.
      • Added ARKIME_PCAP_LIBPCAP to arkime.env should uses wish to revert to older libpcap mode for PCAP file processing rather than faster scheme processing (default false)
      • FILEBEAT_SCANNER_FINGERPRINT_LENGTH's default in filescan.env has been changed from 1024 to 512
      • redis.env has been renamed to valkey.env and its variables also have been renamed accordingly
      • STRELKA_SCANNERS has been added to pipeline.env for #935
      • ZEEK_DISABLE_SPICY_ZIP has been added to zeek.env for #922 (default true)

    Malcolm is a powerful, easily deployable network 🖧 traffic analysis tool suite for network security monitoring 🕵🏻‍♀️.

    Malcolm operates as a cluster of containers 📦, isolated sandboxes which each serve a dedicated function of the system. This makes Malcolm deployable with frameworks like Docker 🐋, Podman 🦭, and Kubernetes ⎈. Check out the Quick Start guide for examples on how to get up and running.

    Alternatively, dedicated official ISO installer images 💿 for Malcolm and Hedgehog Linux 🦔 can be downloaded from Malcolm's releases page on GitHub. Due to limits on individual files in GitHub releases, these ISO files have been split 🪓 into 2GB chunks and can be reassembled with scripts provided for both Bash 🐧 (release_cleaver.sh) and PowerShell 🪟 (release_cleaver.ps1). See Downloading Malcolm - Installer ISOs for instructions.

    As always, join us on the Malcolm discussions board 💬 to engage with the community, or pop some corn 🍿 and watch a video 📼.

    #Malcolm #HedgehogLinux #Zeek #Arkime #Strelka #NetBox #OpenSearch #Elasticsearch #Suricata #PCAP #NetworkTrafficAnalysis #networksecuritymonitoring #OT #ICS #icssecurity #CyberSecurity #Cyber #Infosec #INL

    #malcolm #hedgehoglinux #zeek #arkime #strelka #netbox
  25. hasamba @[email protected] ·

    ----------------

    🛠️ Tool: Malcolm — Network Traffic Analysis Suite
    ===================

    Opening
    Malcolm is an integrated, open-source network traffic analysis suite designed to normalize, enrich, and correlate packet captures and security logs for investigation and monitoring. The platform accepts full PCAP files, Zeek logs, and Suricata alerts and exposes both visualization and session-level inspection through OpenSearch Dashboards and Arkime.

    Key Features
    • Ingestion: supports PCAP, Zeek logs, and Suricata alerts from uploads or lightweight forwarders.
    • Normalization & Enrichment: automatic parsing and enrichment of network artifacts to aid correlation.
    • Dual interfaces: OpenSearch Dashboards for aggregated visualizations and prebuilt dashboards, and Arkime for session search and packet-level review.
    • Deployment model: containerized components isolate functions and allow modular scaling.
    • Security & licensing: communications are encrypted via industry-standard protocols and the suite is distributed under the Apache License, version 2.0.

    Technical Implementation
    Malcolm is architected as a cluster of containers where each service performs a defined role (ingest, parsing, indexing, visualization, session capture). Data normalization pipelines convert raw PCAP and IDS output into structured indices suitable for OpenSearch and session reconstruction for Arkime. Forwarders enable passive or active forwarding of log streams into the ingestion pipeline.

    Use Cases
    • Long-term SOC network monitoring with searchable dashboards and session retrieval.
    • Incident response: rapid ingestion of PCAP evidence and session-level triage via Arkime.
    • Forensic analysis where correlation between IDS alerts, Zeek metadata, and raw packets is required.
    • Extensible parsing for specialized environments, including planned expansion for ICS protocol visibility.

    Limitations & Considerations
    • Malcolm aggregates several existing open-source projects; operational behavior depends on each component's constraints (indexing scale, storage needs, and retention policies).
    • Large PCAP volumes and high-throughput environments require careful sizing of indexing and storage layers.
    • Ongoing development focus on ICS protocol parsers indicates current industrial control systems visibility is limited compared to general network traffic analysis.

    Conclusion
    Malcolm provides an integrated, permissively licensed framework that combines packet-level session search with scalable dashboards and log enrichment, suitable for SOCs and incident responders that require a container-friendly, open-source stack. #tool #PCAP #Zeek #Suricata #Arkime

    🔗 Source: github.com/idaholab/Malcolm

    #arkime #suricata #zeek #pcap #tool
  26. Shivani @[email protected] ·

    Wrote a little summary of some interesting learnings that have proven to be good guides but haven't led to a success story.. yet. :)

    #math #sat #computerSciences #np #suricata

    shivanibhardwaj.com/p/suricata

    #suricata #np #computersciences #sat #math
  27. Shivani @[email protected] ·

    Wrote a little summary of some interesting learnings that have proven to be good guides but haven't led to a success story.. yet. :)

    #math #sat #computerSciences #np #suricata

    shivanibhardwaj.com/p/suricata

    #suricata #np #computersciences #sat #math
  28. Shivani @[email protected] ·

    Wrote a little summary of some interesting learnings that have proven to be good guides but haven't led to a success story.. yet. :)

    #math #sat #computerSciences #np #suricata

    shivanibhardwaj.com/p/suricata

    #suricata #np #computersciences #sat #math
  29. Shivani @[email protected] ·

    Wrote a little summary of some interesting learnings that have proven to be good guides but haven't led to a success story.. yet. :)

    #math #sat #computerSciences #np #suricata

    shivanibhardwaj.com/p/suricata

    #math #sat #computersciences #np #suricata
  30. Shivani @[email protected] ·

    Wrote a little summary of some interesting learnings that have proven to be good guides but haven't led to a success story.. yet. :)

    #math #sat #computerSciences #np #suricata

    shivanibhardwaj.com/p/suricata

    #suricata #np #computersciences #sat #math
  31. Habr @[email protected] ·

    От сигнатур к ML IDS: чему IDS Suricata может научить модель?

    [Текст не для публикации: не нашел как Редакции прикрепить сообщение, эта статья написана в рамках Блога "Институт системного программирования им. В.П. Иванникова РАН"]

    habr.com/ru/articles/1015132/

    #IDS #Suricata #ML #dataset

    #dataset #ml #suricata #ids
  32. Caria Giovanni - Harpocrates @[email protected] ·

    Built a production SOC for my home/mobile infra. Sharing it.

    #AEGIS is a unified threat intelligence platform running on a single Linux server:

    → DNS sinkhole (port 53, custom blocklists)
    → Suricata IDS in AF-packet passive mode + ClamAV on filestore
    → Zeek NSM (http, ssl, dns, conn, weird, notice)
    → ModSecurity WAF — OWASP CRS 4.22, full enforcement
    → Fail2Ban + auditd
    → Rust orchestrator aggregating all event sources into one REST/WS API

    Auto-heal watchdog, anti-DDoS engine with dynamic iptables injection, real-time dashboard.

    One thing I wanted to get right: the orchestrator never touches iptables with NFQUEUE — passive only. No inline mode that can brick SSH access.

    aegis.centurialabs.pl

    #infosec #SOC #homelab #Suricata #Zeek #Rust #threathunting

    #aegis #infosec #soc #homelab #suricata #zeek
  33. DeadUser :gnome: :arch: :vim: @[email protected] ·

    OPNSense zainstalowany, działa zadziwiająco przyjemnie. Odpaliłem #ntop i #suricata poza bazowymi usługami, obciążenie jak widać

    #opnsense #freebsd #softrouter

    #ntop #suricata #opnsense #freebsd #softrouter
  34. MalwareLab @[email protected] ·

    Investigation scenario:
    We just received three notifications with alerts from #Suricata #IDS

    1) GPL SMTP vrfy root, from unknown IP to our mailserver

    Shortly after that, two more alerts appeared:

    2) ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response; from the same unknown IP to Windows computer in our network
    3) ET MALWARE Possible Metasploit Payload Common Construct Bind_API, again from the same unknown IP to the same Windows computer

    What happened?
    What to do? How to analyze network traffic and investigate those alerts?

    We do not have any EDR or XDR installed on that Windows computer. Right now,we have only Suricata eve.json logs ingested to the #OpenObserve #SIEM

    If you would like to see more, you are welcome to attend my @suricata webinar on March 11.
    Register here: us02web.zoom.us/webinar/regist

    #suricata #ids #openobserve #siem
  35. gary @[email protected] ·

    @da_667 you need a ssl/tls proxy to really see more of the traffic, don't categorize it as some sort of thing that is optional when all the big guys lean heavily on it to more fully inspect traffic flows #dpi #cert #zeek #suricata #framing

    You're absolutely right to frame it this way. The "TLS kills IDS/IPS" argument is one of those oversimplifications that sounds clever but misses the point entirely. Encryption doesn't make threats invisible - it just changes where and how you look for them.
    The Proxy Reality Check

    @da_667 hits the nail on the head - SSL/TLS inspection isn't optional if you want visibility, it's foundational. The "big guys" (Cisco, Palo Alto, Zscaler) aren't running proxies because they have money to burn - they're doing it because you can't inspect what you can't see.

    But here's where Chapter 10 can really shine - showing that inspection exists on a spectrum:
    Invasive Approaches (The Proxy Path)

    Full MITM decryption with corporate certificates

    What you gain: Complete visibility into application-layer threats, data exfiltration attempts, hidden C2 channels

    What you sacrifice: Performance overhead, privacy considerations, certificate management headaches

    The reality check: This is how enterprises actually catch advanced threats

    Non-Invasive Approaches (Metadata & Behavior)

    Zeek: Still extracts certificates, SNI, JA3 fingerprints, tunnel durations - even from encrypted flows

    Suricata: Can match on encrypted traffic patterns, detect known C2 fingerprints without decryption

    Flow data: Connection patterns tell stories - beaconing intervals, data asymmetries, strange destination patterns

    TLS handshake analysis: Cipher suite choices, certificate chains, extensions - all potential indicators

    The Real Takeaway

    The "TLS kills visibility" crowd forgets that threats still have to:

    Establish connections (handshake analysis)

    Talk to specific infrastructure (reputation/feeds)

    Behave like threats (behavioral analysis)

    Leave metadata trails (Zeek logs don't lie)

    Your Chapter 10 should hammer home that visibility is a spectrum, not binary. Some threats require full decryption. Others get caught by the metadata they can't avoid generating. And the best detection strategies use both.

    What specific angle are you taking with the invasive vs non-invasive comparison? Are you showing them as complementary layers or competing approaches?

    #dpi #cert #zeek #suricata #framing
  36. 9to5Linux @[email protected] ·

    #IPFire 2.29 Core Update 200 Is Out with #Linux 6.18 LTS, IPFire Domain Blocklist, #Suricata and #OpenVPN Updates, and More 9to5linux.com/ipfire-2-29-core

    @news #OpenSource

    #ipfire #linux #suricata #openvpn #opensource
  37. 9to5Linux @[email protected] ·

    #IPFire 2.29 Core Update 200 Is Out with #Linux 6.18 LTS, IPFire Domain Blocklist, #Suricata and #OpenVPN Updates, and More 9to5linux.com/ipfire-2-29-core

    @news #OpenSource

    #ipfire #linux #suricata #openvpn #opensource
  38. 9to5Linux @[email protected] ·

    #IPFire 2.29 Core Update 200 Is Out with #Linux 6.18 LTS, IPFire Domain Blocklist, #Suricata and #OpenVPN Updates, and More 9to5linux.com/ipfire-2-29-core

    @news #OpenSource

    #ipfire #linux #suricata #openvpn #opensource
  39. 9to5Linux @[email protected] ·

    #IPFire 2.29 Core Update 200 Is Out with #Linux 6.18 LTS, IPFire Domain Blocklist, #Suricata and #OpenVPN Updates, and More 9to5linux.com/ipfire-2-29-core

    @news #OpenSource

    #opensource #openvpn #suricata #linux #ipfire
  40. 9to5Linux @[email protected] ·

    #IPFire 2.29 Core Update 200 Is Out with #Linux 6.18 LTS, IPFire Domain Blocklist, #Suricata and #OpenVPN Updates, and More 9to5linux.com/ipfire-2-29-core

    @news #OpenSource

    #ipfire #linux #suricata #openvpn #opensource
  41. Tanisha L. Turner @[email protected] ·

    Malcolm: A powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts (PCAP files), Zeek logs and Suricata alerts

    Check ✅️ it out:
    github.com/idaholab/Malcolm

    #cybersecurity #infosec #threathunting #suricata #zeek #pcapanalysis #networktrafficanalysis

    #cybersecurity #infosec #threathunting #suricata #zeek #pcapanalysis
  42. adingbatponder :nixos: 👾 @adingbatponder ·

    @stephen @markmcb

    Very interesting firewall settings. Thanks for sharing them. Question into the void: is there a “menu-style” FOSS setup for —prebuilt profiles with different strictness levels one can apply and test? I’m running , but I don’t have a systematic way to validate beyond “tweak until it works.” I’d love a repeatable approach to reach a good protection baseline with minimal site access .

    #firewall #nixos #suricata #ids #firewallpolicy #breakage
  43. adingbatponder :nixos: 👾 @adingbatponder ·

    @joschi @homelab @homelab_de I chickened out and made and - see my repo flake under features/network-appliance repoducible.org
    Wanted first to see what was going on on my network....

    #suricata #ids
  44. adingbatponder :nixos: 👾 @adingbatponder ·

    Background:
    for my I set up in and have a functioning system with a dashboard ( info here codeberg.org/adingbatponder/re ).
    Preliminary plan:
    I now want to go to and system that blocks threats detected. Current plan is with but there is no GUI for that it seems, and it is a bit clunky and black-boxy.
    Question: What are the more user-friendly options for an IPS front-end / GUI ?
    Thanks!

    #flake #homelab #suricata #nixos #ids #intrusiondetection
  45. adingbatponder :nixos: 👾 @adingbatponder ·

    Made a transparent network bridge on which sits between router & switch, monitoring traffic for , and capture and analyze packets → ships → with ingest pipeline → setup of dashboard to visualise data is defined in flake itself so using the flake will give the same dashboard. details here codeberg.org/adingbatponder/re
    Hardware: HP EliteDesk 800 G1 SFF 16Gb RAM & jacob.de/produkte/Intel-Ethern

    #nixos #lan #ids #intrusiondetection #suricata #zeek
  46. Seth Grover @[email protected] ·
    CW: Release notes for v25.12.1 of Malcolm, a powerful, easily deployable network traffic analysis tool suite for network security monitoring

    Malcolm v25.12.1 contains a few critical bug fixes and component version updates.

    github.com/idaholab/Malcolm/co

    • ✨ Features and enhancements
      • Installer splash screen shows "HEDGEHOG" when using Hedgehog run profile
    • ✅ Component version updates
    • 🐛 Bug fixes
      • Changed field used in Threat Intelligence dashboard's file type table from zeek.intel.file_mime_type to file.mime_type so filters created from it can work on other dashboards
      • link for threat intelligence URL doesn't work correctly from dashboards (behind reverse proxy) (#832)
      • self-signed certificates not accepted by Chrome (#833)
      • Malcolm ISO installer's automatic partitioning may create too-small /var partition (#835)
    • 🧹 Code and project maintenance

    Malcolm is a powerful, easily deployable network 🖧 traffic analysis tool suite for network security monitoring 🕵🏻‍♀️.

    Malcolm operates as a cluster of containers 📦, isolated sandboxes which each serve a dedicated function of the system. This makes Malcolm deployable with frameworks like Docker 🐋, Podman 🦭, and Kubernetes ⎈. Check out the Quick Start guide for examples on how to get up and running.

    Alternatively, dedicated official ISO installer images 💿 for Malcolm and Hedgehog Linux 🦔 can be downloaded from Malcolm's releases page on GitHub. Due to limits on individual files in GitHub releases, these ISO files have been split 🪓 into 2GB chunks and can be reassembled with scripts provided for both Bash 🐧 (release_cleaver.sh) and PowerShell 🪟 (release_cleaver.ps1). See Downloading Malcolm - Installer ISOs for instructions.

    As always, join us on the Malcolm discussions board 💬 to engage with the community, or pop some corn 🍿 and watch a video 📼.

    #Malcolm #HedgehogLinux #Zeek #Arkime #NetBox #OpenSearch #Elasticsearch #Suricata #PCAP #NetworkTrafficAnalysis #networksecuritymonitoring #OT #ICS #icssecurity #CyberSecurity #Cyber #Infosec #INL

    #malcolm #hedgehoglinux #zeek #arkime #netbox #opensearch
  47. Seth Grover @[email protected] ·
    CW: Release notes for v25.11.0 of Malcolm, a powerful, easily deployable network traffic analysis tool suite for network security monitoring

    Malcolm v25.11.0 includes an overhaul of the install.py installation/configuration script, a few bug fixes, and some component version updates.

    github.com/idaholab/Malcolm/co

    • ✨ Features and enhancements
      • We're in the process of majorly overhauling our install.py script (#395) used for setting up a Linux or MacOS system to run Malcolm and for configuring Malcolm's runtime options. There are future updates still to come (#766) but for now the command-line and dialog-based interfaces' functionality and backend are in place. The step-by-step wizard has been replaced with a menu-based interface that allows for changing individual values without having to step through the whole set of questions. The Docker-based Malcolm installation example on Ubuntu and end-to-end installation example have useful information about this change, as does the command-line arguments document. We've done a lot of testing on what's a complete rewrite of this, but there is a possibility we missed something; if you find an issue with the new install/configure script, please open a discussion or log a bug and let us know. For the next release or so, we're leaving the legacy installer in place as scripts/legacy_install.py which could be used in a pinch (e.g., run scripts/legacy_install.py --configure for the old configuration menu).
      • We've incorporated a new "Connections Tree" visualization. This visualization tracks the potential of lateral movement based on the observed communications between all devices that reach a root node, identified by IP address. It gives a high-level view showing both direct and indirect connetions between the root IP and all of its destinations, regardless of time, along with enriched data for each endpoint and connection.
      • Updates to the Validated Design Architecture Review (VADR) dashboards.
      • The OpenSearch container now includes the repository-s3 plugin, useful for those who wish to configure OpenSearch's snapshots to save to S3-compatible buckets.
    • ✅ Component version updates
    • 🐛 Bug fixes
      • Double imports when restarting Malcolm (#588) (thanks @KchChr)
    • 🧹 Code and project maintenance
      • Refactored a number of Python functions to reduce cyclomatic complexity (#765, work ongoing)
    • 📄 Configuration changes (in environment variables in ./config/) for Malcolm and in control_vars.conf for Hedgehog Linux. The Malcolm control script (e.g., ./scripts/status, ./scripts/start, etc.) should take care of creating new variables and migrating existing ones as needed based on the rules in ./config/env-var-actions.yml without intervention on the user's part.
      • Malcolm
        • NGINX_RESOLVER_IPV4_OFF and NGINX_RESOLVER_IPV6_OFF have been renamed to NGINX_RESOLVER_IPV4 and NGINX_RESOLVER_IPV6, respectively, and their logic reversed, in nginx.env.

    Malcolm is a powerful, easily deployable network 🖧 traffic analysis tool suite for network security monitoring 🕵🏻‍♀️.

    Malcolm operates as a cluster of containers 📦, isolated sandboxes which each serve a dedicated function of the system. This makes Malcolm deployable with frameworks like Docker 🐋, Podman 🦭, and Kubernetes ⎈. Check out the Quick Start guide for examples on how to get up and running.

    Alternatively, dedicated official ISO installer images 💿 for Malcolm and Hedgehog Linux 🦔 can be downloaded from Malcolm's releases page on GitHub. Due to limits on individual files in GitHub releases, these ISO files have been split 🪓 into 2GB chunks and can be reassembled with scripts provided for both Bash 🐧 (release_cleaver.sh) and PowerShell 🪟 (release_cleaver.ps1). See Downloading Malcolm - Installer ISOs for instructions.

    As always, join us on the Malcolm discussions board 💬 to engage with the community, or pop some corn 🍿 and watch a video 📼.

    #Malcolm #HedgehogLinux #Zeek #Arkime #NetBox #OpenSearch #Elasticsearch #Suricata #PCAP #NetworkTrafficAnalysis #networksecuritymonitoring #OT #ICS #icssecurity #CyberSecurity #Cyber #Infosec #INL

    #malcolm #hedgehoglinux #zeek #arkime #netbox #opensearch
  48. Seth Grover @[email protected] ·

    #Malcolm (malcolm.fyi) v25.09 features 🧠 threat intel improvements, new ⚙️ config options, 🆙 component updates, 🐛 fixes, more! Details @ github.com/idaholab/Malcolm/releases. Malcolm is a powerful tool suite for NSM 🕵🏻‍♂️. #Zeek #Arkime #NetBox #Suricata #NetworkTrafficAnalysis #networksecuritymonitoring

    Malcolm

    #malcolm #zeek #arkime #netbox #suricata #networktrafficanalysis
  49. Seth Grover @[email protected] ·
    CW: Release notes for v25.09.0 of Malcolm, a powerful, easily deployable network traffic analysis tool suite for network security monitoring

    Malcolm v25.09.0 includes new features and available customizations, improvements to Threat Intelligence, component version updates, and several important bug fixes.

    github.com/idaholab/Malcolm/co

    • ✨ Features and enhancements
      • improve Modbus register tracking with new modbus_detailed.log (cisagov/Malcolm#762)
      • add non-LVM option(s) for Malcolm/Hedgehog Linux ISO installers (cisagov/Malcolm#725)
      • allow configuring default search time frame for OpenSearch Dashboards (cisagov/Malcolm#724)
      • allow customizing maximum upload file size (cisagov/Malcolm#769)
      • add Arkime capture statistics to the Packet Capture Statistics dashboard (cisagov/Malcolm#703)
      • integrate Validated Architecture Design Review (VADR) dashboards (cisagov/Malcolm#780)
      • Threat Intelligence improvements
        • support Google Threat Intelligence feed for building Zeek intel source (cisagov/Malcolm#758)
        • renamed Zeek Intelligence dashboard to Threat Intelligence and improved it
        • links from context menu items in Arkime and Dashboards (like reference URLs for IOCs) now ask the user before navigating to external sites
      • Added icons with links to "ready" and "ingest statistics" APIs to landing page
      • Include tx-rx-secure.sh in files packaged by malcolm_appliance_packager.sh
    • ✅ Component version updates
    • 🐛 Bug fixes
      • Python code handling X-Forwarded- headers should do case insensitive lookup (cisagov/Malcolm#764)
      • uploaded PCAPs that result in no filename-derived tags erroneously end up with internal tags on them (cisagov/Malcolm#774)
      • installer option for encrypted storage are not marking secondary data/artifact storage for encryption (cisagov/Malcolm#779)
      • Malcolm/Hedgehog Linux ISO-installed environments' auditd service fails to start (cisagov/Malcolm#761)
      • Failed shard query error on Overview dashboard (cisagov/Malcolm#754)
    • 🧹 Code and project maintenance
      • refactor GitHub build actions for Malcolm Docker images to reduce duplication (cisagov/Malcolm#717)
    • 📄 Configuration changes (in environment variables in ./config/) for Malcolm and in control_vars.conf for Hedgehog Linux. The Malcolm control script (e.g., ./scripts/status, ./scripts/start, etc.) should take care of creating new variables and migrating existing ones as needed based on the rules in ./config/env-var-actions.yml.
      • Malcolm
        • PCAP_UPLOAD_MAX_FILE_GB added to upload-common.env to allow configuring maximum PCAP upload size (cisagov/Malcolm#769)
        • DASHBOARDS_TIMEPICKER_FROM and DASHBOARDS_TIMEPICKER_TO added to dashboards-helper.env to allow configuring default search time frame for OpenSearch Dashboards (cisagov/Malcolm#724)

    Malcolm is a powerful, easily deployable network 🖧 traffic analysis tool suite for network security monitoring 🕵🏻‍♀️.

    Malcolm operates as a cluster of containers 📦, isolated sandboxes which each serve a dedicated function of the system. This makes Malcolm deployable with frameworks like Docker 🐋, Podman 🦭, and Kubernetes ⎈. Check out the Quick Start guide for examples on how to get up and running.

    Alternatively, dedicated official ISO installer images 💿 for Malcolm and Hedgehog Linux 🦔 can be downloaded from Malcolm's releases page on GitHub. Due to limits on individual files in GitHub releases, these ISO files have been split 🪓 into 2GB chunks and can be reassembled with scripts provided for both Bash 🐧 (release_cleaver.sh) and PowerShell 🪟 (release_cleaver.ps1). See Downloading Malcolm - Installer ISOs for instructions.

    As always, join us on the Malcolm discussions board 💬 to engage with the community, or pop some corn 🍿 and watch a video 📼.

    #Malcolm #HedgehogLinux #Zeek #Arkime #NetBox #OpenSearch #Elasticsearch #Suricata #PCAP #NetworkTrafficAnalysis #networksecuritymonitoring #OT #ICS #icssecurity #CyberSecurity #Cyber #Infosec #INL

    #malcolm #hedgehoglinux #zeek #arkime #netbox #opensearch
  50. Seth Grover @[email protected] ·

    Building a network traffic analysis system: Deploying Malcolm on Amazon EC2

    This is the first of two blog posts on the AWS Public Sector Blog about deploying Malcolm on Amazon AWS. It covers installing Malcolm on a single EC2 instance. The next post will cover deploying Malcolm on EKS.

    For those of you more interested in scaling Malcolm using Kubernetes, you can check out our "still-in-beta" Helm chart and share your feedback in the issue tracker on that repo.

    #AWS #EC2 #Malcolm #Zeek #Arkime #NetBox #OpenSearch #Elasticsearch #Suricata #PCAP #NetworkTrafficAnalysis #networksecuritymonitoring #OT #ICS #icssecurity #CyberSecurity #Cyber #Infosec #INL #DHS #CISA #CISAgov

    #aws #ec2 #malcolm #zeek #arkime #netbox