Malcolm v23.12.0

[mmguero]

Malcolm v23.12.0 is a feature release with many improvements, updates and fixes

v23.10.0...v23.12.0

• Features and enhancements
  • replace kbn_sankey_vis with vega or transform (replace kbn_sankey_vis with vega or transform #147)
  • address issues with NetBox database and Logstash's NetBox cache (address issues with NetBox database and Logstash's NetBox cache #259)
  • integrate nsacyber/ELITEWOLF signatures into default rule set CISA (integrate nsacyber/ELITEWOLF signatures into default rule set #275)
  • improve error messages for PCAP/artifact processing beyond just icons (improve error messages for PCAP/artifact processing beyond just icons #276)
  • option to auto-create "catch-all" NetBox IPAM prefixes for private IP space (option to auto-create "catch-all" NetBox IPAM prefixes for private IP space #279)
  • use prefix.description instead of VRF for identifying subnets in NetBox (use prefix.description instead of VRF for identifying subnets in NetBox #280)
  • allow customizing Arkime's freeSpaceG setting (for PCAP deletion) in an environment variable (allow customizing Arkime's freeSpaceG setting (for PCAP deletion) in an environment variable #285)
  • replace master/slave with client/server when parsing modbus logs (replace master/slave with client/server when parsing modbus logs #291)
  • put netbox restore database functionality inside container (put netbox restore database functionality inside container #294)
  • provide way to customize zeek Site::local_nets (provide way to customze Site::local_nets #295)
  • allow configuration of docker's logging driver to prevent disk-exhaustion (allow configuration of docker's logging driver to prevent disk-exhaustion #301)
  • allow user to include other suricata config YML files (allow user to include other suricata config YML files #302)
  • allow user to be able to provide custom zeek config (allow user to be able to provide custom zeek config #303)
  • allow tuning Suricata's max-pending-packets via environment variable (allow tuning Suricata's max-pending-packets via environment variable #304)
  • enable OpenSearch dashboards condensed header
• Component version updates
  • Alpine Linux to v3.18.5
  • elasticsearch-py to v8.11.0
  • Logstash to v8.11.1
  • NetBox v3.6.6
  • OpenSearch and OpenSearch Dashboards (update OpenSearch to v2.11.1 #298)
    • v2.9.0
    • v2.10.0
    • v2.11.0
    • v2.11.1
  • opensearch-py to v2.4.2
  • supercronic to v0.2.28
  • Zeek to v6.1.0
    • Update logstash parsers for Zeek v6.1.0 (logstash parser issues to fix for v23.11.0 #289)
• Bug fixes
  • Malcolm Sensor Temperature dashboard issue (Malcolm Sensor Temperature dashboard issue #265)
  • strip out broken Arkime and NetBox links from dashboards for Kibana import (strip out broken Arkime and NetBox links from dashboards for Kibana import #286)
  • have netbox-restore script restart necessary services or set necessary permissions (have netbox-restore script restart necessary services or set necessary permissions #287)
  • file type validation not working for upload from (some?) windows browsers (file type validation not working for upload from (some?) windows browsers #292)
  • go through list of Qualys image scan results (go through list of Qualys image scan security findings #299)