Code

Malcolm v23.12.0#290

Code

Merged

mmguero merged 84 commits intomaincisagov/Malcolm:mainfrom v23.12.0_merge_cisagovcisagov/Malcolm:v23.12.0_merge_cisagovCopy head branch name to clipboardDec 5, 2023

+3,077-1,664

Commits

Commits on Oct 26, 2023

• bump for v23.11.0 development

  mmguero

  committed
  fa17a78

• add option to auto-create catch-all netbox IPAM prefixes for private IP space (idaholab#279)

  mmguero

  committed
  308a1b0

• add option to auto-create catch-all netbox IPAM prefixes for private IP space (idaholab#279)

  mmguero

  committed
  e20983c

• reduce verbosity of netbox

  mmguero

  committed
  edd49a1

• add option to auto-create catch-all netbox IPAM prefixes for private IP space (idaholab#279)

  mmguero

  committed
  94e8f76

• address issues with NetBox database and Logstash's NetBox cache (idaholab#259); work in progress, almost certainly broken in this state

  mmguero

  committed
  cab66bd

Commits on Oct 27, 2023

• work in pgoress for address issues with NetBox database and Logstash's NetBox cache (idaholab#259)

  mmguero

  committed
  8831476

• work in pgoress for address issues with NetBox database and Logstash's NetBox cache, should fix locking issues (idaholab#259)

  mmguero

  committed
  20a89d5

• specify lru_redux in the gemspec

  mmguero

  committed
  16d5053

• address issues with NetBox database and Logstash's NetBox cache (idaholab#259); restore caching for performance reasons, but decrease TTL significantly and allow it to be specified via environment …

  Show description for 92b4b34
  mmguero

  committed
  92b4b34

• bump Werkzeug to v3.0.1 as patch for DoS 'High resource usage when parsing multipart/form-data containing a large part with CR/LF character at the beginning'

  mmguero

  committed
  12b4f57

• allow specifying capture parameters when orchmode is kubernetes

  mmguero

  committed
  86a41d0

Commits on Oct 30, 2023

• Update Zeek to v6.1.0

  mmguero

  committed
  b4f8d44

• point downstream to mmguero-dev/icsnpp-modbus until cisagov/icsnpp-modbus#8 is pulled

  mmguero

  committed
  ed99af5

Commits on Oct 31, 2023

• Working on zeek v6.1.0 build

  mmguero

  committed
  da45848

• update some of the documentation for docker compose (v2) as a plugin rather than a standalone script

  mmguero

  committed
  70c7773

• update some of the documentation for docker compose (v2) as a plugin rather than a standalone script

  mmguero

  committed
  c9742bb

• fix zeek build

  mmguero

  committed
  be6a9df

• use spicy disable protocol analyzer for LDAP

  mmguero

  committed
  3aa72fc

• point back upstream for a few of the plugins

  mmguero

  committed
  30a05d9

• use prefix.description instead of VRF for identifying subnets in NetBox (idaholab#280); needs testing

  mmguero

  committed
  2a804c6

Commits on Nov 1, 2023

• use docker compose as a plugin rather than docker-compose when possible

  mmguero

  committed
  69ce77c

• fix issue with logs

  mmguero

  committed
  4be0d17

• fix issue parsing dns.ip

  mmguero

  committed
  fd69cad

• make sure preloaded prefixes get populated with default site name (idaholab#279)

  mmguero

  committed
  e518880

• fix start not stopping log display

  mmguero

  committed
  c2f043e

• fix issue with prefix name not being used for segments correctly (idaholab#280)

  mmguero

  committed
  570fce9

Commits on Nov 8, 2023

• update logstash (https://www.elastic.co/guide/en/logstash/current/logstash-8-11-0.html) and beats (https://www.elastic.co/guide/en/beats/libbeat/current/release-notes-8.11.0.html) to v8.11.0

  mmguero

  committed
  326b8f6

Commits on Nov 9, 2023

• Fluent-bit to v2.2.0 (https://github.com/fluent/fluent-bit/releases/tag/v2.2.0)

  mmguero

  committed
  5dbb346

Commits on Nov 10, 2023

• various updates for v23.11.0 development:

  Show description for 0a6565d
  mmguero

  committed
  0a6565d

• Fix logstash parser issues with ldap (idaholab#289)

  mmguero

  committed
  61e3b6e

Commits on Nov 13, 2023

• elasticsearch python libraries to 8.11.0

  mmguero

  committed
  3934eae

• idaholab#275, integrate suricata version of nsacyber ELITEWOLF rules

  mmguero

  committed
  baebc49

• added https://github.com/reversinglabs/reversinglabs-yara-rules yara rule set

  mmguero

  committed
  b0826dd

• update logstash and beats to 8.11.1

  mmguero

  committed
  99afed6

• Work in progress for idaholab#287

  mmguero

  committed
  9b1253a

• better startup for netbox restore

  mmguero

  committed
  de41962

• fix idaholab#287; fix issue with SUPERUSER_API_TOKEN not being set correctly after netbox-restore

  mmguero

  committed
  48bca91

Commits on Nov 14, 2023

• idaholab#286, strip out broken Arkime and NetBox links from dashboards for Kibana import

  mmguero

  committed
  fd6d050

• idaholab#285, allow customizing Arkime's freeSpaceG setting (for PCAP deletion) in an environment variable

  mmguero

  committed
  b7133e3

• fix file type validation not working for upload from (some?) windows browsers (idaholab#292) by removig front-end validation and just relying on the backend to do it

  mmguero

  committed
  684d69f

• improve error messages for PCAP/artifact processing beyond just icons, idaholab#276

  mmguero

  committed
  f3c9872

• idaholab#147, replace kbn_sankey with vega

  mmguero

  committed
  a0dc39a

Commits on Nov 15, 2023

• allow netbox to restore database from preload directory if it exists

  mmguero

  committed
  1ceddc7

• documentation tweak for idaholab#294

  mmguero

  committed
  ea76ffb

• idaholab#294, put netbox restore database functionality inside container (still need to test K8s)

  mmguero

  committed
  d111631

• bump opensearch-py to v2.4.0

  mmguero

  committed
  cdaf056

• Revert "bump opensearch-py to v2.4.0"

  Show description for ecf5599
  mmguero

  committed
  ecf5599

Commits on Nov 16, 2023

• opensearch-py to 2.4.1

  mmguero

  committed
  9d8861c

• idaholab#294, fix a minor bug when preload gz is not specified

  mmguero

  committed
  cba9dc9

• for idaholab#280, on restore of an older database migrate ipam_vrf.name to ipam_prefix.description

  mmguero

  committed
  c2e6008

• for idaholab#280, on restore of an older database migrate ipam_vrf.name to ipam_prefix.description (todo, need to do it in regular startup)

  mmguero

  committed
  b22ea96

Commits on Nov 20, 2023

• bump opensearch-py to v2.4.2

  mmguero

  committed
  379054f

• idaholab#295, specify local networks via ZEEK_LOCAL_NETS environment variable

  mmguero

  committed
  54d7c15

Commits on Nov 21, 2023

• fix idaholab#294, put netbox restore database functionality inside container for kubernetes

  mmguero

  committed
  301b2a7

• restore kubernetes image names in prep for release

  mmguero

  committed
  95b3c2a

• for idaholab#299, fix a vim and libx11 vulnerability in a few packages (by removing those dependencies which we don't really need)

  mmguero

  committed
  103da34

Commits on Nov 22, 2023

• idaholab#280, update existing prefixes to VRF on startup for backwards compatibility

  mmguero

  committed
  e5405bb

• rework y axis of results visualization

  mmguero

  committed
  2bd9578

Commits on Nov 27, 2023

• update supercronic to v0.2.28 (https://github.com/aptible/supercronic/releases/tag/v0.2.28)

  mmguero

  committed
  2808618

• update supercronic to v0.2.28 (https://github.com/aptible/supercronic/releases/tag/v0.2.28)

  mmguero

  committed
  ff81092

Commits on Nov 28, 2023

• flesh out automatic config for virter

  mmguero

  committed
  0a1bf36

• one minor tweak to idaholab#147, allow vega visualizations to import for elasticsearch

  mmguero

  committed
  9059cf2

• idaholab#301, allow configuration of docker's logging driver to prevent disk-exhaustion

  mmguero

  committed
  2331293

Commits on Nov 29, 2023

• idaholab#302, allow user to include other suricata config YML files

  mmguero

  committed
  70684fb

• idaholab#303, allow user to include custom zeek config

  mmguero

  committed
  7338264

• idaholab#303, allow user to include custom zeek config

  mmguero

  committed
  1a199dc

• idaholab#303, allow user to include custom zeek config

  mmguero

  committed
  3684c75

Commits on Nov 30, 2023

• httpupdate netbox to v3.6.6 (https://github.com/netbox-community/netbox/releases/tag/v3.6.6)

  mmguero

  committed
  6861469

• as it's Nov 30th and the fix for idaholab#298 isn't out yet, renaming the release to v23.12.0

  mmguero

  committed
  b499390

• documentation updates for idaholab#302 and idaholab#303, custom configuration for Suricata and Zeek

  mmguero

  committed
  e46b8d6

• allow suricata config to tune max-pending-packets with SURICATA_MAX_PENDING_PACKETS variable

  mmguero

  committed
  33c655c

Commits on Dec 1, 2023

• idaholab#298, bump opensearch to v2.11.1

  mmguero

  committed
  ad937ed

Commits on Dec 4, 2023

• update branding/logos

  mmguero

  committed
  f96a922

• update/fix branding for v2.11.1

  mmguero

  committed
  5ae973e

• update documentation SHA sums

  mmguero

  committed
  36af1c1

• fix issue with image name for kubernetes

  mmguero

  committed
  da0886d

• Merge branch 'development' of https://github.com/mmguero-dev/Malcolm into v23.12.0_merge_cisagov

  mmguero

  committed
  ef9fd17

• issue with K8s with zeek custom/intel

  mmguero

  committed
  14970bd

• fix issue loading zeek intel on startup

  mmguero

  committed
  7cc9e10

• fix issue loading zeek intel on startup

  mmguero

  committed
  acbe2d3

• fix issue loading zeek intel on startup

  mmguero

  committed
  39bdbd5

• sha1sum update

  mmguero

  committed
  eca0c86

• Merge branch 'development' of https://github.com/mmguero-dev/Malcolm into v23.12.0_merge_cisagov

  mmguero

  committed
  9bb1733