#suricata — Public Fediverse posts
Live and recent posts from across the Fediverse tagged #suricata, aggregated by home.social.
-
Big week for #Suricata in Vegas 🎰
- Peter, Jeff & Lukas ran a hands-on workshop on AI SKILLs for network security monitoring @ #BSidesLV
- Broke down Suricata 8 @ #BlackHatUSA Arsenal
- Lukas Sismis won the Telecom Village CTF @ #DEFCON34And gave out all the #Suricata swag - Send us pix!
-
Big week for #Suricata in Vegas 🎰
- Peter, Jeff & Lukas ran a hands-on workshop on AI SKILLs for network security monitoring @ #BSidesLV
- Broke down Suricata 8 @ #BlackHatUSA Arsenal
- Lukas Sismis won the Telecom Village CTF @ #DEFCON34And gave out all the #Suricata swag - Send us pix!
-
Big week for #Suricata in Vegas 🎰
- Peter, Jeff & Lukas ran a hands-on workshop on AI SKILLs for network security monitoring @ #BSidesLV
- Broke down Suricata 8 @ #BlackHatUSA Arsenal
- Lukas Sismis won the Telecom Village CTF @ #DEFCON34And gave out all the #Suricata swag - Send us pix!
-
Big week for #Suricata in Vegas 🎰
- Peter, Jeff & Lukas ran a hands-on workshop on AI SKILLs for network security monitoring @ #BSidesLV
- Broke down Suricata 8 @ #BlackHatUSA Arsenal
- Lukas Sismis won the Telecom Village CTF @ #DEFCON34And gave out all the #Suricata swag - Send us pix!
-
Big week for #Suricata in Vegas 🎰
- Peter, Jeff & Lukas ran a hands-on workshop on AI SKILLs for network security monitoring @ #BSidesLV
- Broke down Suricata 8 @ #BlackHatUSA Arsenal
- Lukas Sismis won the Telecom Village CTF @ #DEFCON34And gave out all the #Suricata swag - Send us pix!
-
Join our growing lineup of sponsors for #SuriCon2026 this fall! Sponsoring SuriCon positions your organization alongside the people and amazing companies helping shape the future of threat detection and network security.
Don't miss out! suricon.net/sponsorships/
-
Join our growing lineup of sponsors for #SuriCon2026 this fall! Sponsoring SuriCon positions your organization alongside the people and amazing companies helping shape the future of threat detection and network security.
Don't miss out! suricon.net/sponsorships/
-
Join our growing lineup of sponsors for #SuriCon2026 this fall! Sponsoring SuriCon positions your organization alongside the people and amazing companies helping shape the future of threat detection and network security.
Don't miss out! suricon.net/sponsorships/
-
Join our growing lineup of sponsors for #SuriCon2026 this fall! Sponsoring SuriCon positions your organization alongside the people and amazing companies helping shape the future of threat detection and network security.
Don't miss out! suricon.net/sponsorships/
-
Join our growing lineup of sponsors for #SuriCon2026 this fall! Sponsoring SuriCon positions your organization alongside the people and amazing companies helping shape the future of threat detection and network security.
Don't miss out! suricon.net/sponsorships/
-
🛡️ Antiphishing is now officially available in @opnsense.org (@suricata IDPS)
OPNsense 26.7.2, released today, includes:
`os-intrusion-detection-content-at-antiphishing 1.0`
The plugin integrates the Antiphishing Suricata ruleset into the OPNsense ecosystem.
This is another step toward making community-driven Threat Intelligence directly consumable at the network enforcement layer.
Current ecosystem integration:
• Suricata / suricata-update
• OPNsense
• pfSense PR in progressThe project also recently added NRD-based threat intelligence for proactive phishing infrastructure detection (Suspect domains).
📖 OPNsense Quick Guide
For users who want to enable the ruleset on OPNsense 26.7.2:
Quick Guide — Installing Antiphishing on OPNsense 26.7.2
Project:
https://github.com/julioliraup/AntiphishingVector / CTI dashboard:
https://julioliraup.github.io/AT/#Suricata #OPNsense #ThreatIntelligence #CTI #DetectionEngineering #IDS #IPS #OpenSource
-
🛡️ Antiphishing is now officially available in @opnsense.org (@suricata IDPS)
OPNsense 26.7.2, released today, includes:
`os-intrusion-detection-content-at-antiphishing 1.0`
The plugin integrates the Antiphishing Suricata ruleset into the OPNsense ecosystem.
This is another step toward making community-driven Threat Intelligence directly consumable at the network enforcement layer.
Current ecosystem integration:
• Suricata / suricata-update
• OPNsense
• pfSense PR in progressThe project also recently added NRD-based threat intelligence for proactive phishing infrastructure detection (Suspect domains).
📖 OPNsense Quick Guide
For users who want to enable the ruleset on OPNsense 26.7.2:
Quick Guide — Installing Antiphishing on OPNsense 26.7.2
Project:
https://github.com/julioliraup/AntiphishingVector / CTI dashboard:
https://julioliraup.github.io/AT/#Suricata #OPNsense #ThreatIntelligence #CTI #DetectionEngineering #IDS #IPS #OpenSource
-
🛡️ Antiphishing is now officially available in @opnsense.org (@suricata IDPS)
OPNsense 26.7.2, released today, includes:
`os-intrusion-detection-content-at-antiphishing 1.0`
The plugin integrates the Antiphishing Suricata ruleset into the OPNsense ecosystem.
This is another step toward making community-driven Threat Intelligence directly consumable at the network enforcement layer.
Current ecosystem integration:
• Suricata / suricata-update
• OPNsense
• pfSense PR in progressThe project also recently added NRD-based threat intelligence for proactive phishing infrastructure detection (Suspect domains).
📖 OPNsense Quick Guide
For users who want to enable the ruleset on OPNsense 26.7.2:
Quick Guide — Installing Antiphishing on OPNsense 26.7.2
Project:
https://github.com/julioliraup/AntiphishingVector / CTI dashboard:
https://julioliraup.github.io/AT/#Suricata #OPNsense #ThreatIntelligence #CTI #DetectionEngineering #IDS #IPS #OpenSource
-
🛡️ Antiphishing is now officially available in @opnsense.org (@suricata IDPS)
OPNsense 26.7.2, released today, includes:
`os-intrusion-detection-content-at-antiphishing 1.0`
The plugin integrates the Antiphishing Suricata ruleset into the OPNsense ecosystem.
This is another step toward making community-driven Threat Intelligence directly consumable at the network enforcement layer.
Current ecosystem integration:
• Suricata / suricata-update
• OPNsense
• pfSense PR in progressThe project also recently added NRD-based threat intelligence for proactive phishing infrastructure detection (Suspect domains).
📖 OPNsense Quick Guide
For users who want to enable the ruleset on OPNsense 26.7.2:
Quick Guide — Installing Antiphishing on OPNsense 26.7.2
Project:
https://github.com/julioliraup/AntiphishingVector / CTI dashboard:
https://julioliraup.github.io/AT/#Suricata #OPNsense #ThreatIntelligence #CTI #DetectionEngineering #IDS #IPS #OpenSource
-
🛡️ Antiphishing is now officially available in @opnsense.org (@suricata IDPS)
OPNsense 26.7.2, released today, includes:
`os-intrusion-detection-content-at-antiphishing 1.0`
The plugin integrates the Antiphishing Suricata ruleset into the OPNsense ecosystem.
This is another step toward making community-driven Threat Intelligence directly consumable at the network enforcement layer.
Current ecosystem integration:
• Suricata / suricata-update
• OPNsense
• pfSense PR in progressThe project also recently added NRD-based threat intelligence for proactive phishing infrastructure detection (Suspect domains).
📖 OPNsense Quick Guide
For users who want to enable the ruleset on OPNsense 26.7.2:
Quick Guide — Installing Antiphishing on OPNsense 26.7.2
Project:
https://github.com/julioliraup/AntiphishingVector / CTI dashboard:
https://julioliraup.github.io/AT/#Suricata #OPNsense #ThreatIntelligence #CTI #DetectionEngineering #IDS #IPS #OpenSource
-
Lib Suricata: Indeed, still a work in progress, there's brief documentation here: https://docs.suricata.io/en/suricata-8.0.6/devguide/libsuricata/index.html
-
Lib Suricata: Indeed, still a work in progress, there's brief documentation here: https://docs.suricata.io/en/suricata-8.0.6/devguide/libsuricata/index.html
-
Lib Suricata: Indeed, still a work in progress, there's brief documentation here: https://docs.suricata.io/en/suricata-8.0.6/devguide/libsuricata/index.html
-
Lib Suricata: Indeed, still a work in progress, there's brief documentation here: https://docs.suricata.io/en/suricata-8.0.6/devguide/libsuricata/index.html
-
Lib Suricata: Indeed, still a work in progress, there's brief documentation here: https://docs.suricata.io/en/suricata-8.0.6/devguide/libsuricata/index.html
-
Did you know #Suricata 7 is EOL?
We recommend updating to a Suricata 8 if you’re still running an older version. Remember, you're not on your own with this. Consortium members get direct access to our team for upgrade planning and support - reach out!
-
Did you know #Suricata 7 is EOL?
We recommend updating to a Suricata 8 if you’re still running an older version. Remember, you're not on your own with this. Consortium members get direct access to our team for upgrade planning and support - reach out!
-
Did you know #Suricata 7 is EOL?
We recommend updating to a Suricata 8 if you’re still running an older version. Remember, you're not on your own with this. Consortium members get direct access to our team for upgrade planning and support - reach out!
-
Did you know #Suricata 7 is EOL?
We recommend updating to a Suricata 8 if you’re still running an older version. Remember, you're not on your own with this. Consortium members get direct access to our team for upgrade planning and support - reach out!
-
Did you know #Suricata 7 is EOL?
We recommend updating to a Suricata 8 if you’re still running an older version. Remember, you're not on your own with this. Consortium members get direct access to our team for upgrade planning and support - reach out!
-
#SuriCon2026 is shaping up to be a fantastic event this fall!
Attend the talks, the hands-on training, meet the people behind the work, and learn what community members are seeing in the field!
Buy your bundled ticket today! suricon.net/tickets/
-
#SuriCon2026 is shaping up to be a fantastic event this fall!
Attend the talks, the hands-on training, meet the people behind the work, and learn what community members are seeing in the field!
Buy your bundled ticket today! suricon.net/tickets/
-
#SuriCon2026 is shaping up to be a fantastic event this fall!
Attend the talks, the hands-on training, meet the people behind the work, and learn what community members are seeing in the field!
Buy your bundled ticket today! suricon.net/tickets/
-
#SuriCon2026 is shaping up to be a fantastic event this fall!
Attend the talks, the hands-on training, meet the people behind the work, and learn what community members are seeing in the field!
Buy your bundled ticket today! suricon.net/tickets/
-
#SuriCon2026 is shaping up to be a fantastic event this fall!
Attend the talks, the hands-on training, meet the people behind the work, and learn what community members are seeing in the field!
Buy your bundled ticket today! suricon.net/tickets/
-
Antiphishing Detection Update
A new threat intelligence cycle has been processed by the Antiphishing pipeline.
Current detection coverage:
• 6,007,331 HTTP signatures
• 243,098 TLS signatures
• 243,098 DNS signatures
• 6,493,527 total generated signaturesThe pipeline transforms phishing indicators from community intelligence sources into Suricata detection signatures across DNS, TLS and HTTP.
The ruleset is available through the suricata-update ecosystem.
Detection is only useful when intelligence can reach the enforcement layer.
Feeds → IOC processing → Rule generation → Suricata → Detection
Run julioliraup/Antiphishing on @suricata
https://github.com/julioliraup/Antiphishing
#Suricata #ThreatIntelligence #DetectionEngineering #Phishing #OpenSource #CyberSecurity -
Antiphishing Detection Update
A new threat intelligence cycle has been processed by the Antiphishing pipeline.
Current detection coverage:
• 6,007,331 HTTP signatures
• 243,098 TLS signatures
• 243,098 DNS signatures
• 6,493,527 total generated signaturesThe pipeline transforms phishing indicators from community intelligence sources into Suricata detection signatures across DNS, TLS and HTTP.
The ruleset is available through the suricata-update ecosystem.
Detection is only useful when intelligence can reach the enforcement layer.
Feeds → IOC processing → Rule generation → Suricata → Detection
Run julioliraup/Antiphishing on @suricata
https://github.com/julioliraup/Antiphishing
#Suricata #ThreatIntelligence #DetectionEngineering #Phishing #OpenSource #CyberSecurity -
Antiphishing Detection Update
A new threat intelligence cycle has been processed by the Antiphishing pipeline.
Current detection coverage:
• 6,007,331 HTTP signatures
• 243,098 TLS signatures
• 243,098 DNS signatures
• 6,493,527 total generated signaturesThe pipeline transforms phishing indicators from community intelligence sources into Suricata detection signatures across DNS, TLS and HTTP.
The ruleset is available through the suricata-update ecosystem.
Detection is only useful when intelligence can reach the enforcement layer.
Feeds → IOC processing → Rule generation → Suricata → Detection
Run julioliraup/Antiphishing on @suricata
https://github.com/julioliraup/Antiphishing
#Suricata #ThreatIntelligence #DetectionEngineering #Phishing #OpenSource #CyberSecurity -
Antiphishing Detection Update
A new threat intelligence cycle has been processed by the Antiphishing pipeline.
Current detection coverage:
• 6,007,331 HTTP signatures
• 243,098 TLS signatures
• 243,098 DNS signatures
• 6,493,527 total generated signaturesThe pipeline transforms phishing indicators from community intelligence sources into Suricata detection signatures across DNS, TLS and HTTP.
The ruleset is available through the suricata-update ecosystem.
Detection is only useful when intelligence can reach the enforcement layer.
Feeds → IOC processing → Rule generation → Suricata → Detection
Run julioliraup/Antiphishing on @suricata
https://github.com/julioliraup/Antiphishing
#Suricata #ThreatIntelligence #DetectionEngineering #Phishing #OpenSource #CyberSecurity -
Antiphishing Detection Update
A new threat intelligence cycle has been processed by the Antiphishing pipeline.
Current detection coverage:
• 6,007,331 HTTP signatures
• 243,098 TLS signatures
• 243,098 DNS signatures
• 6,493,527 total generated signaturesThe pipeline transforms phishing indicators from community intelligence sources into Suricata detection signatures across DNS, TLS and HTTP.
The ruleset is available through the suricata-update ecosystem.
Detection is only useful when intelligence can reach the enforcement layer.
Feeds → IOC processing → Rule generation → Suricata → Detection
Run julioliraup/Antiphishing on @suricata
https://github.com/julioliraup/Antiphishing
#Suricata #ThreatIntelligence #DetectionEngineering #Phishing #OpenSource #CyberSecurity -
Happy SysAdmin Day! 🎉
Today, we recognize the IT professionals who keep systems running, data secure, and teams connected. Thank you for your dedication, expertise, and countless hours spent keeping everything running smoothly.
-
Happy SysAdmin Day! 🎉
Today, we recognize the IT professionals who keep systems running, data secure, and teams connected. Thank you for your dedication, expertise, and countless hours spent keeping everything running smoothly.
-
Happy SysAdmin Day! 🎉
Today, we recognize the IT professionals who keep systems running, data secure, and teams connected. Thank you for your dedication, expertise, and countless hours spent keeping everything running smoothly.
-
Happy SysAdmin Day! 🎉
Today, we recognize the IT professionals who keep systems running, data secure, and teams connected. Thank you for your dedication, expertise, and countless hours spent keeping everything running smoothly.
-
Happy SysAdmin Day! 🎉
Today, we recognize the IT professionals who keep systems running, data secure, and teams connected. Thank you for your dedication, expertise, and countless hours spent keeping everything running smoothly.
-
In this #Suricata webinar replay, Ladislav Bačo walks through an incident investigation from the network POV. He offers a look into how network visibility supports incident response when teams need more than a single alert.
Watch now: https://www.youtube.com/watch?v=2HCqfOZuMJU
-
In this #Suricata webinar replay, Ladislav Bačo walks through an incident investigation from the network POV. He offers a look into how network visibility supports incident response when teams need more than a single alert.
Watch now: https://www.youtube.com/watch?v=2HCqfOZuMJU
-
In this #Suricata webinar replay, Ladislav Bačo walks through an incident investigation from the network POV. He offers a look into how network visibility supports incident response when teams need more than a single alert.
Watch now: https://www.youtube.com/watch?v=2HCqfOZuMJU
-
In this #Suricata webinar replay, Ladislav Bačo walks through an incident investigation from the network POV. He offers a look into how network visibility supports incident response when teams need more than a single alert.
Watch now: https://www.youtube.com/watch?v=2HCqfOZuMJU
-
In this #Suricata webinar replay, Ladislav Bačo walks through an incident investigation from the network POV. He offers a look into how network visibility supports incident response when teams need more than a single alert.
Watch now: https://www.youtube.com/watch?v=2HCqfOZuMJU
-
Great news! We’ve been invited to do a 4 hour workshop training for Security BSides Las Vegas 2026!
Join us for “Engineering the Hunt: Developing AI SKILLs for Network Security Monitoring” with Peter Manev, Jeff Lucovsky & Lukas Sismis on August 3rd at 3pm PST.
Learn more: bsideslv.org
-
Great news! We’ve been invited to do a 4 hour workshop training for Security BSides Las Vegas 2026!
Join us for “Engineering the Hunt: Developing AI SKILLs for Network Security Monitoring” with Peter Manev, Jeff Lucovsky & Lukas Sismis on August 3rd at 3pm PST.
Learn more: bsideslv.org
-
Great news! We’ve been invited to do a 4 hour workshop training for Security BSides Las Vegas 2026!
Join us for “Engineering the Hunt: Developing AI SKILLs for Network Security Monitoring” with Peter Manev, Jeff Lucovsky & Lukas Sismis on August 3rd at 3pm PST.
Learn more: bsideslv.org
-
Great news! We’ve been invited to do a 4 hour workshop training for Security BSides Las Vegas 2026!
Join us for “Engineering the Hunt: Developing AI SKILLs for Network Security Monitoring” with Peter Manev, Jeff Lucovsky & Lukas Sismis on August 3rd at 3pm PST.
Learn more: bsideslv.org
-
Great news! We’ve been invited to do a 4 hour workshop training for Security BSides Las Vegas 2026!
Join us for “Engineering the Hunt: Developing AI SKILLs for Network Security Monitoring” with Peter Manev, Jeff Lucovsky & Lukas Sismis on August 3rd at 3pm PST.
Learn more: bsideslv.org
-
CW: release notes for Malcolm v26.07.1, a network traffic analysis tool suite for network security monitoring
Malcolm v26.07.1 adds a few minor changes on top of Malcolm v26.07.0, the most notable being a fix for a crash in the
strelka-backendcontainer on arm64 platforms. Malcolm v26.07.0 added IEC 60870-5-104 (IEC 104) protocol support using CERT.LV's Zeek plugin, including Logstash parsing, ECS normalization, Arkime fields, and a new OpenSearch Dashboards dashboard. This release also fixes three archive extraction and authentication security vulnerabilities; improves NetBox enrichment configuration; and addresses PostgreSQL major version upgrade, custom CA certificate for KeyCloak, container health check, privilege-drop signal chaining, and configuration script issues. Arkime, Zeek, Fluent Bit, Filebeat, Logstash, Supercronic, and Alpine-based images have been updated as well.If you are upgrading from an existing Malcolm installation, run
./scripts/statusfor Malcolm to migrate some settings prior to running./scripts/configure,./scripts/start, or other Malcolm control scripts.https://github.com/idaholab/Malcolm/compare/v26.06.1...v26.07.1
✨ Features and enhancements
- Add IEC 60870-5-104 (IEC 104) support using the CERT.LV
spicy-iec104Zeek plugin, including Zeek log ingestion, ECS field mapping, Arkime fields, and an IEC 104 dashboard #939 - Make
LOGSTASH_NETBOX_ENRICHMENT_DATASETSmore flexible: it now acceptsdefault,ics/ot,all, explicitprovider.datasetvalues, and combinations such asdefault,ics#1037 - Allow
LOGSTASH_NETBOX_ENRICHMENT_DATASETSto be configured through checkboxes in the configuration TUI #1033 - Improve
./scripts/starterror messages by listing missing or invalid authentication-related files instead of reporting only a generic authentication setup failure #865 - Have
system-quickstartdetect and prepopulate existing time synchronization settings when rerun #992
- Add IEC 60870-5-104 (IEC 104) support using the CERT.LV
🛡️ Security Remediation & Hardening
- Fix an RBAC bypass caused by URI normalization differences between Nginx location matching and the Lua authorization layer CVE-2026-63177 #1042
- Fix path traversal in archive extraction directory handling by validating resolved paths and using libarchive's secure extraction flags CVE-2026-63134 #1040
- Limit archive entry count, nesting depth, and total expanded size to prevent inode- and resource-exhaustion denial of service during extraction CVE-2026-63133 #1041
- Mark OpenID Connect session cookies as secure and improve handling of externally forwarded HTTPS schemes
🐛 Bug fixes
- Co-installation of
opencv-pythonandopencv-contrib-pythoncorruptscv2.abi3.so, segfaultingstrelka-backendat import on arm64 #1046 (fix) - Allow the configuration TUI to reset supported variables back to empty values after installation #1024, #1030
- Fix the broken signal chain in
docker-uid-gid-setup.shso signals reach the final process after dropping privileges #1039 to ensure clean shutdown of containers - Fix PostgreSQL being reported unhealthy after a major-version upgrade, improve upgrade-state handling, and perform required post-upgrade extension and collation maintenance #1038
- Fix the Nginx Lua/OpenID Connect helper not honoring user-provided CA certificates for KeyCloak when
KEYCLOAK_SSL_VERIFY=true#1035 - Restore
curlto the thehtadmincontainer for use by the health check script #1029 - Reduce the size of the OpenSearch Dashboards image by copying only the permissions data needed from its upstream image layer #1031
- Fix JSON handling of several Zeek fields whose names contain dots by normalizing them to underscore-separated field names
- Fix additional Zeek and Suricata field normalization and ECS mapping inconsistencies found while updating dashboards and index templates
- Co-installation of
✅ Component version updates
- Arkime to v6.6.0
- This update contains a major speed-up when loading the SPIView and Connections pages
- Zeek to v8.2.1 #970
- Fluent Bit Windows installer helper to v5.0.9
- Filebeat OSS to v9.4.3
- Logstash to v9.4.4
- Pillow (Python library used in the
netboxcontainer) to v12.3.0 to address several security findings - Supercronic to v0.2.47
- Alpine Linux base images to v3.24
- KeyCloak to 26.6.4
- cryptography (Python library) to v48.0.1 to address security advisory GHSA-537c-gmf6-5ccf
- Arkime to v6.6.0
🧹 Code and project maintenance
- Broad spelling, grammar, naming consistency, and documentation cleanup across scripts, configuration, dashboards, and documentation #990
- Expand and restructure documentation to provide better project context for developers and LLM-assisted code analysis #964
- Improve installer validation, environment-variable mapping tests, and configuration item metadata
- Refresh dashboards, index templates, field mappings, protocol documentation, and navigation links
- Minor improvements to the Hedgehog Raspberry Pi image build process.
📄 Configuration changes for Malcolm (in environment variables in
./config/). The Malcolm control script (e.g.,./scripts/status,./scripts/start) automatically handles creation and migration of variables according to./config/env-var-actions.yml.LOGSTASH_NETBOX_ENRICHMENT_DATASETSinlogstash.envnow defaults todefaultand may containdefault,ics/ot,all, explicitprovider.datasetvalues, or a comma-separated combination of these valuesZEEK_DISABLE_ICS_IEC104inzeek.envcontrols whether the IEC 104 Zeek plugin is disabledSAFE_EXTRACT_MAX_ENTRIES,SAFE_EXTRACT_MAX_DEPTH, andSAFE_EXTRACT_MAX_BYTESinupload-common.envset archive extraction resource limits for uploaded archive files (e.g., containing Zeek logs for processing); their defaults are 5,000 entries, 20 directory levels, and 4 GiB of expanded data
Malcolm is a powerful, easily deployable network 🖧 traffic analysis tool suite for network security monitoring 🕵🏻♀️.
Malcolm operates as a cluster of containers 📦, isolated sandboxes which each serve a dedicated function of the system. This makes Malcolm deployable with frameworks like Docker 🐋, Podman 🦭, and Kubernetes ⎈. Check out the Quick Start guide for examples on how to get up and running.
Alternatively, dedicated official ISO installer images 💿 for Malcolm and Hedgehog Linux 🦔 can be downloaded from Malcolm's releases page on GitHub. Due to limits on individual files in GitHub releases, these ISO files have been split 🪓 into 2GB chunks and can be reassembled with scripts provided for both Bash 🐧 (
release_cleaver.sh) and PowerShell 🪟 (release_cleaver.ps1). See Downloading Malcolm - Installer ISOs for instructions.As always, join us on the Malcolm discussions board 💬 to engage with the community, or pop some corn 🍿 and watch a video 📼.
#Malcolm #HedgehogLinux #Zeek #Arkime #Strelka #NetBox #OpenSearch #Elasticsearch #Suricata #PCAP #NetworkTrafficAnalysis #networksecuritymonitoring #OT #ICS #icssecurity #CyberSecurity #Cyber #Infosec #INL
-
CW: release notes for Malcolm v26.07.1, a network traffic analysis tool suite for network security monitoring
Malcolm v26.07.1 adds a few minor changes on top of Malcolm v26.07.0, the most notable being a fix for a crash in the
strelka-backendcontainer on arm64 platforms. Malcolm v26.07.0 added IEC 60870-5-104 (IEC 104) protocol support using CERT.LV's Zeek plugin, including Logstash parsing, ECS normalization, Arkime fields, and a new OpenSearch Dashboards dashboard. This release also fixes three archive extraction and authentication security vulnerabilities; improves NetBox enrichment configuration; and addresses PostgreSQL major version upgrade, custom CA certificate for KeyCloak, container health check, privilege-drop signal chaining, and configuration script issues. Arkime, Zeek, Fluent Bit, Filebeat, Logstash, Supercronic, and Alpine-based images have been updated as well.If you are upgrading from an existing Malcolm installation, run
./scripts/statusfor Malcolm to migrate some settings prior to running./scripts/configure,./scripts/start, or other Malcolm control scripts.https://github.com/idaholab/Malcolm/compare/v26.06.1...v26.07.1
✨ Features and enhancements
- Add IEC 60870-5-104 (IEC 104) support using the CERT.LV
spicy-iec104Zeek plugin, including Zeek log ingestion, ECS field mapping, Arkime fields, and an IEC 104 dashboard #939 - Make
LOGSTASH_NETBOX_ENRICHMENT_DATASETSmore flexible: it now acceptsdefault,ics/ot,all, explicitprovider.datasetvalues, and combinations such asdefault,ics#1037 - Allow
LOGSTASH_NETBOX_ENRICHMENT_DATASETSto be configured through checkboxes in the configuration TUI #1033 - Improve
./scripts/starterror messages by listing missing or invalid authentication-related files instead of reporting only a generic authentication setup failure #865 - Have
system-quickstartdetect and prepopulate existing time synchronization settings when rerun #992
- Add IEC 60870-5-104 (IEC 104) support using the CERT.LV
🛡️ Security Remediation & Hardening
- Fix an RBAC bypass caused by URI normalization differences between Nginx location matching and the Lua authorization layer CVE-2026-63177 #1042
- Fix path traversal in archive extraction directory handling by validating resolved paths and using libarchive's secure extraction flags CVE-2026-63134 #1040
- Limit archive entry count, nesting depth, and total expanded size to prevent inode- and resource-exhaustion denial of service during extraction CVE-2026-63133 #1041
- Mark OpenID Connect session cookies as secure and improve handling of externally forwarded HTTPS schemes
🐛 Bug fixes
- Co-installation of
opencv-pythonandopencv-contrib-pythoncorruptscv2.abi3.so, segfaultingstrelka-backendat import on arm64 #1046 (fix) - Allow the configuration TUI to reset supported variables back to empty values after installation #1024, #1030
- Fix the broken signal chain in
docker-uid-gid-setup.shso signals reach the final process after dropping privileges #1039 to ensure clean shutdown of containers - Fix PostgreSQL being reported unhealthy after a major-version upgrade, improve upgrade-state handling, and perform required post-upgrade extension and collation maintenance #1038
- Fix the Nginx Lua/OpenID Connect helper not honoring user-provided CA certificates for KeyCloak when
KEYCLOAK_SSL_VERIFY=true#1035 - Restore
curlto the thehtadmincontainer for use by the health check script #1029 - Reduce the size of the OpenSearch Dashboards image by copying only the permissions data needed from its upstream image layer #1031
- Fix JSON handling of several Zeek fields whose names contain dots by normalizing them to underscore-separated field names
- Fix additional Zeek and Suricata field normalization and ECS mapping inconsistencies found while updating dashboards and index templates
- Co-installation of
✅ Component version updates
- Arkime to v6.6.0
- This update contains a major speed-up when loading the SPIView and Connections pages
- Zeek to v8.2.1 #970
- Fluent Bit Windows installer helper to v5.0.9
- Filebeat OSS to v9.4.3
- Logstash to v9.4.4
- Pillow (Python library used in the
netboxcontainer) to v12.3.0 to address several security findings - Supercronic to v0.2.47
- Alpine Linux base images to v3.24
- KeyCloak to 26.6.4
- cryptography (Python library) to v48.0.1 to address security advisory GHSA-537c-gmf6-5ccf
- Arkime to v6.6.0
🧹 Code and project maintenance
- Broad spelling, grammar, naming consistency, and documentation cleanup across scripts, configuration, dashboards, and documentation #990
- Expand and restructure documentation to provide better project context for developers and LLM-assisted code analysis #964
- Improve installer validation, environment-variable mapping tests, and configuration item metadata
- Refresh dashboards, index templates, field mappings, protocol documentation, and navigation links
- Minor improvements to the Hedgehog Raspberry Pi image build process.
📄 Configuration changes for Malcolm (in environment variables in
./config/). The Malcolm control script (e.g.,./scripts/status,./scripts/start) automatically handles creation and migration of variables according to./config/env-var-actions.yml.LOGSTASH_NETBOX_ENRICHMENT_DATASETSinlogstash.envnow defaults todefaultand may containdefault,ics/ot,all, explicitprovider.datasetvalues, or a comma-separated combination of these valuesZEEK_DISABLE_ICS_IEC104inzeek.envcontrols whether the IEC 104 Zeek plugin is disabledSAFE_EXTRACT_MAX_ENTRIES,SAFE_EXTRACT_MAX_DEPTH, andSAFE_EXTRACT_MAX_BYTESinupload-common.envset archive extraction resource limits for uploaded archive files (e.g., containing Zeek logs for processing); their defaults are 5,000 entries, 20 directory levels, and 4 GiB of expanded data
Malcolm is a powerful, easily deployable network 🖧 traffic analysis tool suite for network security monitoring 🕵🏻♀️.
Malcolm operates as a cluster of containers 📦, isolated sandboxes which each serve a dedicated function of the system. This makes Malcolm deployable with frameworks like Docker 🐋, Podman 🦭, and Kubernetes ⎈. Check out the Quick Start guide for examples on how to get up and running.
Alternatively, dedicated official ISO installer images 💿 for Malcolm and Hedgehog Linux 🦔 can be downloaded from Malcolm's releases page on GitHub. Due to limits on individual files in GitHub releases, these ISO files have been split 🪓 into 2GB chunks and can be reassembled with scripts provided for both Bash 🐧 (
release_cleaver.sh) and PowerShell 🪟 (release_cleaver.ps1). See Downloading Malcolm - Installer ISOs for instructions.As always, join us on the Malcolm discussions board 💬 to engage with the community, or pop some corn 🍿 and watch a video 📼.
#Malcolm #HedgehogLinux #Zeek #Arkime #Strelka #NetBox #OpenSearch #Elasticsearch #Suricata #PCAP #NetworkTrafficAnalysis #networksecuritymonitoring #OT #ICS #icssecurity #CyberSecurity #Cyber #Infosec #INL
-
CW: release notes for Malcolm v26.07.1, a network traffic analysis tool suite for network security monitoring
Malcolm v26.07.1 adds a few minor changes on top of Malcolm v26.07.0, the most notable being a fix for a crash in the
strelka-backendcontainer on arm64 platforms. Malcolm v26.07.0 added IEC 60870-5-104 (IEC 104) protocol support using CERT.LV's Zeek plugin, including Logstash parsing, ECS normalization, Arkime fields, and a new OpenSearch Dashboards dashboard. This release also fixes three archive extraction and authentication security vulnerabilities; improves NetBox enrichment configuration; and addresses PostgreSQL major version upgrade, custom CA certificate for KeyCloak, container health check, privilege-drop signal chaining, and configuration script issues. Arkime, Zeek, Fluent Bit, Filebeat, Logstash, Supercronic, and Alpine-based images have been updated as well.If you are upgrading from an existing Malcolm installation, run
./scripts/statusfor Malcolm to migrate some settings prior to running./scripts/configure,./scripts/start, or other Malcolm control scripts.https://github.com/idaholab/Malcolm/compare/v26.06.1...v26.07.1
✨ Features and enhancements
- Add IEC 60870-5-104 (IEC 104) support using the CERT.LV
spicy-iec104Zeek plugin, including Zeek log ingestion, ECS field mapping, Arkime fields, and an IEC 104 dashboard #939 - Make
LOGSTASH_NETBOX_ENRICHMENT_DATASETSmore flexible: it now acceptsdefault,ics/ot,all, explicitprovider.datasetvalues, and combinations such asdefault,ics#1037 - Allow
LOGSTASH_NETBOX_ENRICHMENT_DATASETSto be configured through checkboxes in the configuration TUI #1033 - Improve
./scripts/starterror messages by listing missing or invalid authentication-related files instead of reporting only a generic authentication setup failure #865 - Have
system-quickstartdetect and prepopulate existing time synchronization settings when rerun #992
- Add IEC 60870-5-104 (IEC 104) support using the CERT.LV
🛡️ Security Remediation & Hardening
- Fix an RBAC bypass caused by URI normalization differences between Nginx location matching and the Lua authorization layer CVE-2026-63177 #1042
- Fix path traversal in archive extraction directory handling by validating resolved paths and using libarchive's secure extraction flags CVE-2026-63134 #1040
- Limit archive entry count, nesting depth, and total expanded size to prevent inode- and resource-exhaustion denial of service during extraction CVE-2026-63133 #1041
- Mark OpenID Connect session cookies as secure and improve handling of externally forwarded HTTPS schemes
🐛 Bug fixes
- Co-installation of
opencv-pythonandopencv-contrib-pythoncorruptscv2.abi3.so, segfaultingstrelka-backendat import on arm64 #1046 (fix) - Allow the configuration TUI to reset supported variables back to empty values after installation #1024, #1030
- Fix the broken signal chain in
docker-uid-gid-setup.shso signals reach the final process after dropping privileges #1039 to ensure clean shutdown of containers - Fix PostgreSQL being reported unhealthy after a major-version upgrade, improve upgrade-state handling, and perform required post-upgrade extension and collation maintenance #1038
- Fix the Nginx Lua/OpenID Connect helper not honoring user-provided CA certificates for KeyCloak when
KEYCLOAK_SSL_VERIFY=true#1035 - Restore
curlto the thehtadmincontainer for use by the health check script #1029 - Reduce the size of the OpenSearch Dashboards image by copying only the permissions data needed from its upstream image layer #1031
- Fix JSON handling of several Zeek fields whose names contain dots by normalizing them to underscore-separated field names
- Fix additional Zeek and Suricata field normalization and ECS mapping inconsistencies found while updating dashboards and index templates
- Co-installation of
✅ Component version updates
- Arkime to v6.6.0
- This update contains a major speed-up when loading the SPIView and Connections pages
- Zeek to v8.2.1 #970
- Fluent Bit Windows installer helper to v5.0.9
- Filebeat OSS to v9.4.3
- Logstash to v9.4.4
- Pillow (Python library used in the
netboxcontainer) to v12.3.0 to address several security findings - Supercronic to v0.2.47
- Alpine Linux base images to v3.24
- KeyCloak to 26.6.4
- cryptography (Python library) to v48.0.1 to address security advisory GHSA-537c-gmf6-5ccf
- Arkime to v6.6.0
🧹 Code and project maintenance
- Broad spelling, grammar, naming consistency, and documentation cleanup across scripts, configuration, dashboards, and documentation #990
- Expand and restructure documentation to provide better project context for developers and LLM-assisted code analysis #964
- Improve installer validation, environment-variable mapping tests, and configuration item metadata
- Refresh dashboards, index templates, field mappings, protocol documentation, and navigation links
- Minor improvements to the Hedgehog Raspberry Pi image build process.
📄 Configuration changes for Malcolm (in environment variables in
./config/). The Malcolm control script (e.g.,./scripts/status,./scripts/start) automatically handles creation and migration of variables according to./config/env-var-actions.yml.LOGSTASH_NETBOX_ENRICHMENT_DATASETSinlogstash.envnow defaults todefaultand may containdefault,ics/ot,all, explicitprovider.datasetvalues, or a comma-separated combination of these valuesZEEK_DISABLE_ICS_IEC104inzeek.envcontrols whether the IEC 104 Zeek plugin is disabledSAFE_EXTRACT_MAX_ENTRIES,SAFE_EXTRACT_MAX_DEPTH, andSAFE_EXTRACT_MAX_BYTESinupload-common.envset archive extraction resource limits for uploaded archive files (e.g., containing Zeek logs for processing); their defaults are 5,000 entries, 20 directory levels, and 4 GiB of expanded data
Malcolm is a powerful, easily deployable network 🖧 traffic analysis tool suite for network security monitoring 🕵🏻♀️.
Malcolm operates as a cluster of containers 📦, isolated sandboxes which each serve a dedicated function of the system. This makes Malcolm deployable with frameworks like Docker 🐋, Podman 🦭, and Kubernetes ⎈. Check out the Quick Start guide for examples on how to get up and running.
Alternatively, dedicated official ISO installer images 💿 for Malcolm and Hedgehog Linux 🦔 can be downloaded from Malcolm's releases page on GitHub. Due to limits on individual files in GitHub releases, these ISO files have been split 🪓 into 2GB chunks and can be reassembled with scripts provided for both Bash 🐧 (
release_cleaver.sh) and PowerShell 🪟 (release_cleaver.ps1). See Downloading Malcolm - Installer ISOs for instructions.As always, join us on the Malcolm discussions board 💬 to engage with the community, or pop some corn 🍿 and watch a video 📼.
#Malcolm #HedgehogLinux #Zeek #Arkime #Strelka #NetBox #OpenSearch #Elasticsearch #Suricata #PCAP #NetworkTrafficAnalysis #networksecuritymonitoring #OT #ICS #icssecurity #CyberSecurity #Cyber #Infosec #INL
-
CW: release notes for Malcolm v26.07.1, a network traffic analysis tool suite for network security monitoring
Malcolm v26.07.1 adds a few minor changes on top of Malcolm v26.07.0, the most notable being a fix for a crash in the
strelka-backendcontainer on arm64 platforms. Malcolm v26.07.0 added IEC 60870-5-104 (IEC 104) protocol support using CERT.LV's Zeek plugin, including Logstash parsing, ECS normalization, Arkime fields, and a new OpenSearch Dashboards dashboard. This release also fixes three archive extraction and authentication security vulnerabilities; improves NetBox enrichment configuration; and addresses PostgreSQL major version upgrade, custom CA certificate for KeyCloak, container health check, privilege-drop signal chaining, and configuration script issues. Arkime, Zeek, Fluent Bit, Filebeat, Logstash, Supercronic, and Alpine-based images have been updated as well.If you are upgrading from an existing Malcolm installation, run
./scripts/statusfor Malcolm to migrate some settings prior to running./scripts/configure,./scripts/start, or other Malcolm control scripts.https://github.com/idaholab/Malcolm/compare/v26.06.1...v26.07.1
✨ Features and enhancements
- Add IEC 60870-5-104 (IEC 104) support using the CERT.LV
spicy-iec104Zeek plugin, including Zeek log ingestion, ECS field mapping, Arkime fields, and an IEC 104 dashboard #939 - Make
LOGSTASH_NETBOX_ENRICHMENT_DATASETSmore flexible: it now acceptsdefault,ics/ot,all, explicitprovider.datasetvalues, and combinations such asdefault,ics#1037 - Allow
LOGSTASH_NETBOX_ENRICHMENT_DATASETSto be configured through checkboxes in the configuration TUI #1033 - Improve
./scripts/starterror messages by listing missing or invalid authentication-related files instead of reporting only a generic authentication setup failure #865 - Have
system-quickstartdetect and prepopulate existing time synchronization settings when rerun #992
- Add IEC 60870-5-104 (IEC 104) support using the CERT.LV
🛡️ Security Remediation & Hardening
- Fix an RBAC bypass caused by URI normalization differences between Nginx location matching and the Lua authorization layer CVE-2026-63177 #1042
- Fix path traversal in archive extraction directory handling by validating resolved paths and using libarchive's secure extraction flags CVE-2026-63134 #1040
- Limit archive entry count, nesting depth, and total expanded size to prevent inode- and resource-exhaustion denial of service during extraction CVE-2026-63133 #1041
- Mark OpenID Connect session cookies as secure and improve handling of externally forwarded HTTPS schemes
🐛 Bug fixes
- Co-installation of
opencv-pythonandopencv-contrib-pythoncorruptscv2.abi3.so, segfaultingstrelka-backendat import on arm64 #1046 (fix) - Allow the configuration TUI to reset supported variables back to empty values after installation #1024, #1030
- Fix the broken signal chain in
docker-uid-gid-setup.shso signals reach the final process after dropping privileges #1039 to ensure clean shutdown of containers - Fix PostgreSQL being reported unhealthy after a major-version upgrade, improve upgrade-state handling, and perform required post-upgrade extension and collation maintenance #1038
- Fix the Nginx Lua/OpenID Connect helper not honoring user-provided CA certificates for KeyCloak when
KEYCLOAK_SSL_VERIFY=true#1035 - Restore
curlto the thehtadmincontainer for use by the health check script #1029 - Reduce the size of the OpenSearch Dashboards image by copying only the permissions data needed from its upstream image layer #1031
- Fix JSON handling of several Zeek fields whose names contain dots by normalizing them to underscore-separated field names
- Fix additional Zeek and Suricata field normalization and ECS mapping inconsistencies found while updating dashboards and index templates
- Co-installation of
✅ Component version updates
- Arkime to v6.6.0
- This update contains a major speed-up when loading the SPIView and Connections pages
- Zeek to v8.2.1 #970
- Fluent Bit Windows installer helper to v5.0.9
- Filebeat OSS to v9.4.3
- Logstash to v9.4.4
- Pillow (Python library used in the
netboxcontainer) to v12.3.0 to address several security findings - Supercronic to v0.2.47
- Alpine Linux base images to v3.24
- KeyCloak to 26.6.4
- cryptography (Python library) to v48.0.1 to address security advisory GHSA-537c-gmf6-5ccf
- Arkime to v6.6.0
🧹 Code and project maintenance
- Broad spelling, grammar, naming consistency, and documentation cleanup across scripts, configuration, dashboards, and documentation #990
- Expand and restructure documentation to provide better project context for developers and LLM-assisted code analysis #964
- Improve installer validation, environment-variable mapping tests, and configuration item metadata
- Refresh dashboards, index templates, field mappings, protocol documentation, and navigation links
- Minor improvements to the Hedgehog Raspberry Pi image build process.
📄 Configuration changes for Malcolm (in environment variables in
./config/). The Malcolm control script (e.g.,./scripts/status,./scripts/start) automatically handles creation and migration of variables according to./config/env-var-actions.yml.LOGSTASH_NETBOX_ENRICHMENT_DATASETSinlogstash.envnow defaults todefaultand may containdefault,ics/ot,all, explicitprovider.datasetvalues, or a comma-separated combination of these valuesZEEK_DISABLE_ICS_IEC104inzeek.envcontrols whether the IEC 104 Zeek plugin is disabledSAFE_EXTRACT_MAX_ENTRIES,SAFE_EXTRACT_MAX_DEPTH, andSAFE_EXTRACT_MAX_BYTESinupload-common.envset archive extraction resource limits for uploaded archive files (e.g., containing Zeek logs for processing); their defaults are 5,000 entries, 20 directory levels, and 4 GiB of expanded data
Malcolm is a powerful, easily deployable network 🖧 traffic analysis tool suite for network security monitoring 🕵🏻♀️.
Malcolm operates as a cluster of containers 📦, isolated sandboxes which each serve a dedicated function of the system. This makes Malcolm deployable with frameworks like Docker 🐋, Podman 🦭, and Kubernetes ⎈. Check out the Quick Start guide for examples on how to get up and running.
Alternatively, dedicated official ISO installer images 💿 for Malcolm and Hedgehog Linux 🦔 can be downloaded from Malcolm's releases page on GitHub. Due to limits on individual files in GitHub releases, these ISO files have been split 🪓 into 2GB chunks and can be reassembled with scripts provided for both Bash 🐧 (
release_cleaver.sh) and PowerShell 🪟 (release_cleaver.ps1). See Downloading Malcolm - Installer ISOs for instructions.As always, join us on the Malcolm discussions board 💬 to engage with the community, or pop some corn 🍿 and watch a video 📼.
#Malcolm #HedgehogLinux #Zeek #Arkime #Strelka #NetBox #OpenSearch #Elasticsearch #Suricata #PCAP #NetworkTrafficAnalysis #networksecuritymonitoring #OT #ICS #icssecurity #CyberSecurity #Cyber #Infosec #INL
-
Let’s give it up for the sponsors making #SuriCon2026 possible: OPNsense, Léargas Security, Corelight, Stamus Networks, ENEA, Catena Cyber, NEOX, Nomic Networks, and AWS.
Sponsorship opportunities are still available! Help bring this community together in 2026! suricon.net/sponsorships/