home.social

#suricata — Public Fediverse posts

Live and recent posts from across the Fediverse tagged #suricata, aggregated by home.social.

  1. Seth Grover @[email protected] ·
    CW: release notes for Malcolm v26.07.1, a network traffic analysis tool suite for network security monitoring

    Malcolm v26.07.1 adds a few minor changes on top of Malcolm v26.07.0, the most notable being a fix for a crash in the strelka-backend container on arm64 platforms. Malcolm v26.07.0 added IEC 60870-5-104 (IEC 104) protocol support using CERT.LV's Zeek plugin, including Logstash parsing, ECS normalization, Arkime fields, and a new OpenSearch Dashboards dashboard. This release also fixes three archive extraction and authentication security vulnerabilities; improves NetBox enrichment configuration; and addresses PostgreSQL major version upgrade, custom CA certificate for KeyCloak, container health check, privilege-drop signal chaining, and configuration script issues. Arkime, Zeek, Fluent Bit, Filebeat, Logstash, Supercronic, and Alpine-based images have been updated as well.

    If you are upgrading from an existing Malcolm installation, run ./scripts/status for Malcolm to migrate some settings prior to running ./scripts/configure, ./scripts/start, or other Malcolm control scripts.

    github.com/idaholab/Malcolm/co

    • ✨ Features and enhancements

      • Add IEC 60870-5-104 (IEC 104) support using the CERT.LV spicy-iec104 Zeek plugin, including Zeek log ingestion, ECS field mapping, Arkime fields, and an IEC 104 dashboard #939
      • Make LOGSTASH_NETBOX_ENRICHMENT_DATASETS more flexible: it now accepts default, ics/ot, all, explicit provider.dataset values, and combinations such as default,ics #1037
      • Allow LOGSTASH_NETBOX_ENRICHMENT_DATASETS to be configured through checkboxes in the configuration TUI #1033
      • Improve ./scripts/start error messages by listing missing or invalid authentication-related files instead of reporting only a generic authentication setup failure #865
      • Have system-quickstart detect and prepopulate existing time synchronization settings when rerun #992

    • 🛡️ Security Remediation & Hardening

      • Fix an RBAC bypass caused by URI normalization differences between Nginx location matching and the Lua authorization layer CVE-2026-63177 #1042
      • Fix path traversal in archive extraction directory handling by validating resolved paths and using libarchive's secure extraction flags CVE-2026-63134 #1040
      • Limit archive entry count, nesting depth, and total expanded size to prevent inode- and resource-exhaustion denial of service during extraction CVE-2026-63133 #1041
      • Mark OpenID Connect session cookies as secure and improve handling of externally forwarded HTTPS schemes

    • 🐛 Bug fixes

      • Co-installation of opencv-python and opencv-contrib-python corrupts cv2.abi3.so, segfaulting strelka-backend at import on arm64 #1046 (fix)
      • Allow the configuration TUI to reset supported variables back to empty values after installation #1024, #1030
      • Fix the broken signal chain in docker-uid-gid-setup.sh so signals reach the final process after dropping privileges #1039 to ensure clean shutdown of containers
      • Fix PostgreSQL being reported unhealthy after a major-version upgrade, improve upgrade-state handling, and perform required post-upgrade extension and collation maintenance #1038
      • Fix the Nginx Lua/OpenID Connect helper not honoring user-provided CA certificates for KeyCloak when KEYCLOAK_SSL_VERIFY=true #1035
      • Restore curl to the the htadmin container for use by the health check script #1029
      • Reduce the size of the OpenSearch Dashboards image by copying only the permissions data needed from its upstream image layer #1031
      • Fix JSON handling of several Zeek fields whose names contain dots by normalizing them to underscore-separated field names
      • Fix additional Zeek and Suricata field normalization and ECS mapping inconsistencies found while updating dashboards and index templates

    • ✅ Component version updates

    • 🧹 Code and project maintenance

      • Broad spelling, grammar, naming consistency, and documentation cleanup across scripts, configuration, dashboards, and documentation #990
      • Expand and restructure documentation to provide better project context for developers and LLM-assisted code analysis #964
      • Improve installer validation, environment-variable mapping tests, and configuration item metadata
      • Refresh dashboards, index templates, field mappings, protocol documentation, and navigation links
      • Minor improvements to the Hedgehog Raspberry Pi image build process.

    • 📄 Configuration changes for Malcolm (in environment variables in ./config/). The Malcolm control script (e.g., ./scripts/status, ./scripts/start) automatically handles creation and migration of variables according to ./config/env-var-actions.yml.

      • LOGSTASH_NETBOX_ENRICHMENT_DATASETS in logstash.env now defaults to default and may contain default, ics/ot, all, explicit provider.dataset values, or a comma-separated combination of these values
      • ZEEK_DISABLE_ICS_IEC104 in zeek.env controls whether the IEC 104 Zeek plugin is disabled
      • SAFE_EXTRACT_MAX_ENTRIES, SAFE_EXTRACT_MAX_DEPTH, and SAFE_EXTRACT_MAX_BYTES in upload-common.env set archive extraction resource limits for uploaded archive files (e.g., containing Zeek logs for processing); their defaults are 5,000 entries, 20 directory levels, and 4 GiB of expanded data

    Malcolm is a powerful, easily deployable network 🖧 traffic analysis tool suite for network security monitoring 🕵🏻‍♀️.

    Malcolm operates as a cluster of containers 📦, isolated sandboxes which each serve a dedicated function of the system. This makes Malcolm deployable with frameworks like Docker 🐋, Podman 🦭, and Kubernetes ⎈. Check out the Quick Start guide for examples on how to get up and running.

    Alternatively, dedicated official ISO installer images 💿 for Malcolm and Hedgehog Linux 🦔 can be downloaded from Malcolm's releases page on GitHub. Due to limits on individual files in GitHub releases, these ISO files have been split 🪓 into 2GB chunks and can be reassembled with scripts provided for both Bash 🐧 (release_cleaver.sh) and PowerShell 🪟 (release_cleaver.ps1). See Downloading Malcolm - Installer ISOs for instructions.

    As always, join us on the Malcolm discussions board 💬 to engage with the community, or pop some corn 🍿 and watch a video 📼.

    #Malcolm #HedgehogLinux #Zeek #Arkime #Strelka #NetBox #OpenSearch #Elasticsearch #Suricata #PCAP #NetworkTrafficAnalysis #networksecuritymonitoring #OT #ICS #icssecurity #CyberSecurity #Cyber #Infosec #INL

    #malcolm #hedgehoglinux #zeek #arkime #strelka #netbox
  2. Seth Grover @[email protected] ·
    CW: release notes for Malcolm v26.07.0, a network traffic analysis tool suite for network security monitoring

    Malcolm v26.07.0 adds IEC 60870-5-104 (IEC 104) protocol support using CERT.LV's Zeek plugin, including Logstash parsing, ECS normalization, Arkime fields, and a new OpenSearch Dashboards dashboard. This release also fixes three archive extraction and authentication security vulnerabilities; improves NetBox enrichment configuration; and addresses PostgreSQL major version upgrade, custom CA certificate for KeyCloak, container health check, privilege-drop signal chaining, and configuration script issues. Arkime, Zeek, Fluent Bit, Filebeat, Logstash, Supercronic, and Alpine-based images have been updated as well.

    If you are upgrading from an existing Malcolm installation, run ./scripts/status for Malcolm to migrate some settings prior to running ./scripts/configure, ./scripts/start, or other Malcolm control scripts.

    github.com/idaholab/Malcolm/co

    • ✨ Features and enhancements

      • Add IEC 60870-5-104 (IEC 104) support using the CERT.LV spicy-iec104 Zeek plugin, including Zeek log ingestion, ECS field mapping, Arkime fields, and an IEC 104 dashboard #939
      • Make LOGSTASH_NETBOX_ENRICHMENT_DATASETS more flexible: it now accepts default, ics/ot, all, explicit provider.dataset values, and combinations such as default,ics #1037
      • Allow LOGSTASH_NETBOX_ENRICHMENT_DATASETS to be configured through checkboxes in the configuration TUI #1033
      • Improve ./scripts/start error messages by listing missing or invalid authentication-related files instead of reporting only a generic authentication setup failure #865
      • Have system-quickstart detect and prepopulate existing time synchronization settings when rerun #992

    • 🛡️ Security Remediation & Hardening

      • Fix an RBAC bypass caused by URI normalization differences between Nginx location matching and the Lua authorization layer CVE-2026-63177 #1042
      • Fix path traversal in archive extraction directory handling by validating resolved paths and using libarchive's secure extraction flags CVE-2026-63134 #1040
      • Limit archive entry count, nesting depth, and total expanded size to prevent inode- and resource-exhaustion denial of service during extraction CVE-2026-63133 #1041
      • Mark OpenID Connect session cookies as secure and improve handling of externally forwarded HTTPS schemes

    • 🐛 Bug fixes

      • Allow the configuration TUI to reset supported variables back to empty values after installation #1024, #1030
      • Fix the broken signal chain in docker-uid-gid-setup.sh so signals reach the final process after dropping privileges #1039 to ensure clean shutdown of containers
      • Fix PostgreSQL being reported unhealthy after a major-version upgrade, improve upgrade-state handling, and perform required post-upgrade extension and collation maintenance #1038
      • Fix the Nginx Lua/OpenID Connect helper not honoring user-provided CA certificates for KeyCloak when KEYCLOAK_SSL_VERIFY=true #1035
      • Restore curl to the the htadmin container for use by the health check script #1029
      • Reduce the size of the OpenSearch Dashboards image by copying only the permissions data needed from its upstream image layer #1031
      • Fix JSON handling of several Zeek fields whose names contain dots by normalizing them to underscore-separated field names
      • Fix additional Zeek and Suricata field normalization and ECS mapping inconsistencies found while updating dashboards and index templates

    • ✅ Component version updates

    • 🧹 Code and project maintenance

      • Broad spelling, grammar, naming consistency, and documentation cleanup across scripts, configuration, dashboards, and documentation #990
      • Expand and restructure documentation to provide better project context for developers and LLM-assisted code analysis #964
      • Improve installer validation, environment-variable mapping tests, and configuration item metadata
      • Refresh dashboards, index templates, field mappings, protocol documentation, and navigation links

    • 📄 Configuration changes for Malcolm (in environment variables in ./config/). The Malcolm control script (e.g., ./scripts/status, ./scripts/start) automatically handles creation and migration of variables according to ./config/env-var-actions.yml.

      • LOGSTASH_NETBOX_ENRICHMENT_DATASETS in logstash.env now defaults to default and may contain default, ics/ot, all, explicit provider.dataset values, or a comma-separated combination of these values
      • ZEEK_DISABLE_ICS_IEC104 in zeek.env controls whether the IEC 104 Zeek plugin is disabled
      • SAFE_EXTRACT_MAX_ENTRIES, SAFE_EXTRACT_MAX_DEPTH, and SAFE_EXTRACT_MAX_BYTES in upload-common.env set archive extraction resource limits for uploaded archive files (e.g., containing Zeek logs for processing); their defaults are 5,000 entries, 20 directory levels, and 4 GiB of expanded data

    • ❌ Errata

      • Post-release, a Strelka bug was found which can cause the strelka-backend container's work process to crash on aarch64 platforms (cisagov#1046). A followup v26.07.1 release addressing this issue is forthcoming.

    Malcolm is a powerful, easily deployable network 🖧 traffic analysis tool suite for network security monitoring 🕵🏻‍♀️.

    Malcolm operates as a cluster of containers 📦, isolated sandboxes which each serve a dedicated function of the system. This makes Malcolm deployable with frameworks like Docker 🐋, Podman 🦭, and Kubernetes ⎈. Check out the Quick Start guide for examples on how to get up and running.

    Alternatively, dedicated official ISO installer images 💿 for Malcolm and Hedgehog Linux 🦔 can be downloaded from Malcolm's releases page on GitHub. Due to limits on individual files in GitHub releases, these ISO files have been split 🪓 into 2GB chunks and can be reassembled with scripts provided for both Bash 🐧 (release_cleaver.sh) and PowerShell 🪟 (release_cleaver.ps1). See Downloading Malcolm - Installer ISOs for instructions.

    As always, join us on the Malcolm discussions board 💬 to engage with the community, or pop some corn 🍿 and watch a video 📼.

    #Malcolm #HedgehogLinux #Zeek #Arkime #Strelka #NetBox #OpenSearch #Elasticsearch #Suricata #PCAP #NetworkTrafficAnalysis #networksecuritymonitoring #OT #ICS #icssecurity #CyberSecurity #Cyber #Infosec #INL

    #malcolm #hedgehoglinux #zeek #arkime #strelka #netbox
  3. Seth Grover @[email protected] ·
    CW: release notes for Malcolm v26.07.0, a network traffic analysis tool suite for network security monitoring

    Malcolm v26.07.0 adds IEC 60870-5-104 (IEC 104) protocol support using CERT.LV's Zeek plugin, including Logstash parsing, ECS normalization, Arkime fields, and a new OpenSearch Dashboards dashboard. This release also fixes three archive extraction and authentication security vulnerabilities; improves NetBox enrichment configuration; and addresses PostgreSQL major version upgrade, custom CA certificate for KeyCloak, container health check, privilege-drop signal chaining, and configuration script issues. Arkime, Zeek, Fluent Bit, Filebeat, Logstash, Supercronic, and Alpine-based images have been updated as well.

    If you are upgrading from an existing Malcolm installation, run ./scripts/status for Malcolm to migrate some settings prior to running ./scripts/configure, ./scripts/start, or other Malcolm control scripts.

    github.com/idaholab/Malcolm/co

    • ✨ Features and enhancements

      • Add IEC 60870-5-104 (IEC 104) support using the CERT.LV spicy-iec104 Zeek plugin, including Zeek log ingestion, ECS field mapping, Arkime fields, and an IEC 104 dashboard #939
      • Make LOGSTASH_NETBOX_ENRICHMENT_DATASETS more flexible: it now accepts default, ics/ot, all, explicit provider.dataset values, and combinations such as default,ics #1037
      • Allow LOGSTASH_NETBOX_ENRICHMENT_DATASETS to be configured through checkboxes in the configuration TUI #1033
      • Improve ./scripts/start error messages by listing missing or invalid authentication-related files instead of reporting only a generic authentication setup failure #865
      • Have system-quickstart detect and prepopulate existing time synchronization settings when rerun #992

    • 🛡️ Security Remediation & Hardening

      • Fix an RBAC bypass caused by URI normalization differences between Nginx location matching and the Lua authorization layer CVE-2026-63177 #1042
      • Fix path traversal in archive extraction directory handling by validating resolved paths and using libarchive's secure extraction flags CVE-2026-63134 #1040
      • Limit archive entry count, nesting depth, and total expanded size to prevent inode- and resource-exhaustion denial of service during extraction CVE-2026-63133 #1041
      • Mark OpenID Connect session cookies as secure and improve handling of externally forwarded HTTPS schemes

    • 🐛 Bug fixes

      • Allow the configuration TUI to reset supported variables back to empty values after installation #1024, #1030
      • Fix the broken signal chain in docker-uid-gid-setup.sh so signals reach the final process after dropping privileges #1039 to ensure clean shutdown of containers
      • Fix PostgreSQL being reported unhealthy after a major-version upgrade, improve upgrade-state handling, and perform required post-upgrade extension and collation maintenance #1038
      • Fix the Nginx Lua/OpenID Connect helper not honoring user-provided CA certificates for KeyCloak when KEYCLOAK_SSL_VERIFY=true #1035
      • Restore curl to the the htadmin container for use by the health check script #1029
      • Reduce the size of the OpenSearch Dashboards image by copying only the permissions data needed from its upstream image layer #1031
      • Fix JSON handling of several Zeek fields whose names contain dots by normalizing them to underscore-separated field names
      • Fix additional Zeek and Suricata field normalization and ECS mapping inconsistencies found while updating dashboards and index templates

    • ✅ Component version updates

    • 🧹 Code and project maintenance

      • Broad spelling, grammar, naming consistency, and documentation cleanup across scripts, configuration, dashboards, and documentation #990
      • Expand and restructure documentation to provide better project context for developers and LLM-assisted code analysis #964
      • Improve installer validation, environment-variable mapping tests, and configuration item metadata
      • Refresh dashboards, index templates, field mappings, protocol documentation, and navigation links

    • 📄 Configuration changes for Malcolm (in environment variables in ./config/). The Malcolm control script (e.g., ./scripts/status, ./scripts/start) automatically handles creation and migration of variables according to ./config/env-var-actions.yml.

      • LOGSTASH_NETBOX_ENRICHMENT_DATASETS in logstash.env now defaults to default and may contain default, ics/ot, all, explicit provider.dataset values, or a comma-separated combination of these values
      • ZEEK_DISABLE_ICS_IEC104 in zeek.env controls whether the IEC 104 Zeek plugin is disabled
      • SAFE_EXTRACT_MAX_ENTRIES, SAFE_EXTRACT_MAX_DEPTH, and SAFE_EXTRACT_MAX_BYTES in upload-common.env set archive extraction resource limits for uploaded archive files (e.g., containing Zeek logs for processing); their defaults are 5,000 entries, 20 directory levels, and 4 GiB of expanded data

    • ❌ Errata

      • Post-release, a Strelka bug was found which can cause the strelka-backend container's work process to crash on aarch64 platforms (cisagov#1046). A followup v26.07.1 release addressing this issue is forthcoming.

    Malcolm is a powerful, easily deployable network 🖧 traffic analysis tool suite for network security monitoring 🕵🏻‍♀️.

    Malcolm operates as a cluster of containers 📦, isolated sandboxes which each serve a dedicated function of the system. This makes Malcolm deployable with frameworks like Docker 🐋, Podman 🦭, and Kubernetes ⎈. Check out the Quick Start guide for examples on how to get up and running.

    Alternatively, dedicated official ISO installer images 💿 for Malcolm and Hedgehog Linux 🦔 can be downloaded from Malcolm's releases page on GitHub. Due to limits on individual files in GitHub releases, these ISO files have been split 🪓 into 2GB chunks and can be reassembled with scripts provided for both Bash 🐧 (release_cleaver.sh) and PowerShell 🪟 (release_cleaver.ps1). See Downloading Malcolm - Installer ISOs for instructions.

    As always, join us on the Malcolm discussions board 💬 to engage with the community, or pop some corn 🍿 and watch a video 📼.

    #Malcolm #HedgehogLinux #Zeek #Arkime #Strelka #NetBox #OpenSearch #Elasticsearch #Suricata #PCAP #NetworkTrafficAnalysis #networksecuritymonitoring #OT #ICS #icssecurity #CyberSecurity #Cyber #Infosec #INL

    #malcolm #hedgehoglinux #zeek #arkime #strelka #netbox
  4. Seth Grover @[email protected] ·
    CW: release notes for Malcolm v26.07.0, a network traffic analysis tool suite for network security monitoring

    Malcolm v26.07.0 adds IEC 60870-5-104 (IEC 104) protocol support using CERT.LV's Zeek plugin, including Logstash parsing, ECS normalization, Arkime fields, and a new OpenSearch Dashboards dashboard. This release also fixes three archive extraction and authentication security vulnerabilities; improves NetBox enrichment configuration; and addresses PostgreSQL major version upgrade, custom CA certificate for KeyCloak, container health check, privilege-drop signal chaining, and configuration script issues. Arkime, Zeek, Fluent Bit, Filebeat, Logstash, Supercronic, and Alpine-based images have been updated as well.

    If you are upgrading from an existing Malcolm installation, run ./scripts/status for Malcolm to migrate some settings prior to running ./scripts/configure, ./scripts/start, or other Malcolm control scripts.

    github.com/idaholab/Malcolm/co

    • ✨ Features and enhancements

      • Add IEC 60870-5-104 (IEC 104) support using the CERT.LV spicy-iec104 Zeek plugin, including Zeek log ingestion, ECS field mapping, Arkime fields, and an IEC 104 dashboard #939
      • Make LOGSTASH_NETBOX_ENRICHMENT_DATASETS more flexible: it now accepts default, ics/ot, all, explicit provider.dataset values, and combinations such as default,ics #1037
      • Allow LOGSTASH_NETBOX_ENRICHMENT_DATASETS to be configured through checkboxes in the configuration TUI #1033
      • Improve ./scripts/start error messages by listing missing or invalid authentication-related files instead of reporting only a generic authentication setup failure #865
      • Have system-quickstart detect and prepopulate existing time synchronization settings when rerun #992

    • 🛡️ Security Remediation & Hardening

      • Fix an RBAC bypass caused by URI normalization differences between Nginx location matching and the Lua authorization layer CVE-2026-63177 #1042
      • Fix path traversal in archive extraction directory handling by validating resolved paths and using libarchive's secure extraction flags CVE-2026-63134 #1040
      • Limit archive entry count, nesting depth, and total expanded size to prevent inode- and resource-exhaustion denial of service during extraction CVE-2026-63133 #1041
      • Mark OpenID Connect session cookies as secure and improve handling of externally forwarded HTTPS schemes

    • 🐛 Bug fixes

      • Allow the configuration TUI to reset supported variables back to empty values after installation #1024, #1030
      • Fix the broken signal chain in docker-uid-gid-setup.sh so signals reach the final process after dropping privileges #1039 to ensure clean shutdown of containers
      • Fix PostgreSQL being reported unhealthy after a major-version upgrade, improve upgrade-state handling, and perform required post-upgrade extension and collation maintenance #1038
      • Fix the Nginx Lua/OpenID Connect helper not honoring user-provided CA certificates for KeyCloak when KEYCLOAK_SSL_VERIFY=true #1035
      • Restore curl to the the htadmin container for use by the health check script #1029
      • Reduce the size of the OpenSearch Dashboards image by copying only the permissions data needed from its upstream image layer #1031
      • Fix JSON handling of several Zeek fields whose names contain dots by normalizing them to underscore-separated field names
      • Fix additional Zeek and Suricata field normalization and ECS mapping inconsistencies found while updating dashboards and index templates

    • ✅ Component version updates

    • 🧹 Code and project maintenance

      • Broad spelling, grammar, naming consistency, and documentation cleanup across scripts, configuration, dashboards, and documentation #990
      • Expand and restructure documentation to provide better project context for developers and LLM-assisted code analysis #964
      • Improve installer validation, environment-variable mapping tests, and configuration item metadata
      • Refresh dashboards, index templates, field mappings, protocol documentation, and navigation links

    • 📄 Configuration changes for Malcolm (in environment variables in ./config/). The Malcolm control script (e.g., ./scripts/status, ./scripts/start) automatically handles creation and migration of variables according to ./config/env-var-actions.yml.

      • LOGSTASH_NETBOX_ENRICHMENT_DATASETS in logstash.env now defaults to default and may contain default, ics/ot, all, explicit provider.dataset values, or a comma-separated combination of these values
      • ZEEK_DISABLE_ICS_IEC104 in zeek.env controls whether the IEC 104 Zeek plugin is disabled
      • SAFE_EXTRACT_MAX_ENTRIES, SAFE_EXTRACT_MAX_DEPTH, and SAFE_EXTRACT_MAX_BYTES in upload-common.env set archive extraction resource limits for uploaded archive files (e.g., containing Zeek logs for processing); their defaults are 5,000 entries, 20 directory levels, and 4 GiB of expanded data

    • ❌ Errata

      • Post-release, a Strelka bug was found which can cause the strelka-backend container's work process to crash on aarch64 platforms (cisagov#1046). A followup v26.07.1 release addressing this issue is forthcoming.

    Malcolm is a powerful, easily deployable network 🖧 traffic analysis tool suite for network security monitoring 🕵🏻‍♀️.

    Malcolm operates as a cluster of containers 📦, isolated sandboxes which each serve a dedicated function of the system. This makes Malcolm deployable with frameworks like Docker 🐋, Podman 🦭, and Kubernetes ⎈. Check out the Quick Start guide for examples on how to get up and running.

    Alternatively, dedicated official ISO installer images 💿 for Malcolm and Hedgehog Linux 🦔 can be downloaded from Malcolm's releases page on GitHub. Due to limits on individual files in GitHub releases, these ISO files have been split 🪓 into 2GB chunks and can be reassembled with scripts provided for both Bash 🐧 (release_cleaver.sh) and PowerShell 🪟 (release_cleaver.ps1). See Downloading Malcolm - Installer ISOs for instructions.

    As always, join us on the Malcolm discussions board 💬 to engage with the community, or pop some corn 🍿 and watch a video 📼.

    #Malcolm #HedgehogLinux #Zeek #Arkime #Strelka #NetBox #OpenSearch #Elasticsearch #Suricata #PCAP #NetworkTrafficAnalysis #networksecuritymonitoring #OT #ICS #icssecurity #CyberSecurity #Cyber #Infosec #INL

    #malcolm #hedgehoglinux #zeek #arkime #strelka #netbox
  5. Seth Grover @[email protected] ·
    CW: release notes for Malcolm v26.07.0, a network traffic analysis tool suite for network security monitoring

    Malcolm v26.07.0 adds IEC 60870-5-104 (IEC 104) protocol support using CERT.LV's Zeek plugin, including Logstash parsing, ECS normalization, Arkime fields, and a new OpenSearch Dashboards dashboard. This release also fixes three archive extraction and authentication security vulnerabilities; improves NetBox enrichment configuration; and addresses PostgreSQL major version upgrade, custom CA certificate for KeyCloak, container health check, privilege-drop signal chaining, and configuration script issues. Arkime, Zeek, Fluent Bit, Filebeat, Logstash, Supercronic, and Alpine-based images have been updated as well.

    If you are upgrading from an existing Malcolm installation, run ./scripts/status for Malcolm to migrate some settings prior to running ./scripts/configure, ./scripts/start, or other Malcolm control scripts.

    github.com/idaholab/Malcolm/co

    • ✨ Features and enhancements

      • Add IEC 60870-5-104 (IEC 104) support using the CERT.LV spicy-iec104 Zeek plugin, including Zeek log ingestion, ECS field mapping, Arkime fields, and an IEC 104 dashboard #939
      • Make LOGSTASH_NETBOX_ENRICHMENT_DATASETS more flexible: it now accepts default, ics/ot, all, explicit provider.dataset values, and combinations such as default,ics #1037
      • Allow LOGSTASH_NETBOX_ENRICHMENT_DATASETS to be configured through checkboxes in the configuration TUI #1033
      • Improve ./scripts/start error messages by listing missing or invalid authentication-related files instead of reporting only a generic authentication setup failure #865
      • Have system-quickstart detect and prepopulate existing time synchronization settings when rerun #992

    • 🛡️ Security Remediation & Hardening

      • Fix an RBAC bypass caused by URI normalization differences between Nginx location matching and the Lua authorization layer CVE-2026-63177 #1042
      • Fix path traversal in archive extraction directory handling by validating resolved paths and using libarchive's secure extraction flags CVE-2026-63134 #1040
      • Limit archive entry count, nesting depth, and total expanded size to prevent inode- and resource-exhaustion denial of service during extraction CVE-2026-63133 #1041
      • Mark OpenID Connect session cookies as secure and improve handling of externally forwarded HTTPS schemes

    • 🐛 Bug fixes

      • Allow the configuration TUI to reset supported variables back to empty values after installation #1024, #1030
      • Fix the broken signal chain in docker-uid-gid-setup.sh so signals reach the final process after dropping privileges #1039 to ensure clean shutdown of containers
      • Fix PostgreSQL being reported unhealthy after a major-version upgrade, improve upgrade-state handling, and perform required post-upgrade extension and collation maintenance #1038
      • Fix the Nginx Lua/OpenID Connect helper not honoring user-provided CA certificates for KeyCloak when KEYCLOAK_SSL_VERIFY=true #1035
      • Restore curl to the the htadmin container for use by the health check script #1029
      • Reduce the size of the OpenSearch Dashboards image by copying only the permissions data needed from its upstream image layer #1031
      • Fix JSON handling of several Zeek fields whose names contain dots by normalizing them to underscore-separated field names
      • Fix additional Zeek and Suricata field normalization and ECS mapping inconsistencies found while updating dashboards and index templates

    • ✅ Component version updates

    • 🧹 Code and project maintenance

      • Broad spelling, grammar, naming consistency, and documentation cleanup across scripts, configuration, dashboards, and documentation #990
      • Expand and restructure documentation to provide better project context for developers and LLM-assisted code analysis #964
      • Improve installer validation, environment-variable mapping tests, and configuration item metadata
      • Refresh dashboards, index templates, field mappings, protocol documentation, and navigation links

    • 📄 Configuration changes for Malcolm (in environment variables in ./config/). The Malcolm control script (e.g., ./scripts/status, ./scripts/start) automatically handles creation and migration of variables according to ./config/env-var-actions.yml.

      • LOGSTASH_NETBOX_ENRICHMENT_DATASETS in logstash.env now defaults to default and may contain default, ics/ot, all, explicit provider.dataset values, or a comma-separated combination of these values
      • ZEEK_DISABLE_ICS_IEC104 in zeek.env controls whether the IEC 104 Zeek plugin is disabled
      • SAFE_EXTRACT_MAX_ENTRIES, SAFE_EXTRACT_MAX_DEPTH, and SAFE_EXTRACT_MAX_BYTES in upload-common.env set archive extraction resource limits for uploaded archive files (e.g., containing Zeek logs for processing); their defaults are 5,000 entries, 20 directory levels, and 4 GiB of expanded data

    • ❌ Errata

      • Post-release, a Strelka bug was found which can cause the strelka-backend container's work process to crash on aarch64 platforms (cisagov#1046). A followup v26.07.1 release addressing this issue is forthcoming.

    Malcolm is a powerful, easily deployable network 🖧 traffic analysis tool suite for network security monitoring 🕵🏻‍♀️.

    Malcolm operates as a cluster of containers 📦, isolated sandboxes which each serve a dedicated function of the system. This makes Malcolm deployable with frameworks like Docker 🐋, Podman 🦭, and Kubernetes ⎈. Check out the Quick Start guide for examples on how to get up and running.

    Alternatively, dedicated official ISO installer images 💿 for Malcolm and Hedgehog Linux 🦔 can be downloaded from Malcolm's releases page on GitHub. Due to limits on individual files in GitHub releases, these ISO files have been split 🪓 into 2GB chunks and can be reassembled with scripts provided for both Bash 🐧 (release_cleaver.sh) and PowerShell 🪟 (release_cleaver.ps1). See Downloading Malcolm - Installer ISOs for instructions.

    As always, join us on the Malcolm discussions board 💬 to engage with the community, or pop some corn 🍿 and watch a video 📼.

    #Malcolm #HedgehogLinux #Zeek #Arkime #Strelka #NetBox #OpenSearch #Elasticsearch #Suricata #PCAP #NetworkTrafficAnalysis #networksecuritymonitoring #OT #ICS #icssecurity #CyberSecurity #Cyber #Infosec #INL

    #malcolm #hedgehoglinux #zeek #arkime #strelka #netbox
  6. Seth Grover @[email protected] ·
    CW: release notes for Malcolm v26.07.0, a network traffic analysis tool suite for network security monitoring

    Malcolm v26.07.0 adds IEC 60870-5-104 (IEC 104) protocol support using CERT.LV's Zeek plugin, including Logstash parsing, ECS normalization, Arkime fields, and a new OpenSearch Dashboards dashboard. This release also fixes three archive extraction and authentication security vulnerabilities; improves NetBox enrichment configuration; and addresses PostgreSQL major version upgrade, custom CA certificate for KeyCloak, container health check, privilege-drop signal chaining, and configuration script issues. Arkime, Zeek, Fluent Bit, Filebeat, Logstash, Supercronic, and Alpine-based images have been updated as well.

    If you are upgrading from an existing Malcolm installation, run ./scripts/status for Malcolm to migrate some settings prior to running ./scripts/configure, ./scripts/start, or other Malcolm control scripts.

    github.com/idaholab/Malcolm/co

    • ✨ Features and enhancements

      • Add IEC 60870-5-104 (IEC 104) support using the CERT.LV spicy-iec104 Zeek plugin, including Zeek log ingestion, ECS field mapping, Arkime fields, and an IEC 104 dashboard #939
      • Make LOGSTASH_NETBOX_ENRICHMENT_DATASETS more flexible: it now accepts default, ics/ot, all, explicit provider.dataset values, and combinations such as default,ics #1037
      • Allow LOGSTASH_NETBOX_ENRICHMENT_DATASETS to be configured through checkboxes in the configuration TUI #1033
      • Improve ./scripts/start error messages by listing missing or invalid authentication-related files instead of reporting only a generic authentication setup failure #865
      • Have system-quickstart detect and prepopulate existing time synchronization settings when rerun #992

    • 🛡️ Security Remediation & Hardening

      • Fix an RBAC bypass caused by URI normalization differences between Nginx location matching and the Lua authorization layer CVE-2026-63177 #1042
      • Fix path traversal in archive extraction directory handling by validating resolved paths and using libarchive's secure extraction flags CVE-2026-63134 #1040
      • Limit archive entry count, nesting depth, and total expanded size to prevent inode- and resource-exhaustion denial of service during extraction CVE-2026-63133 #1041
      • Mark OpenID Connect session cookies as secure and improve handling of externally forwarded HTTPS schemes

    • 🐛 Bug fixes

      • Allow the configuration TUI to reset supported variables back to empty values after installation #1024, #1030
      • Fix the broken signal chain in docker-uid-gid-setup.sh so signals reach the final process after dropping privileges #1039 to ensure clean shutdown of containers
      • Fix PostgreSQL being reported unhealthy after a major-version upgrade, improve upgrade-state handling, and perform required post-upgrade extension and collation maintenance #1038
      • Fix the Nginx Lua/OpenID Connect helper not honoring user-provided CA certificates for KeyCloak when KEYCLOAK_SSL_VERIFY=true #1035
      • Restore curl to the the htadmin container for use by the health check script #1029
      • Reduce the size of the OpenSearch Dashboards image by copying only the permissions data needed from its upstream image layer #1031
      • Fix JSON handling of several Zeek fields whose names contain dots by normalizing them to underscore-separated field names
      • Fix additional Zeek and Suricata field normalization and ECS mapping inconsistencies found while updating dashboards and index templates

    • ✅ Component version updates

    • 🧹 Code and project maintenance

      • Broad spelling, grammar, naming consistency, and documentation cleanup across scripts, configuration, dashboards, and documentation #990
      • Expand and restructure documentation to provide better project context for developers and LLM-assisted code analysis #964
      • Improve installer validation, environment-variable mapping tests, and configuration item metadata
      • Refresh dashboards, index templates, field mappings, protocol documentation, and navigation links

    • 📄 Configuration changes for Malcolm (in environment variables in ./config/). The Malcolm control script (e.g., ./scripts/status, ./scripts/start) automatically handles creation and migration of variables according to ./config/env-var-actions.yml.

      • LOGSTASH_NETBOX_ENRICHMENT_DATASETS in logstash.env now defaults to default and may contain default, ics/ot, all, explicit provider.dataset values, or a comma-separated combination of these values
      • ZEEK_DISABLE_ICS_IEC104 in zeek.env controls whether the IEC 104 Zeek plugin is disabled
      • SAFE_EXTRACT_MAX_ENTRIES, SAFE_EXTRACT_MAX_DEPTH, and SAFE_EXTRACT_MAX_BYTES in upload-common.env set archive extraction resource limits for uploaded archive files (e.g., containing Zeek logs for processing); their defaults are 5,000 entries, 20 directory levels, and 4 GiB of expanded data

    • ❌ Errata

      • Post-release, a Strelka bug was found which can cause the strelka-backend container's work process to crash on aarch64 platforms (cisagov#1046). A followup v26.07.1 release addressing this issue is forthcoming.

    Malcolm is a powerful, easily deployable network 🖧 traffic analysis tool suite for network security monitoring 🕵🏻‍♀️.

    Malcolm operates as a cluster of containers 📦, isolated sandboxes which each serve a dedicated function of the system. This makes Malcolm deployable with frameworks like Docker 🐋, Podman 🦭, and Kubernetes ⎈. Check out the Quick Start guide for examples on how to get up and running.

    Alternatively, dedicated official ISO installer images 💿 for Malcolm and Hedgehog Linux 🦔 can be downloaded from Malcolm's releases page on GitHub. Due to limits on individual files in GitHub releases, these ISO files have been split 🪓 into 2GB chunks and can be reassembled with scripts provided for both Bash 🐧 (release_cleaver.sh) and PowerShell 🪟 (release_cleaver.ps1). See Downloading Malcolm - Installer ISOs for instructions.

    As always, join us on the Malcolm discussions board 💬 to engage with the community, or pop some corn 🍿 and watch a video 📼.

    #Malcolm #HedgehogLinux #Zeek #Arkime #Strelka #NetBox #OpenSearch #Elasticsearch #Suricata #PCAP #NetworkTrafficAnalysis #networksecuritymonitoring #OT #ICS #icssecurity #CyberSecurity #Cyber #Infosec #INL

    #inl #infosec #cyber #cybersecurity #icssecurity #ics
  7. adingbatponder :nixos: 👾 @adingbatponder ·

    I seem to be seeing that the addresses of some legit are being included in some of the lists used by to IP addresses, and so they might well end up blocked by your or
    in particular e.g. database might be flagging mesh nodes
    Please take steps for port 4242
    normally used by to not let bad data spoil the

    #ip #ipv4 #reticulum #nodes #suricata #ids
  8. adingbatponder :nixos: 👾 @[email protected] ·

    I seem to be seeing that the #ip #ipv4 addresses of some legit #reticulum #nodes are being included in some of the lists used by #suricata #IDS #intrustiondetectionsystem to #blacklist IP addresses, and so they might well end up blocked by your #firewall or #IPS #intrusionprotectionsystem
    in particular e.g. database #CINS might be flagging mesh nodes
    Please take steps for port 4242
    #port4242 normally used by #rns #reticulum to not let bad data spoil the #mesh #nomadnet #meshchat #meshchatx

    #ip #ipv4 #reticulum #nodes #suricata #ids
  9. adingbatponder :nixos: 👾 @adingbatponder ·

    Using and with manual checks using to identify IP addresses that are attacking my reverse proxy device. I block in the IPs that tick all three boxes:
    1. suricata reports attack,
    2. claude code investigates and confirms attack (and we log the CVE etc.), and
    3. IP is already high confidence bad actor.
    A bit slow really due to manual checking. How does one extend to ? What measures should one add?

    #suricata #ids #abuseipdb #claudecode #nftables #ipv6
  10. adingbatponder :nixos: 👾 @[email protected] ·

    Using #suricata #IDS and #abuseipdb with manual checks using #claudecode to identify IP addresses that are attacking my reverse proxy device. I block in #nftables the IPs that tick all three boxes:
    1. suricata reports attack,
    2. claude code investigates and confirms attack (and we log the CVE etc.), and
    3. IP is already high confidence bad actor.
    A bit slow really due to manual checking. How does one extend to #IPv6 ? What measures should one add? #portscanning

    #suricata #ids #abuseipdb #claudecode #nftables #ipv6
  11. adingbatponder :nixos: 👾 @[email protected] ·

    Using #suricata #IDS and #abuseipdb with manual checks using #claudecode to identify IP addresses that are attacking my reverse proxy device. I block in #nftables the IPs that tick all three boxes:
    1. suricata reports attack,
    2. claude code investigates and confirms attack (and we log the CVE etc.), and
    3. IP is already high confidence bad actor.
    A bit slow really due to manual checking. How does one extend to #IPv6 ? What measures should one add? #portscanning

    #suricata #ids #abuseipdb #claudecode #nftables #ipv6
  12. adingbatponder :nixos: 👾 @[email protected] ·

    Using #suricata #IDS and #abuseipdb with manual checks using #claudecode to identify IP addresses that are attacking my reverse proxy device. I block in #nftables the IPs that tick all three boxes:
    1. suricata reports attack,
    2. claude code investigates and confirms attack (and we log the CVE etc.), and
    3. IP is already high confidence bad actor.
    A bit slow really due to manual checking. How does one extend to #IPv6 ? What measures should one add? #portscanning

    #suricata #ids #abuseipdb #claudecode #nftables #ipv6
  13. adingbatponder :nixos: 👾 @[email protected] ·

    Using #suricata #IDS and #abuseipdb with manual checks using #claudecode to identify IP addresses that are attacking my reverse proxy device. I block in #nftables the IPs that tick all three boxes:
    1. suricata reports attack,
    2. claude code investigates and confirms attack (and we log the CVE etc.), and
    3. IP is already high confidence bad actor.
    A bit slow really due to manual checking. How does one extend to #IPv6 ? What measures should one add? #portscanning

    #portscanning #ipv6 #nftables #claudecode #abuseipdb #ids
  14. Suricata @[email protected] ·

    SuriCon is community-funded - sponsorships keep it self-sustaining.

    Spots remain from the $800 Mob tier (for individual super fans) up to Community Partner ($10K).

    And our last exclusive slot: Welcome Reception Sponsor ($6K).

    Secure your spot: suricon.net/sponsorships/

    #Suricata #SuriCon #SuriCon2026

    #suricata #suricon #suricon2026
  15. Suricata @[email protected] ·

    SuriCon is community-funded - sponsorships keep it self-sustaining.

    Spots remain from the $800 Mob tier (for individual super fans) up to Community Partner ($10K).

    And our last exclusive slot: Welcome Reception Sponsor ($6K).

    Secure your spot: suricon.net/sponsorships/

    #Suricata #SuriCon #SuriCon2026

    #suricata #suricon #suricon2026
  16. James_inthe_box @[email protected] ·

    Got tired of mucking with these miserable #screenconnect msi's so here's a #suricata rule to catch the initial check via sni:

    gist.github.com/silence-is-bes

    app.any.run/tasks/73887f39-a8a
    cc @da_667

    #screenconnect #suricata
  17. James_inthe_box @[email protected] ·

    Got tired of mucking with these miserable #screenconnect msi's so here's a #suricata rule to catch the initial check via sni:

    gist.github.com/silence-is-bes

    app.any.run/tasks/73887f39-a8a
    cc @da_667

    #screenconnect #suricata
  18. Jason Ish @[email protected] ·

    The Hunters Ledger ruleset was recently added to the #Suricata ruleset index; check it out here: the-hunters-ledger.com/

    Thank you Joseph Harrison (linkedin.com/in/josephrharriso)

    #suricata
  19. Jason Ish @[email protected] ·

    The Hunters Ledger ruleset was recently added to the #Suricata ruleset index; check it out here: the-hunters-ledger.com/

    Thank you Joseph Harrison (linkedin.com/in/josephrharriso)

    #suricata
  20. Graylog @[email protected] ·

    Suricata produces rich network telemetry, alerts, anomalies, flow data, DNS, TLS, SSH, Kerberos, and more, but raw EVE JSON isn't investigation ready on its own.

    The Suricata IDS/IPS Content Pack for Graylog parses, enriches, and maps that data to the Graylog Information Model, with a dashboard built in. Setup covers Filebeat via Sidecar or syslog forwarding.
    Full breakdown here: graylog.org/post/suricata-ids-
    #Graylog #Suricata #SIEM #ThreatHunting #InfoSec #NetworkSecurity

    #graylog #suricata #siem #threathunting #infosec #networksecurity
  21. Graylog @[email protected] ·

    Suricata produces rich network telemetry, alerts, anomalies, flow data, DNS, TLS, SSH, Kerberos, and more, but raw EVE JSON isn't investigation ready on its own.

    The Suricata IDS/IPS Content Pack for Graylog parses, enriches, and maps that data to the Graylog Information Model, with a dashboard built in. Setup covers Filebeat via Sidecar or syslog forwarding.
    Full breakdown here: graylog.org/post/suricata-ids-
    #Graylog #Suricata #SIEM #ThreatHunting #InfoSec #NetworkSecurity

    #graylog #suricata #siem #threathunting #infosec #networksecurity
  22. Suricata @[email protected] ·

    We're pleased to announce the releases of #Suricata 8.0.6 and 7.0.17! 🎉
    With this, Suricata 7 series has reached its #EOL.

    See the release notes at forum.suricata.io/t/suricata-8

    #suricata #eol
  23. Suricata @[email protected] ·

    We're pleased to announce the releases of #Suricata 8.0.6 and 7.0.17! 🎉
    With this, Suricata 7 series has reached its #EOL.

    See the release notes at forum.suricata.io/t/suricata-8

    #suricata #eol
  24. Federico Fantini @[email protected] ·

    Are you using #wazuh and want to integrate threat intelligence today? These two posts might interest you:

    blog.federicofantini.net/blog/

    blog.federicofantini.net/blog/

    #wazuh #opencti #homelab #sysmon #suricata #threatintel #retrohunting

    #wazuh #opencti #homelab #sysmon #suricata #threatintel
  25. jufajardini @[email protected] ·

    RE: infosec.exchange/@suricata/116

    These are cute. And cool.

    And the different messages that they represent and embrace are part of why I truly love #suricata project and community.

    #suricata
  26. Suricata @[email protected] ·

    Future Suricata contributors start small. These little shirts are a playful community moment, but this is how open source lasts. It stays useful today while remaining open to the people who will shape what comes next.

    Some future contributors are still growing into the shirt 🧸

    #Suricata

    #suricata
  27. Suricata @[email protected] ·

    Future Suricata contributors start small. These little shirts are a playful community moment, but this is how open source lasts. It stays useful today while remaining open to the people who will shape what comes next.

    Some future contributors are still growing into the shirt 🧸

    #Suricata

    #suricata
  28. Suricata @[email protected] ·

    #Suricata powers many of today’s leading network detection and response solutions, including Clear NDR Community, which is widely used by practitioners to explore what is possible with Suricata IDS/IPS/NSM and the network protocol monitoring logs and alerts it produces.

    #IDS #IPS #NSM

    #suricata #ids #ips #nsm
  29. Suricata @[email protected] ·

    #Suricata powers many of today’s leading network detection and response solutions, including Clear NDR Community, which is widely used by practitioners to explore what is possible with Suricata IDS/IPS/NSM and the network protocol monitoring logs and alerts it produces.

    #IDS #IPS #NSM

    #suricata #ids #ips #nsm
  30. Suricata @[email protected] ·

    #Suricata powers many of today’s leading network detection and response solutions, including Clear NDR Community, which is widely used by practitioners to explore what is possible with Suricata IDS/IPS/NSM and the network protocol monitoring logs and alerts it produces.

    #IDS #IPS #NSM

    #suricata #ids #ips #nsm
  31. Suricata @[email protected] ·

    #Suricata powers many of today’s leading network detection and response solutions, including Clear NDR Community, which is widely used by practitioners to explore what is possible with Suricata IDS/IPS/NSM and the network protocol monitoring logs and alerts it produces.

    #IDS #IPS #NSM

    #suricata #ids #ips #nsm
  32. Suricata @[email protected] ·

    #Suricata powers many of today’s leading network detection and response solutions, including Clear NDR Community, which is widely used by practitioners to explore what is possible with Suricata IDS/IPS/NSM and the network protocol monitoring logs and alerts it produces.

    #IDS #IPS #NSM

    #nsm #ips #ids #suricata
  33. Suricata @[email protected] ·

    Heading to BSides Porto?

    Be sure to connect with
    @jufajardini . She’ll be there representing Suricata on Saturday.

    Find her and chat about open source security, and don’t forget to ask her for some Suricata swag.

    bsidesporto.org

    #Suricata #BSidesPorto #OpenSource #Cybersecurity

    #suricata #bsidesporto #opensource #cybersecurity
  34. Suricata @[email protected] ·

    Heading to BSides Porto?

    Be sure to connect with
    @jufajardini . She’ll be there representing Suricata on Saturday.

    Find her and chat about open source security, and don’t forget to ask her for some Suricata swag.

    bsidesporto.org

    #Suricata #BSidesPorto #OpenSource #Cybersecurity

    #suricata #bsidesporto #opensource #cybersecurity
  35. Suricata @[email protected] ·

    Major releases take time. They evolve through development, testing, review, feedback, and real deployment needs.

    If you use #Suricata today, what should be improved or carried forward toward Suricata 9?

    Share your thoughts now, or bring them to #SuriCon .

    #suricata #suricon
  36. Suricata @[email protected] ·

    Major releases take time. They evolve through development, testing, review, feedback, and real deployment needs.

    If you use #Suricata today, what should be improved or carried forward toward Suricata 9?

    Share your thoughts now, or bring them to #SuriCon .

    #suricata #suricon
  37. Doug Burks @[email protected] ·

    🚀 SO-CRATES 1.1 is here — now with Light Mode! ☀️

    The tool you loved as OhMyPCAP keeps getting better.

    Your all-in-one Docker/Podman container for rapid analysis of PCAPs, logs, and binaries just leveled up.

    ✅ PCAPs → Suricata alerts, rich metadata, ASCII transcripts, stream carving
    ✅ Logs → Sigma alerts + originals
    ✅ Binaries → YARA matches + metadata

    Perfect for air-gapped environments, malware analysis, IR, threat hunting, forensics & teaching.

    What’s your preference?
    → Dark Mode 🖤
    → Light Mode ☀️
    → Why not both?
    → Needs glorious 4-color CGA option lol
    Comment below!

    #DFIR #Cybersecurity #BlueTeam #ThreatHunting #Suricata #YARA #Sigma #DarkMode #LightMode

    #dfir #cybersecurity #blueteam #threathunting #suricata #yara
  38. Doug Burks @[email protected] ·

    🚀 SO-CRATES 1.1 is here — now with Light Mode! ☀️

    The tool you loved as OhMyPCAP keeps getting better.

    Your all-in-one Docker/Podman container for rapid analysis of PCAPs, logs, and binaries just leveled up.

    ✅ PCAPs → Suricata alerts, rich metadata, ASCII transcripts, stream carving
    ✅ Logs → Sigma alerts + originals
    ✅ Binaries → YARA matches + metadata

    Perfect for air-gapped environments, malware analysis, IR, threat hunting, forensics & teaching.

    What’s your preference?
    → Dark Mode 🖤
    → Light Mode ☀️
    → Why not both?
    → Needs glorious 4-color CGA option lol
    Comment below!

    #DFIR #Cybersecurity #BlueTeam #ThreatHunting #Suricata #YARA #Sigma #DarkMode #LightMode

    #dfir #cybersecurity #blueteam #threathunting #suricata #yara
  39. Doug Burks @[email protected] ·

    🚀 SO-CRATES 1.1 is here — now with Light Mode! ☀️

    The tool you loved as OhMyPCAP keeps getting better.

    Your all-in-one Docker/Podman container for rapid analysis of PCAPs, logs, and binaries just leveled up.

    ✅ PCAPs → Suricata alerts, rich metadata, ASCII transcripts, stream carving
    ✅ Logs → Sigma alerts + originals
    ✅ Binaries → YARA matches + metadata

    Perfect for air-gapped environments, malware analysis, IR, threat hunting, forensics & teaching.

    What’s your preference?
    → Dark Mode 🖤
    → Light Mode ☀️
    → Why not both?
    → Needs glorious 4-color CGA option lol
    Comment below!

    #DFIR #Cybersecurity #BlueTeam #ThreatHunting #Suricata #YARA #Sigma #DarkMode #LightMode

    #lightmode #darkmode #sigma #yara #suricata #threathunting
  40. Habr @[email protected] ·

    Как работает эта ваша суриката 3 часть

    Третья часть цикла статей по разбору устройства работы IDS/IPS решения Suricata. Разберём на практике уязвимость CVE‑2025‑66698 – обход аутентификации в Veda (Semantic Machines) v5.4.8. Запишем трафик с вредоносными запросами и составим suricata-правило, которое детектирует эксплуатацию уязвимости. В статье также приводятся объяснения как работают content, pcre и липкие буферы.

    habr.com/ru/articles/1049776/

    #suricata #dalton #wireshark #безопасность_сети #dpi #ids

    #ids #dpi #безопасность_сети #wireshark #dalton #suricata
  41. Habr @[email protected] ·

    Как работает эта ваша суриката 3 часть

    Третья часть цикла статей по разбору устройства работы IDS/IPS решения Suricata. Разберём на практике уязвимость CVE‑2025‑66698 – обход аутентификации в Veda (Semantic Machines) v5.4.8. Запишем трафик с вредоносными запросами и составим suricata-правило, которое детектирует эксплуатацию уязвимости. В статье также приводятся объяснения как работают content, pcre и липкие буферы.

    habr.com/ru/articles/1049776/

    #suricata #dalton #wireshark #безопасность_сети #dpi #ids

    #ids #dpi #безопасность_сети #wireshark #dalton #suricata
  42. Habr @[email protected] ·

    Как работает эта ваша суриката 3 часть

    Третья часть цикла статей по разбору устройства работы IDS/IPS решения Suricata. Разберём на практике уязвимость CVE‑2025‑66698 – обход аутентификации в Veda (Semantic Machines) v5.4.8. Запишем трафик с вредоносными запросами и составим suricata-правило, которое детектирует эксплуатацию уязвимости. В статье также приводятся объяснения как работают content, pcre и липкие буферы.

    habr.com/ru/articles/1049776/

    #suricata #dalton #wireshark #безопасность_сети #dpi #ids

    #suricata #dalton #wireshark #безопасность_сети #dpi #ids
  43. Suricata @[email protected] ·

    Two opportunities to learn more on Suricata this August, at BlackHat.

    For those who learn best through real traffic, rules, tuning, and workflow questions, this is one to keep on the radar. Suricata’s value is clearest when you can see it in practice.

    August 5: blackhat.com/us-26/arsenal/sch

    August 6: blackhat.com/us-26/arsenal/sch

    #Suricata #BlackHatUSA2026

    #suricata #blackhatusa2026
  44. Suricata @[email protected] ·

    Two opportunities to learn more on Suricata this August, at BlackHat.

    For those who learn best through real traffic, rules, tuning, and workflow questions, this is one to keep on the radar. Suricata’s value is clearest when you can see it in practice.

    August 5: blackhat.com/us-26/arsenal/sch

    August 6: blackhat.com/us-26/arsenal/sch

    #Suricata #BlackHatUSA2026

    #suricata #blackhatusa2026
  45. Suricata @[email protected] ·

    New in Suricata 9 and available in main, the `subslice` transform keyword creates a bounded window from a sticky buffer before content matching.

    Jeff Lucovsky covers how it works, with URI-ending, header-skipping, and short User-Agent examples.

    suricata.io/2026/06/16/suricat

    #SuricataTips #Suricata

    #suricatatips #suricata
  46. Suricata @[email protected] ·

    New in Suricata 9 and available in main, the `subslice` transform keyword creates a bounded window from a sticky buffer before content matching.

    Jeff Lucovsky covers how it works, with URI-ending, header-skipping, and short User-Agent examples.

    suricata.io/2026/06/16/suricat

    #SuricataTips #Suricata

    #suricatatips #suricata
  47. Suricata @[email protected] ·

    SuriCon 2026 is taking shape in Lisbon.

    Sponsor support helps make the event possible. Thank you to OPNsense, Léargas Security, Stamus Networks, AWS, and Corelight for helping create space for training, technical conversations, and community work.

    Become a sponsor: suricon.net/sponsorships/

    #Suricata #SuriCon2026 #Sponsors

    #suricata #suricon2026 #sponsors
  48. Suricata @[email protected] ·

    SuriCon 2026 is taking shape in Lisbon.

    Sponsor support helps make the event possible. Thank you to OPNsense, Léargas Security, Stamus Networks, AWS, and Corelight for helping create space for training, technical conversations, and community work.

    Become a sponsor: suricon.net/sponsorships/

    #Suricata #SuriCon2026 #Sponsors

    #suricata #suricon2026 #sponsors
  49. Habr @[email protected] ·

    Как работает эта ваша суриката 2 часть

    Вторая часть цикла статей о практическом применении Suricata IDS/IPS. Рассмотрим базовые модификаторы Suricata на примерах DNS-запросов и на сетевых атаках. Уделим внимание механизму threshold для предотвращения флуда алертов.

    habr.com/ru/articles/1047804/

    #suricata #dalton #безопасность_сети #ids #dpi

    #dpi #ids #безопасность_сети #dalton #suricata
  50. Habr @[email protected] ·

    Как работает эта ваша суриката 2 часть

    Вторая часть цикла статей о практическом применении Suricata IDS/IPS. Рассмотрим базовые модификаторы Suricata на примерах DNS-запросов и на сетевых атаках. Уделим внимание механизму threshold для предотвращения флуда алертов.

    habr.com/ru/articles/1047804/

    #suricata #dalton #безопасность_сети #ids #dpi

    #dpi #ids #безопасность_сети #dalton #suricata