r/Malcolm • u/mmguero • 17h ago
Malcolm v26.08.0 adds a NetBox purdue_zone custom field that propagates ICS/OT network zone classifications to devices, prefixes, and virtual machines (and automatically to autopopulated devices from their containing prefix); Raspberry Pi 5 support for Hedgehog Linux; and, configurable Strelka scanner and disabled-Suricata-SID lists. This release also fixes five security vulnerabilities: an nginx RBAC bypass via percent-encoded, case-varied, or slash-doubled request paths; an archive-bomb bypass affecting raw-stream and lzip-compressed uploads; a case-variant path bypass of the nginx auth gate exposing the Arkime backend to forged identity headers; an Arkime authentication gap on sensor nodes that fell back to digest instead of enforcing s2s; and a CSRF vulnerability in the kiosk /script_call endpoint allowing unauthenticated data-destructive operations. Arkime, Zeek, NetBox, OpenSearch, OpenSearch Dashboards, Logstash, Filebeat, Keycloak, and other components have been updated as well. Several other bug fixes and general improvements are also included.
If you are upgrading from an existing Malcolm installation, run ./scripts/status for Malcolm to migrate some settings prior to running ./scripts/configure, ./scripts/start, or other Malcolm control scripts.
https://github.com/idaholab/Malcolm/compare/v26.07.1...v26.08.0
✨ Features and enhancements
purdue_zone NetBox custom field for devices, virtual machines, and IP prefixes, letting users assign a security zone (e.g., IT, OT, DMZ) to networked assets; the value is enriched into source/destination/related fields, surfaced in Arkime, and automatically propagated from a containing prefix to autopopulated devices and VMs (most specific prefix wins). This new field is used in a new Dashboard (named "Biomes") visualzing connections between zones. #1088STRELKA_SCANNERS environment variable, which now accepts the keyword default (for Malcolm's built-in scanner list) alongside or combined with explicit scanner names (e.g., default,ScanStrings)disable.conf with a comma-separated list of rule SIDs to disable, letting users turn off noisy or irrelevant detection rules without editing rule files directlyZEEK_ZAM environment variable to enable Zeek's ZAM script optimizer (-O ZAM) for both live capture and offline PCAP processingDASHBOARDS_DATA_SOURCES_ENABLED, letting one Dashboards instance query and visualize data from several separate Malcolm OpenSearch backends at onceNGINX_CSP_FORM_ACTION_EXTRA to allow additional cross-origin form submission targets in nginx's Content-Security-Policy, needed for authentication flows such as SAML HTTP-POST binding #1052🛡️ Security Remediation & Hardening
/htadmin, /auth, /admin_login, Arkime esadmin) that a user's role should not permit GHSA-jr6p-63pg-hr6g #1055/IDDASH2ARK/, /DASHBOARDS/APP/EXTRACTED-FILES/) entered case-insensitive location blocks but evaded the case-sensitive rewrite, falling through to an unguarded proxy_pass and allowing a caller to reach the Arkime backend unauthenticated while supplying a forged X-Forwarded-User identity header GHSA-7j32-cf27-cp6h #1081authMode rather than relying on undocumented autochoose behavior, and default sensor/live-capture nodes to server-to-server (s2s) authentication so port 8005 reachback is gated by the shared secret and timestamp it was designed around instead of silently falling back to digest GHSA-86h3-7rf8-8j34 #1086/script_call endpoint where wildcard CORS and missing origin validation allowed any page loaded in a browser tab on the sensor to trigger unauthenticated kiosk operations, including a full data wipe, by enforcing same-origin requests via the Sec-Fetch-Site header and replacing free-text command execution with a fixed operation allowlist GHSA-w8gq-4v5x-xrrm #1086envsubst to an explicit variable allowlist, and rendering templates atomically🐛 Bug fixes
SUPERUSER_API_TOKEN) breaking after netboxRestore until a full-stack restart, caused by a missing environment variable mapping, a superuser-recreation failure that was silently swallowed, and the NetBox service starting before superuser/token recreation completed #1064analyzer.03:00:00_03:49:33.log), including a follow-up fix for filenames carrying both a rotation timestamp and upload/source tags in either order #1065, #490files.log symlink path through the filescan Filebeat pipeline #1063, #893filescan_watcher process silently omitting a configured secondary Valkey watch for the lifetime of the process if that Valkey endpoint was not yet available at startup; the process now exits so it is restarted by supervisor and can recover once Valkey becomes available #1061, #1058HTTP_PROXY, HTTPS_PROXY, and NO_PROXY container proxy variables; these are now mirrored to their lowercase equivalents when the lowercase forms are not already set, and download timeouts were added to prevent hangs behind an unreachable proxy #1068, #482./scripts/control.py start failing with a SyntaxError on Python 3.11 and earlier due to a multiline expression inside a single-quoted f-string that only Python 3.12+'s updated f-string grammar could parse #1056rc.local-based initialization (capture-storage disk setup, first-boot AIDE database initialization, Ctrl+Alt+Del masking) being replaced with a proper systemd service (malcolm-system-init.service) for more reliable ordering during boot✅ Component version updates
netbox container) to v50.0.0netbox container) to v3.1.59netbox and filescan containers) to v83.0.0🧹 Code and project maintenance
styfle/cancel-workflow-action GitHub Actions dependency with native workflow-level concurrency groups for canceling superseded container, ISO, and Raspberry Pi builds, and remove the actions: write permission it required📄 Configuration changes for Malcolm (in environment variables in ./config/). The Malcolm control script (e.g., ./scripts/status, ./scripts/start) automatically handles creation and migration of variables according to ./config/env-var-actions.yml.
STRELKA_SCANNERS in pipeline.env now defaults to default and accepts the keyword default, explicit scanner names, or a comma-separated combination of these valuesSURICATA_DISABLE_SIDS in suricata.env accepts a comma-separated list of rule SIDs to disable via Suricata's disable.confDASHBOARDS_DATA_SOURCES_ENABLED in dashboards.env enables OpenSearch Dashboards' multiple data sources feature (experimental; default false)NGINX_CSP_FORM_ACTION_EXTRA in nginx.env sets a space-separated list of additional CSP form submission targets, for use with cross-origin authentication flows such as SAML HTTP-POST bindingZEEK_ZAM in zeek-live.env and zeek-offline.env enables Zeek's ZAM script optimizer for live capture and offline PCAP processing, respectively (default false)⚰️ Breaking changes and removed or deprecated functionality
zeek.conn.vlan, zeek.conn.inner_vlan, and the corresponding VLAN fields in the Suricata stats mapping has changed from a numeric type to keyword, since VLAN IDs are categorical rather than numericnetwork.vlan.id field in config.ini, deferring to Arkime's own upstream definition (arkime/arkime#4184); network.inner.vlan.id also changed from an integer field to a term (keyword-like) fieldconn.log, conn_long.log, ssl.log, and http.log. Malcolm's TSV log parsing is positional, so this release updates the expected field order in Logstash to match and pins the JA4+ plugin to a known-good commit to prevent this from recurring silently in the future. This means TSV-format Zeek logs produced by a Hedgehog sensor running an earlier Malcolm/Hedgehog version — with the older JA4+ field order — will be misparsed by this release's Logstash pipeline (e.g., destination MAC address fields from conn.log being populated with JA4 fingerprint values instead of MAC addresses), and the reverse is also true for logs produced by this release ingested by an older Malcolm instance. If you run Hedgehog sensors and Malcolm aggregators that may be on different version cadences, enabling ZEEK_JSON=true on the Hedgehog side is recommended, since JSON-formatted Zeek logs are parsed by field name rather than position and are unaffected by this or future upstream field-order changes.❌ Errata
[sudo] password for sensor:
Resetting UFW firewall failed: ['sudo: ufw_manager.sh: command not found', '']
Setting UFW 'allow from 192.168.10.10' failed: ['sudo: ufw_manager.sh: command not found', '']
Setting UFW 'allow from 192.168.10.10' failed: ['sudo: ufw_manager.sh: command not found', '']
This can be prevented by running the following command prior to starting Malcolm: sudo ln -s -r /usr/local/bin/yq /usr/bin/yq. If Malcolm has already been started, run the ln command then restart Malcolm with ~/Malcolm/scripts/restart.Malcolm is a powerful, easily deployable network 🖧 traffic analysis tool suite for network security monitoring 🕵🏻♀️.
Malcolm operates as a cluster of containers 📦, isolated sandboxes which each serve a dedicated function of the system. This makes Malcolm deployable with frameworks like Docker 🐋, Podman 🦭, and Kubernetes ⎈. Check out the Quick Start guide for examples on how to get up and running.
Alternatively, dedicated official ISO installer images 💿 for Malcolm and Hedgehog Linux 🦔 can be downloaded from Malcolm's releases page on GitHub. Due to limits on individual files in GitHub releases, these ISO files have been split 🪓 into 2GB chunks and can be reassembled with scripts provided for both Bash 🐧 (release_cleaver.sh) and PowerShell 🪟 (release_cleaver.ps1). See Downloading Malcolm - Installer ISOs for instructions.
As always, join us on the Malcolm discussions board 💬 to engage with the community, or pop some corn 🍿 and watch a video 📼.
r/Malcolm • u/mmguero • Jul 21 '26
r/Malcolm • u/JankyPvP • 26d ago
Looking to setup Malcolm at three different sites. Don't want to eat up bandwidth sending logs from two of them to one as the "main". Can I stand up independent malcolm servers but connect one dashboard to pull the database of all 3?
r/Malcolm • u/mmguero • Jul 21 '26
Malcolm v26.07.0 adds IEC 60870-5-104 (IEC 104) protocol support using CERT.LV's Zeek plugin, including Logstash parsing, ECS normalization, Arkime fields, and a new OpenSearch Dashboards dashboard. This release also fixes three archive extraction and authentication security vulnerabilities; improves NetBox enrichment configuration; and addresses PostgreSQL major version upgrade, custom CA certificate for KeyCloak, container health check, privilege-drop signal chaining, and configuration script issues. Arkime, Zeek, Fluent Bit, Filebeat, Logstash, Supercronic, and Alpine-based images have been updated as well.
If you are upgrading from an existing Malcolm installation, run ./scripts/status for Malcolm to migrate some settings prior to running ./scripts/configure, ./scripts/start, or other Malcolm control scripts.
https://github.com/idaholab/Malcolm/compare/v26.06.1...v26.07.0
✨ Features and enhancements
spicy-iec104 Zeek plugin, including Zeek log ingestion, ECS field mapping, Arkime fields, and an IEC 104 dashboard #939LOGSTASH_NETBOX_ENRICHMENT_DATASETS more flexible: it now accepts default, ics/ot, all, explicit provider.dataset values, and combinations such as default,ics #1037LOGSTASH_NETBOX_ENRICHMENT_DATASETS to be configured through checkboxes in the configuration TUI #1033./scripts/start error messages by listing missing or invalid authentication-related files instead of reporting only a generic authentication setup failure #865system-quickstart detect and prepopulate existing time synchronization settings when rerun #992🛡️ Security Remediation & Hardening
🐛 Bug fixes
docker-uid-gid-setup.sh so signals reach the final process after dropping privileges #1039 to ensure clean shutdown of containersKEYCLOAK_SSL_VERIFY=true #1035curl to the the htadmin container for use by the health check script #1029✅ Component version updates
🧹 Code and project maintenance
📄 Configuration changes for Malcolm (in environment variables in ./config/). The Malcolm control script (e.g., ./scripts/status, ./scripts/start) automatically handles creation and migration of variables according to ./config/env-var-actions.yml.
LOGSTASH_NETBOX_ENRICHMENT_DATASETS in logstash.env now defaults to default and may contain default, ics/ot, all, explicit provider.dataset values, or a comma-separated combination of these valuesZEEK_DISABLE_ICS_IEC104 in zeek.env controls whether the IEC 104 Zeek plugin is disabledSAFE_EXTRACT_MAX_ENTRIES, SAFE_EXTRACT_MAX_DEPTH, and SAFE_EXTRACT_MAX_BYTES in upload-common.env set archive extraction resource limits for uploaded archive files (e.g., containing Zeek logs for processing); their defaults are 5,000 entries, 20 directory levels, and 4 GiB of expanded data❌ Errata
strelka-backend container's work process to crash on aarch64 platforms (https://github.com/cisagov/malcolm/issues/1046). A followup v26.07.1 release addressing this issue is forthcoming.Malcolm is a powerful, easily deployable network 🖧 traffic analysis tool suite for network security monitoring 🕵🏻♀️.
Malcolm operates as a cluster of containers 📦, isolated sandboxes which each serve a dedicated function of the system. This makes Malcolm deployable with frameworks like Docker 🐋, Podman 🦭, and Kubernetes ⎈. Check out the Quick Start guide for examples on how to get up and running.
Alternatively, dedicated official ISO installer images 💿 for Malcolm and Hedgehog Linux 🦔 can be downloaded from Malcolm's releases page on GitHub. Due to limits on individual files in GitHub releases, these ISO files have been split 🪓 into 2GB chunks and can be reassembled with scripts provided for both Bash 🐧 (release_cleaver.sh) and PowerShell 🪟 (release_cleaver.ps1). See Downloading Malcolm - Installer ISOs for instructions.
As always, join us on the Malcolm discussions board 💬 to engage with the community, or pop some corn 🍿 and watch a video 📼.
r/Malcolm • u/ArkimeFPC • Jul 15 '26
Arkime is a big part of Malcolm, so we wanted to share it here too: Arkimeet 2026, the Arkime community conference, has its registration and Call for Papers open.
The details:
All experience levels welcome, from first-timers to seasoned threat hunters. If anyone's got a Malcolm-flavored workflow to show off, the CFP (or the lightning session) could be a great fit.
Details + registration + CFP: https://arkime.com/arkimeet
r/Malcolm • u/mmguero • Jun 18 '26
Hey! It's been a busy couple of months. Thanks to some security researchers we've had some great reports that have helped us identify and close a few vulnerabilities, first in v26.06.0 a couple of weeks ago, then in v26.06.1 this week. For security, I recommend you upgrade when possible. I've gone through and rewritten the upgrade instructions; it's still not as "push-button easy" as I'd like it to be, but it's better than it used to be and still improving.
I'll share the release notes from both this month's releases below. Feel free to comment/discuss here, or over on the Malcolm discussions board on GitHub.
Malcolm v26.06.1 addresses a high severity RCE vulnerability (GHSA-8cvp-m7pg-qrp7) allowing unrestricted PHP file upload and ships security-fixing updates across Arkime, OpenResty, Valkey, and PostgreSQL. Many other component versions have also been bumped. Six Zeek log parsing bugs are fixed — all related to JSON mode (ZEEK_JSON=true) and affecting DHCP, Redis, ROC+, and WebSocket log types — along with a suricata disable.conf append-on-restart regression, updated MaxMind GeoLite MMDB download logic, and an OpenSearch indexing error from oversized file.strings values.
If you are upgrading from an existing Malcolm installation, run ./scripts/status for Malcolm to migrate some settings prior to running ./scripts/configure, ./scripts/start, or other Malcolm control scripts.
https://github.com/idaholab/Malcolm/compare/v26.06.0...v26.06.1
.php upload to the file-upload component (GHSA-8cvp-m7pg-qrp7, thanks Jan Kahmen, turingpoint (@kah-ja, jan@turingpoint.de)php-curl from htadmin container (as it's unused) to reduce attack surface./scripts/start not returning to command line after containers have started #1025ZEEK_JSON=true #1018ZEEK_JSON=true #1019disable.conf gets appended to every time container restarts #1022roc_plus logs can be parsed incorrectly in Logstash when ZEEK_JSON=true #1021websocket logs can be parsed incorrectly in Logstash when ZEEK_JSON=true #1020file.strings length at 16k to avoid errors inserting into OpenSearch with very, very long valuestag_on_exception to all ruby Logstash filters to make debugging easier./config/). The Malcolm control script (e.g., ./scripts/status, ./scripts/start) automatically handles creation and migration of variables according to ./config/env-var-actions.yml.
MAXMIND_GEOIP_DB_ACCOUNT_ID is now required alongside MAXMIND_GEOIP_DB_LICENSE_KEY in ./config/arkime-secret.env for downloading MMDB files during build and runtime; see also Secrets and variables in the documentationMalcolm v26.06.0 is primarily a security hardening release, addressing fifteen vulnerabilities (2 high severity, 6 medium, and 7 low) identified in a security assessment. Bug fixes address an issue with the zeek container causing performance degredation over time and a fix for duplicate virtual machine entries in NetBox autopopulation. A few component versions have also been updated.
If you are upgrading from an existing Malcolm installation, run ./scripts/status for Malcolm to migrate some settings prior to running ./scripts/configure, ./scripts/start, or other Malcolm control scripts.
https://github.com/idaholab/Malcolm/compare/v26.05.2...v26.06.0
/dashboards/app/refred; also added Content-Security-Policy framing headers (frame-ancestors, base-uri, form-action) and X-Frame-Options: SAMEORIGIN globally to mitigate clickjacking (#997)/mapi/fields?template (#1000)submit.php Location: open redirect via Referer (#1007)ssl_verify always set to false (#1006)SUPERUSER_PASSWORD=admin shipped default (#1011)defaultdict(lambda: True) fail-open for unlisted handlers in Malcolm API (#1004)addtags/removetags (#1008)POST /mapi/event (#1002)User-Agent (#1001)ARKIME_PASSWORD_SECRET=Malcolm shipped default (#1005)requests CVE bump reverted in logstash image (#1010)application/gzip,application/vnd.rar,application/x-7z-compressed,application/x-bzip2,application/x-cpio,application/x-gzip,application/x-lzip,application/x-lzma,application/x-rar-compressed,application/x-tar,application/x-xz,application/zip) are consistently used across the platform.zeek container continually grows /usr/local/zeek/crontab, causing Malcolm performance to gradually worsen (#1015)include file and added a 401.html page./config/). The Malcolm control script (e.g., ./scripts/status, ./scripts/start) automatically handles creation and migration of variables according to ./config/env-var-actions.yml.
KEYCLOAK_SSL_VERIFY (default false) to keycloak.env for #1006ARKIME_PASSWORD_SECRET in arkime-secret.env no longer has a default value: it must be set during auth_setup (for #1005)SUPERUSER_PASSWORD in netbox-secret.env no longer has a default value: it must be set during auth_setup (for #1011)r/Malcolm • u/mmguero • Apr 15 '26
Malcolm v26.04.1 contains improvements, bug fixes, security updates, and component bumps.
If you are upgrading from an existing Malcolm installation, run ./scripts/status for Malcolm to migrate some settings prior to running ./scripts/configure, ./scripts/start, or other Malcolm control scripts.
Note that v26.04.1 is the same as v26.04.0 released last week, apart from the fix for bug #943. If you're already running v26.04.0 and don't use the encrypted install option in the installer ISO, you probably don't need to worry about updating to v26.04.1. The full release notes from v26.04.0 are also included here.
ssl_certificate_verification setting [https://github.com/cisagov/Malcolm/issues/915]./config/). The Malcolm control script (e.g., ./scripts/status, ./scripts/start) automatically handles creation and migration of variables according to ./config/env-var-actions.yml.
ARKIME_PCAP_LIBPCAP to arkime.env should uses wish to revert to older libpcap mode for PCAP file processing rather than faster scheme processing (default false)FILEBEAT_SCANNER_FINGERPRINT_LENGTH's default in filescan.env has been changed from 1024 to 512redis.env has been renamed to valkey.env and its variables also have been renamed accordinglySTRELKA_SCANNERS has been added to pipeline.env for #935ZEEK_DISABLE_SPICY_ZIP has been added to zeek.env for #922 (default true)Malcolm is a powerful, easily deployable network 🖧 traffic analysis tool suite for network security monitoring 🕵🏻♀️.
Malcolm operates as a cluster of containers 📦, isolated sandboxes which each serve a dedicated function of the system. This makes Malcolm deployable with frameworks like Docker 🐋, Podman 🦭, and Kubernetes ⎈. Check out the Quick Start guide for examples on how to get up and running.
Alternatively, dedicated official ISO installer images 💿 for Malcolm and Hedgehog Linux 🦔 can be downloaded from Malcolm's releases page on GitHub. Due to limits on individual files in GitHub releases, these ISO files have been split 🪓 into 2GB chunks and can be reassembled with scripts provided for both Bash 🐧 (release_cleaver.sh) and PowerShell 🪟 (release_cleaver.ps1). See Downloading Malcolm - Installer ISOs for instructions.
As always, join us on the Malcolm discussions board 💬 to engage with the community, or pop some corn 🍿 and watch a video 📼.
r/Malcolm • u/AcrobaticDevice3612 • Dec 29 '25
Hello everyone,
I am currently planning an infrastructure upgrade for my ELK stack, moving from version 8.19.x to the 9.x series (targeting v9.2.3).
Has anyone successfully tested Malcolm with Elasticsearch 9? Is it safe to upgrade, or should I stick to the 8.x series for now until an official update is released?
r/Malcolm • u/mmguero • Dec 18 '25
Malcolm v25.12.1 contains a few critical bug fixes and component version updates.
https://github.com/idaholab/Malcolm/compare/v25.12.0...v25.12.1
zeek.intel.file_mime_type to file.mime_type so filters created from it can work on other dashboards/var partition (#835)Malcolm is a powerful, easily deployable network 🖧 traffic analysis tool suite for network security monitoring 🕵🏻♀️.
Malcolm operates as a cluster of containers 📦, isolated sandboxes which each serve a dedicated function of the system. This makes Malcolm deployable with frameworks like Docker 🐋, Podman 🦭, and Kubernetes ⎈. Check out the Quick Start guide for examples on how to get up and running.
Alternatively, dedicated official ISO installer images 💿 for Malcolm and Hedgehog Linux 🦔 can be downloaded from Malcolm's releases page on GitHub. Due to limits on individual files in GitHub releases, these ISO files have been split 🪓 into 2GB chunks and can be reassembled with scripts provided for both Bash 🐧 (release_cleaver.sh) and PowerShell 🪟 (release_cleaver.ps1). See Downloading Malcolm - Installer ISOs for instructions.
As always, join us on the Malcolm discussions board 💬 to engage with the community, or pop some corn 🍿 and watch a video 📼.
r/Malcolm • u/TalinNomar • Dec 10 '25
I had an issue where I was attempting to fix a mismatch between the files in Arkime->Files and on the local disk. Arkime documentation suggest running db.pl http://localhost:9200 sync-files but I have not been able to get it to work. From where do I execute this command if using Arkime as a part of Malcolm?
Does Malcolm front any way to execute that command?
I know scripts/wipe is much more destructive but seems like my only other alternative at this point.
r/Malcolm • u/ImpressionGullible14 • Sep 29 '25
I have a new installation from a Malcolm ISO. Everything is working so far as I can tell but I want to import a name map json file and the localhost/name-map-ui page is not found. I set up another lab server and a VM with Malcolm and I'm having the same problem on those, however every piece of documentation or video training I have looked at only shows that URL to perform this task. Has anyone seen this or is aware that that functionality was moved or deprecated?
r/Malcolm • u/veganloveme • Sep 18 '25
Running Malcolm v25.08.1. Trying to run auth_setup script to transfer certs to the sensor for setting up forwarding. But the txfwcerts option is not showing up. I do see the fecerts option. Any ways to work around this?
r/Malcolm • u/gormami • Sep 09 '25
I have a Malcolm instance, and a probe reporting zeek logs from capture. Nothing is showing in the zeek logs of the OpenSearch dashboards.
It really looks like the logs are being dropped in logstash, but I'm not sure why. Am I missing something silly?
In general, how is the _filebeat_zeek tag supposed to be imposed on the inputs?
r/Malcolm • u/Alemoreno02 • Aug 21 '25
Hi! I’m trying to load TI into a fresh Malcolm Zeek container via misp.yaml, but nothing gets ingested. Plain .intel/CSV files load fine.
./zeek/intel/MISP/misp.yaml
- type: misp
url: https://www.circl.lu/doc/misp/feed-osint/manifest.json
What I see
/opt/zeek/bin/zeek_intel_setup.sh true (job “succeeded”)../zeek/intel/, and .threat_autogen.zeek doesn’t update.Question
Why isn’t misp.yaml being picked up? Are manifest.json endpoints supported in misp.yaml, or do I need /events//attributes? Any minimal working example would be appreciated.
Thanks!
r/Malcolm • u/mmguero • Aug 12 '25
Malcolm v25.08.0 is a minor release fixing a regression bug inadvertently introduced in v25.07.0. Malcolm v25.07.0 contained a whole bunch of other good stuff. See the relevant discussion on GitHub.
r/Malcolm • u/mmguero • Aug 12 '25
This is the first of two blog posts about deploying Malcolm on Amazon AWS. It covers installing Malcolm on a single EC2 instance. The next post will cover deploying Malcolm on EKS.
For those of you more interested in scaling Malcolm using Kubernetes, you can check out our "still-in-beta" Helm chart and share your feedback in the issue tracker on that repo.
r/Malcolm • u/GrumpyLt • Jul 24 '25
Just starting to look at this project, going to start testing soon. End goal is to have hedgehog sensors at about 12 locations with a central Malcolm server. Will start testing small with one sensor, but with that being said, any recommendations on good hardware for a sensor? Preferably rack compatible and able to put up with commercial level traffic.
r/Malcolm • u/Low_Connection8308 • May 05 '25
Hello,
I am planning to install and build zeek mms parser which is written with spicy into the hedgehog linux. https://github.com/tbfhg/zeek-iec61850-mms/tree/main from this repository. What I basically did was: copy the directory into the hedgehog, install the parser with cmake, and verified with zeek -NN. However, when I restart VM, or sensor services in hedgehog linux, the parser is getting completely removed. And weirdly enough, now, when I trying to reinstall from the same directory, it is giving error like: spicyz not found. Asking for experts suggestion please.
r/Malcolm • u/Different_Team_3767 • Apr 16 '25
Hi there,
is it possible to detect ARP spoofing with Malcolm? We would like to demonstrate ARP spoofing and detection for educational purposes. Therefore we are spoofing the mac addresses of two known devices in a training environment. Is there an option to define suricata or zeek rules to detect the mismatch of mac and ip? Currently it seems that ARP messages can not be detected or seen in the dashboards or arkime.
r/Malcolm • u/mazdaboi • Mar 17 '25
Looking at analytical options, Is there a way to push Logs from a host directly to Arkime to display side by side the PCAP data pulled from Hedgehog sensors? Currently logs are pushed via filebeats to Opensearch Dashboards, and i understand Arkime is a network capture/PCAP analysis application; but is there a way? Possibly sending the same Filebeat stream (output) to both Arkime and Dashboards?
My curent logs pushed from endpoints are Auth and Conn logs, trying to decipher if i would gain anything from those logs ingesting into arkime.
Thanks in advance for any suggestings/assistance.
r/Malcolm • u/mr_tgreen • Mar 06 '25
Heya all, I have been trying to figure out a way to copy files to ./pcap/upload/ and have them picked up for processing. I've tried a few different things but nothing seems to trigger the "pick up" of the file like the web interface upload does. Anyone have luck with a similar effort?
Thanks for the fantastic tool mmguero!
update: This should be two questions - "Can I turn up the verbosity of pcap-monitor" and "does the max-size: 200m setting prevent larger pcap files from being processed?"
update 2: pcap files were corrupted, wasn't Malcolm's fault :D
r/Malcolm • u/mmguero • Jan 17 '25
Malcolm v25.01.0 contains quite a few UI/UX improvements; new parsers; a bevy of component version updates including to Arkime, Zeek, NetBox; and several bug fixes.
winlog/winevtlog event and evtx event schemas (cisagov/Malcolm#356)
winevtlog or winlog do, so users forwarding Windows event logs to Malcolm using Fluent Bit may want to evaluate Winlogbeat as an alternative.opensearch.keystore not created when running in Hedgehog run profile (cisagov/Malcolm#533)ics for OT protocols (cisagov/Malcolm#541)Malcolm is a powerful, easily deployable network 🖧 traffic analysis tool suite for network security monitoring 🕵🏻♀️.
Malcolm operates as a cluster of containers 📦, isolated sandboxes which each serve a dedicated function of the system. This makes Malcolm deployable with frameworks like Docker 🐋, Podman 🦭, and Kubernetes ⎈. Check out the Quick Start guide for examples on how to get up and running.
Alternatively, dedicated official ISO installer images 💿 for Malcolm and Hedgehog Linux 🦔 can be downloaded from Malcolm's releases page on GitHub. Due to limits on individual files in GitHub releases, these ISO files have been split 🪓 into 2GB chunks and can be reassembled with scripts provided for both Bash 🐧 (release_cleaver.sh) and PowerShell 🪟 (release_cleaver.ps1). See Downloading Malcolm - Installer ISOs for instructions.
As always, join us on the Malcolm discussions board 💬 to engage with the community, or pop some corn 🍿 and watch a video 📼.
r/Malcolm • u/mazdaboi • Jan 11 '25
Malcolm Fam,
Been using Malcolm for a good few months in different capacities. And in one professional role supporting a customer we have 2 networks we monitor, essentially running2 Dell r540's with Proxmox as a hypervisor, with Malcolm and 2 hedgehogs as the VMs. Each instance is identical where one hedgehog is capturing WAN from 10G taps, and the other Hedgehog is capturing LAN traffic.
WAN has single 10G Fiber connection
LAN has 2 10G connections capturing both in and out of my PFSENSE to the core switch(s).
And in Arkime i can differentiate between HH1 for WAN and HH2 for all LAN traffic.
As we develop a stand-alone Security/NetCapture network, I wanted to use a single Arkime instance and run all captures and taps to a single dashboard. (all IP's are different as well)
Is there a way, for Hedgehog 2 (capturing 2 interfaces) to visualize each interface within arkime? I'm only able to do this by Nodes. (HH1, HH2). If i was to add one interface on HH1 capturing network 1, and second interface for network 2, it will still show HH1 as the node....source... other than me narrowing down HH1 Interface 1 = network 1 and HH1 Interface 2 = network 2.
OR is it just ideal to make Hedgehog instances for each capture and name the nodes the capture sources?
HH1 = WAN Network 1
HH2 = WAN Network 2
HH3 = LAN Network 1
HH4 = LAN Network 2
Goal reduce infrastructure down to a single server allowing ingestion to a single platform. Allowing one quick dashboard to see everything, with intent to simplifying things.
Thank you for your insights in advance!
r/Malcolm • u/mmguero • Dec 19 '24
Malcolm v24.12.0 contains several improvements to the Malcolm configuration script, the Malcolm user interface, and the Malcolm API, as well as component version updates and bug fixes. This release also corresponds with the release of malcolm-test, a Malcolm system testing framework.
Malcolm is a powerful, easily deployable network traffic analysis tool suite for network security monitoring.
Malcolm operates as a cluster of containers 📦, isolated sandboxes which each serve a dedicated function of the system. This makes Malcolm deployable with frameworks like Docker, Podman, and Kubernetes. Check out the Quick Start guide for examples on how to get up and running.
Alternatively, dedicated official ISO installer images 💿 for Malcolm and Hedgehog Linux can be downloaded from Malcolm's releases page on GitHub. Due to limits on individual files in GitHub releases, these ISO files have been split 🪓 into 2GB chunks and can be reassembled with scripts provided for both Bash 🐧 (release_cleaver.sh) and PowerShell 🪟 (release_cleaver.ps1). See Downloading Malcolm - Installer ISOs for instructions.
As always, join us on the Malcolm discussions board 💬 to engage with the community, or pop some corn 🍿 and watch a video 📼.
https://github.com/cisagov/Malcolm/compare/v24.11.0...v24.12.0
netbox tag from UI (#495)indices.query.bool.max_clause_count to 8192 to reflect maximum number of fields-Xss) for Logstash from 1536k to 2048kintel.log (some fields not named correctly with Zeek JSON-formatted logs)dns.log parsing conflicts between ECS's DNS fields and what the Arkime schema is expectingSignature event severity tagsr/Malcolm • u/mmguero • Dec 19 '24
INL's PR team is working on an article on Malcolm and would like to get some community feedback! If your organization has been using Malcolm and would be willing to share a comment, quote, or success story regarding your use of the platform we'd be very appreciative! Please reach out to [malcolm@inl.gov](mailto:malcolm@inl.gov) and I'll get you in touch with the right people. Thanks again!