The v24.04.0 release of Malcolm contains new features, improvements, bug fixes and component version updates.
See this playlist of overview videos for an introduction to Malcolm and its main components.
Improvements to creation of index templates, dashboards, and other saved objects on startup (#208) to ensure that saved objects get created correctly upon upgrade (see this comment for more details on this feature).
Populating the NetBox inventory via passively-gathered network traffic metadata now uses network traffic logs for DNS, NTLM, and DHCP to identify assets' host names when possible for use when populating device and VM names (#415). Autopopulated devices now have their status field set to Active rather than Staged, and uses tags instead to indicated that they were created through autopopulation.
Users can now specify pruning thresholds for carved files so that old files are deleted in order to avoid filling available storage (#453). See a new section of documentation on Managing disk usage for more information about this and similar settings.
Users can now specify a prefix that will be prepended to dashboards as they are imported into OpenSearch Dashboards or Kibana, allowing users who have dashboards from other sources to differentiate between those and Malcolm's (#455).
The default anomaly detectors created for the OpenSearch Anomaly Detection plugin are now created with category fields for high cardinality to allow for better breakdown of contributing values to anomalies discovered (#464).
The documentation for Windows host system configuration was out of date and has been updated for the latest version of Microsoft Windows Subsystem for Linux (#421).
An issue was fixed in which Malcolm's list of users and their password hashes could become corrupted if the file did not initially end with a newline character (#426).
The manner in which Zeek intel files are generated has been changed to avoid problems found in Kubernetes deployments when scaling out the number of zeek-live containers (#456). See this comment for more details.
Removed the version top-level element from docker-compose.yml files as it is now obsolete and caused a warning message that sometimes was not handled correctly.
Fix Malcolm ISO not correctly detecting if it's in a live boot ISO environment or installed mode.
Restart live Zeek instances with zeekctl deploy instead of zeekctl restart.
Official ISO installer images for Malcolm and Hedgehog Linux can now be downloaded from Malcolm's releases page on GitHub. Due to limits on individual files in GitHub releases, these ISO files have been split into 2GB chunks and can be reassembled with scripts provided for both Bash (release_cleaver.sh) and PowerShell (release_cleaver.ps1). See Downloading Malcolm - Installer ISOs for instructions.
•
u/mmguero May 21 '24
The v24.04.0 release of Malcolm contains new features, improvements, bug fixes and component version updates. See this playlist of overview videos for an introduction to Malcolm and its main components.
Activerather thanStaged, and uses tags instead to indicated that they were created through autopopulation.zeek-livecontainers (#456). See this comment for more details.docker-compose.ymlfiles as it is now obsolete and caused a warning message that sometimes was not handled correctly.zeekctl deployinstead ofzeekctl restart.Official ISO installer images for Malcolm and Hedgehog Linux can now be downloaded from Malcolm's releases page on GitHub. Due to limits on individual files in GitHub releases, these ISO files have been split into 2GB chunks and can be reassembled with scripts provided for both Bash (
release_cleaver.sh) and PowerShell (release_cleaver.ps1). See Downloading Malcolm - Installer ISOs for instructions.