Malcolm v23.10.0 development #287

mmguero · 2023-10-25T20:51:53Z

Malcolm v23.10.0 is a feature release.

v23.09.0...v23.10.0

Features and enhancements
- support both OpenSearch and Elasticsearch output (support both ElasticSearch and OpenSearch output idaholab/Malcolm#258)
- "capture-only" Malcolm configuration (AKA "dockerized Hedgehog") ("capture-only" Malcolm configuration (aka "dockerized Hedgehog") idaholab/Malcolm#254)
- don't run kiosk mode on Hedgehog first boot (hedgehog: don't run kiosk mode on first boot idaholab/Malcolm#263)
- let Arkime check its own database to see if it needs to be upgraded
- allow specifying Arkime password hash secret for Viewer clusters
- documentation improvements
- minor updates to slide decks
- allow specifying ports for EtherNet/IP parser via environment variable
Component version updates
- Arkime to v4.6.0
- supercronic to v0.2.27
- beats to v8.10.4
- Logstash to v8.10.4
- NetBox to v3.6.4
- Fluent Bit to v2.1.10
Bug fixes
- set "autorestart" to true for all started services (set "autorestart" to true for all started services idaholab/Malcolm#267)
- changed toolchain for building Zeek and Zeek plugins to clang/libc++ to address some build issues with Spicy plugins using GCC
- ensure Arkime is started before creating OpenSearch artifacts
- ensure Arkime and OpenSearch artifacts are populated before starting LogStash
- don't log "0.0" temperatures from Fluent Bit thermal forwarders

…n; added malcolm and hedgehog profiles to docker-compose

…search-project/OpenSearch-Dashboards#4694. checking in for tracking purposes only

…-py/releases/tag/v8.10.1)

… v23.10.0

…/releases/tag/v0.2.27)

* allow specifying ZEEK_ENIP_PORTS environment variable * fix OPCUA binary .log files to include new host/port/is_orig values

… vs. hedgehog profile) idaholab#254

This reverts commit b852596.

…into v23.10.0_merge_cisagov

mmguero added 30 commits September 18, 2023 08:30

update slides slightly

27afe92

Bump development for v23.10.0

d4f8cad

Bump beats and logstash to v8.10.1

104d50b

don't run Kiosk mode on first boot or in live boot mode (idaholab#263)

5e46e0f

work in progress on idaholab#258

c29a97d

work in progress on idaholab#258

7b57c89

work in progress on idaholab#258

d1c8808

work in progress on idaholab#258

03d17de

work in progress on idaholab#258

177edba

some initial work for idaholab#254, capt-re-only malcolm configuratio…

a000fb3

…n; added malcolm and hedgehog profiles to docker-compose

work in progress on idaholab#254

22af0f2

documentation

67ef52f

work in progress on idaholab#254

94205fb

work in progress on idaholab#254

ab3ac80

work in progress on idaholab#254

022522a

fix some minor bugs with noninteractive mode

96adda0

work in progress on idaholab#254

5dcfd70

special check for opensearch in service disable

52872ee

work in progress on idaholab#254

feceeb0

Added fx

3cde633

work in progress on idaholab#254

ae681f3

fix labels for non-dialog prompts

f3f817b

work in progress on idaholab#254

cdea02b

sync time once with htpdate without waiting for the interval

63d9866

bump beats and logstash to 8.10.2

b722732

documentation work in progress on idaholab#254

725d29d

bump netbox to v3.6.2

c5f513d

for idaholab#254, specify host to capture if provided

29d5894

for idaholab#254, specify node host or iP in configuration

2016400

update opensearch to v2.10.0, but will immediately revert due to open…

97852ca

…search-project/OpenSearch-Dashboards#4694. checking in for tracking purposes only

mmguero added 28 commits October 13, 2023 10:20

Set password secret for Arkime

498e609

build zeek with clang/libc++

cedaf8b

build zeek on sensor with clang

4c6bd0d

elasticsearch-py to v8.10.1 (https://github.com/elastic/elasticsearch…

066fd92

…-py/releases/tag/v8.10.1)

Added flightsim, remove starship

c433905

change references in kubernetes manifests prior to prepping a release…

e16b3af

… v23.10.0

Update supercronic to v0.2.27 (https://github.com/aptible/supercronic…

64833c2

…/releases/tag/v0.2.27)

bump urllib3 to v1.26.18

d90206f

Bump beats and logstash to v8.10.4 and netbox to v3.6.4

d5e1425

bump arkime to v4.6.0

0f70430

summary of changes:

ffed601

* allow specifying ZEEK_ENIP_PORTS environment variable * fix OPCUA binary .log files to include new host/port/is_orig values

don't log successful netbox post/patch

1713c7e

implement 'execution profiles' in Kuberetes deployment (e.g., malcolm…

12fcaec

… vs. hedgehog profile) idaholab#254

MALCOLM_NAMESPACE via env. variable

f8eb781

default to empty list for deep_get

cb1a4db

allow env variables for install.py

81c3ab7

Fix issues with elasticsearch API

5ae09a7

set @timestamp with a date filter

b852596

delete redundant patch

4100015

Revert "set @timestamp with a date filter"

122c33d

This reverts commit b852596.

fix mapi health for elasticsearch

ce883c9

added mode to api health info

4e56ea8

Added mode to documentation

5975ff7

Fix capture configuration input

18a16c7

fix zeek build in sensor (hopefully)

12e6efa

fix zeek build in sensor (hopefully part 2)

1eb617e

add SHA sums for v23.10.0 ISOs

d371e60

Merge branch 'development' of https://github.com/mmguero-dev/Malcolm …

d9e4732

…into v23.10.0_merge_cisagov

mmguero merged commit 72cb1d1 into main Oct 26, 2023
3 checks passed

mmguero deleted the v23.10.0_merge_cisagov branch October 26, 2023 02:19

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Malcolm v23.10.0 development #287

Malcolm v23.10.0 development #287

mmguero commented Oct 25, 2023 •

edited

Loading

Malcolm v23.10.0 development #287

Malcolm v23.10.0 development #287

Conversation

mmguero commented Oct 25, 2023 • edited Loading

mmguero commented Oct 25, 2023 •

edited

Loading