Paige Chat Timeline Gallery Friends Lists Email Drive DNS Resolver Domains VPN Kairo Nerve

Remote

Seth Grover

@mmguero@infosec.exchange

mastodon 4.8.0-alpha.3+glitch

Open on infosec.exchange

Husband. Father of four daughters (and their dungeon master). Guardian of Peach, our precious yellow lab and Toad, a cat. Member of the Church of Jesus Christ of Latter-day Saints. Software developer in cybersecurity research and development at Idaho National Lab. Geek and homelabber. Sporadic guitarist/singer/songwriter. Fan of a wide swath of music. Lover of sci-fi, horror and weird fiction. Into family history and genetic genealogy (48% 🏴󠁧󠁢󠁥󠁮󠁧󠁿, 23% 🇩🇰, 17% 🏴󠁧󠁢󠁳󠁣󠁴󠁿, 9% 🏴󠁧󠁢󠁷󠁬󠁳󠁿, 3% 🇮🇪, depending on the reference panels used). Avid outdoorsman: archery, shooting, hunting, fishing and hiking. Idaho, USA. Hablo español también.

178 Followers

98 Following

5 Posts

Joined November 07, 2022

:github::

https://github.com/mmguero

:github: Gist:

https://gist.github.com/mmguero

:github: dotfiles:

https://github.com/mmguero/dotfiles

Malcolm:

https://malcolm.fyi

🦋:

https://bsky.app/profile/guero.org

🛐:

https://www.churchofjesuschrist.org/comeuntochrist

Open post

Seth Grover @mmguero@infosec.exchange

· 5mo ago

Malcolm v26.04.1 contains improvements, bug fixes, security updates, and component bumps.

If you are upgrading from an existing Malcolm installation, run ./scripts/status for Malcolm to migrate some settings prior to running ./scripts/configure, ./scripts/start, or other Malcolm control scripts.

v26.02.0...v26.04.1

Note that v26.04.1 is the same as v26.04.0 released last week, apart from the fix for bug #943. If you're already running v26.04.0 and don't use the encrypted install option in the installer ISO, you probably don't need to worry about updating to v26.04.1. The full release notes from v26.04.0 are also included here.

✨ Features and enhancements
- implemented easier way to enable/disable Strelka scanners #935
- Handle nested file scanning (e.g., from ZIP files) with Strelka #922
- index selected Strelka result fields #919
✅ Component version updates
- Zeek to v8.1.1
- Arkime to v6.1.1
- crytography to v46.0.6 (for CVE-2026-34073)
- evtx to v0.11.2
- Flask to v3.1.3 (for CVE-2026-27205)
- Fluent Bit to v5.0.2
- Logstash to v9.2.7
- Requests to v2.33.1 (for CVE-2026-25645)
- supercronic to v0.2.43
- yq to v4.52.5
- Updates for ICSNPP Hart IP parser #924
🐛 Bug fixes
- Hedgehog Linux Breaking on Reboot after Encrypted Quick Install with Multiple Drives #943
- Fix YAML syntax error in kubernetes/15-redis.yml due to missing end quote #926
- Using remote elasticsearch data store uses deprecated ssl_certificate_verification setting [https://github.com/cisagov/Malcolm/issues/915]
- fix Malcolm API loopback webhook to handle RBAC and non-JSON formatted events #916
- fix issues in zeekdeploy.sh to handle long crypto handshakes and Zeek's state DB getting out of sync
🧹 Code and project maintenance
- swap redis out for valkey #882
- pin all third-party GitHub CI actions at known good SHA sums to mitigate things like the Trivy supply chain attack #933
- some minor tweaks to various Dockerfiles and ISO build scripts to address vulnerability scanner findings
- some documentation updates
📄 Configuration changes for Malcolm (in environment variables in ./config/). The Malcolm control script (e.g., ./scripts/status, ./scripts/start) automatically handles creation and migration of variables according to ./config/env-var-actions.yml.
- Added ARKIME_PCAP_LIBPCAP to arkime.env should uses wish to revert to older libpcap mode for PCAP file processing rather than faster scheme processing (default false)
- FILEBEAT_SCANNER_FINGERPRINT_LENGTH's default in filescan.env has been changed from 1024 to 512
- redis.env has been renamed to valkey.env and its variables also have been renamed accordingly
- STRELKA_SCANNERS has been added to pipeline.env for #935
- ZEEK_DISABLE_SPICY_ZIP has been added to zeek.env for #922 (default true)

Malcolm is a powerful, easily deployable network 🖧 traffic analysis tool suite for network security monitoring 🕵🏻‍♀️.

Malcolm operates as a cluster of containers 📦, isolated sandboxes which each serve a dedicated function of the system. This makes Malcolm deployable with frameworks like Docker 🐋, Podman 🦭, and Kubernetes ⎈. Check out the Quick Start guide for examples on how to get up and running.

Alternatively, dedicated official ISO installer images 💿 for Malcolm and Hedgehog Linux 🦔 can be downloaded from Malcolm's releases page on GitHub. Due to limits on individual files in GitHub releases, these ISO files have been split 🪓 into 2GB chunks and can be reassembled with scripts provided for both Bash 🐧 (release_cleaver.sh) and PowerShell 🪟 (release_cleaver.ps1). See Downloading Malcolm - Installer ISOs for instructions.

As always, join us on the Malcolm discussions board 💬 to engage with the community, or pop some corn 🍿 and @malcolmnetworktrafficanalysis@www.youtube.com 📼.

#Malcolm #HedgehogLinux #Zeek #Arkime #Strelka #NetBox #OpenSearch #Elasticsearch #Suricata #PCAP #NetworkTrafficAnalysis #networksecuritymonitoring #OT #ICS #icssecurity #CyberSecurity #Cyber #Infosec #INL

Open post

Seth Grover @mmguero@infosec.exchange

· 4mo ago

Malcolm v26.05.0 delivers a mix of feature improvements, performance improvements, bug fixes, dependency updates, and deployment refinements across Malcolm and Hedgehog for both Docker- and Kubernetes-based workflows.

https://github.com/idaholab/Malcolm/compare/v26.04.1...v26.05.0

✨ Features and enhancements
- #726 — use hierarchical structure for NetBox device roles
  - Expanded/reworked NetBox preloaded device roles into a hierarchical taxonomy (thanks Crubumble)
- #867 — examine large chown'ed directories in container images and see if they can be reduced
- #954 — allow users to provide custom netbox scripts to be automatically registered on startup (thanks PrudhviChanda)
  - Added NetBox custom script support in the container/runtime and docs, including bind-mounting ./netbox/custom-scripts and automatic script registration at startup
  - Renamed NetBox startup/control scripts from netbox/scripts to netbox/control-scripts
- Added file.strings extraction/indexing/search support across Strelka → Logstash → OpenSearch templates (wildcard field mapping type) → Arkime/WISE
- Added configurable Zeek file analyzer timeout via ZEEK_FILE_ANALYZER_TIMEOUT_SEC
- netdev users in ISO-installed environment can run nmcli and nmtui to configure network interfaces.
- the malcolm_appliance_packager.sh script that creates a tarball of Malcolm images can now package for both Malcolm and Hedgehog profiles.
✅ Component version updates
- Arkime to v6.3.1
- cryptography to v46.0.7
- Filebeat OSS to v9.3.4
- Fluent Bit to v5.0.4
- GitPython to v3.1.47
- Keycloak to v26.6
- Logstash OSS to v9.2.8
- OpenSearch and Opensearch Dashboards to v3.6.0
- opensearch-py to v3.2.0
- pillow to v12.2.0
- python-dotenv to v1.2.2
- Supercronic to v0.2.45
- yq to v4.53.2
- Zeek to v8.1.2
🐛 Bug fixes
- #757 — multiple OpenSearch nodes (using Malcolm-Helm) fail to communicate with each other due to self-signed certs (thanks scott-jeffery)
  - OpenSearch post-start setup now supports configurable default replica counts instead of always forcing single-node replicas to 0
  - OpenSearch self-signed internal cert generation can now be skipped when external/preexisting certs are being used
- #827 — Fix raspberry pi build which is broken since v25.12.0 Hedgehog/Malcolm platform unification
  - Updated Hedgehog Raspberry Pi docs and first-boot behavior/documentation
  - Hedgehog Raspberry Pi image now forces password change for sensor on first login and disables direct root password login by default
  - Refactored Raspberry Pi GitHub Actions build into reusable workflow .github/workflows/raspi-build-push.yml
- #878 — Arkime capture Fails to Start on Hedgehog When WISE Web Config Is Enabled
  - Arkime RBAC role-mapping injection is now only applied when role-based access control is enabled
  - Arkime WISE configuration initialization now handles missing/empty persistent config files more robustly
  - Arkime live capture now normalizes WISE URLs better, follows redirects when probing, and avoids some bad URL construction edge cases
- #957 — configuration script can disable ICS parsers unintentionally
- #959 — Arkime sessions view attempts to load PCAP for Zeek and Suricata logs (which don't have PCAP) (see also arkime/arkime#3934)
- Fixed one-off cleanup of interrupted Zeek intel files during stop --wipe
🧹 Code and project maintenance
- Documentation improvements
- #913 — replace ingress-nginx which is EOL
  - Switched Kubernetes ingress example/docs from ingress-nginx to Traefik and replaced the old Vagrant example with a new RKE2/Traefik-based environment
  - Fixed malformed indentation in kubernetes/01-volumes-nfs.yml.example for the filescan volume section
  - Removed deprecated Kubernetes example files for ingress-nginx and the old separate NFS-server Vagrant setup
  - opensearch is no longer part of the hedgehog Docker Compose profile, and some depends_on relationships were adjusted accordingly
- #942 - Fixed mutable default argument usage in Zeek threat feed helper functions (thanks @stef41)
- #917 — develop IronBank (US DoD) images for Malcolm
📄 Configuration changes for Malcolm (in environment variables in ./config/). The Malcolm control script (e.g., ./scripts/status, ./scripts/start) automatically handles creation and migration of variables according to ./config/env-var-actions.yml.
- Added ZEEK_FILE_ANALYZER_TIMEOUT_SEC (default 5) to zeek.env. This is the default amount of time a file can be inactive before the file analysis gives up and discards any internal state related to the file.
- ZEEK_CLUSTER_BACKEND can be specified in zeek.env to specify the Zeek cluster backend (ZeroMQ vs Broker).
❌ Errata
- Under NetBox → Plugins → NetBox HealthCheck Plugin → HealthCheck the error "unavailable: Unable to connect to Redis: Connection Error" is displayed. This is a side effect of #882 and does not actually indicate a problem with NetBox or its connection to Valkey. This will be fixed in the next release.

Malcolm is a powerful, easily deployable network 🖧 traffic analysis tool suite for network security monitoring 🕵🏻‍♀️.

As always, join us on the Malcolm discussions board 💬 to engage with the community, or pop some corn 🍿 and @malcolmnetworktrafficanalysis@www.youtube.com 📼.

Open post

Seth Grover @mmguero@infosec.exchange

· 2mo ago

release notes for Malcolm v26.07.1, a network traffic analysis tool suite for network security monitoring Hover or focus to reveal Sensitive

Malcolm v26.07.1 adds a few minor changes on top of Malcolm v26.07.0, the most notable being a fix for a crash in the strelka-backend container on arm64 platforms. Malcolm v26.07.0 added IEC 60870-5-104 (IEC 104) protocol support using CERT.LV's Zeek plugin, including Logstash parsing, ECS normalization, Arkime fields, and a new OpenSearch Dashboards dashboard. This release also fixes three archive extraction and authentication security vulnerabilities; improves NetBox enrichment configuration; and addresses PostgreSQL major version upgrade, custom CA certificate for KeyCloak, container health check, privilege-drop signal chaining, and configuration script issues. Arkime, Zeek, Fluent Bit, Filebeat, Logstash, Supercronic, and Alpine-based images have been updated as well. If you are upgrading from an existing Malcolm installation, run ./scripts/status for Malcolm to migrate some settings prior to running ./scripts/configure, ./scripts/start, or other Malcolm control scripts. https://github.com/idaholab/Malcolm/compare/v26.06.1...v26.07.1 ✨ Features and enhancements Add IEC 60870-5-104 (IEC 104) support using the CERT.LV spicy-iec104 Zeek plugin, including Zeek log ingestion, ECS field mapping, Arkime fields, and an IEC 104 dashboard #939Make LOGSTASH_NETBOX_ENRICHMENT_DATASETS more flexible: it now accepts default, ics/ot, all, explicit provider.dataset values, and combinations such as default,ics #1037Allow LOGSTASH_NETBOX_ENRICHMENT_DATASETS to be configured through checkboxes in the configuration TUI #1033Improve ./scripts/start error messages by listing missing or invalid authentication-related files instead of reporting only a generic authentication setup failure #865Have system-quickstart detect and prepopulate existing time synchronization settings when rerun #992 🛡️ Security Remediation & Hardening Fix an RBAC bypass caused by URI normalization differences between Nginx location matching and the Lua authorization layer CVE-2026-63177 #1042Fix path traversal in archive extraction directory handling by validating resolved paths and using libarchive's secure extraction flags CVE-2026-63134 #1040Limit archive entry count, nesting depth, and total expanded size to prevent inode- and resource-exhaustion denial of service during extraction CVE-2026-63133 #1041Mark OpenID Connect session cookies as secure and improve handling of externally forwarded HTTPS schemes 🐛 Bug fixes Co-installation of opencv-python and opencv-contrib-python corrupts cv2.abi3.so, segfaulting strelka-backend at import on arm64 #1046 (fix)Allow the configuration TUI to reset supported variables back to empty values after installation #1024, #1030Fix the broken signal chain in docker-uid-gid-setup.sh so signals reach the final process after dropping privileges #1039 to ensure clean shutdown of containersFix PostgreSQL being reported unhealthy after a major-version upgrade, improve upgrade-state handling, and perform required post-upgrade extension and collation maintenance #1038Fix the Nginx Lua/OpenID Connect helper not honoring user-provided CA certificates for KeyCloak when KEYCLOAK_SSL_VERIFY=true #1035Restore curl to the the htadmin container for use by the health check script #1029Reduce the size of the OpenSearch Dashboards image by copying only the permissions data needed from its upstream image layer #1031Fix JSON handling of several Zeek fields whose names contain dots by normalizing them to underscore-separated field namesFix additional Zeek and Suricata field normalization and ECS mapping inconsistencies found while updating dashboards and index templates ✅ Component version updates Arkime to v6.6.0This update contains a major speed-up when loading the SPIView and Connections pagesZeek to v8.2.1 #970Fluent Bit Windows installer helper to v5.0.9Filebeat OSS to v9.4.3Logstash to v9.4.4Pillow (Python library used in the netbox container) to v12.3.0 to address several security findingsSupercronic to v0.2.47Alpine Linux base images to v3.24KeyCloak to 26.6.4cryptography (Python library) to v48.0.1 to address security advisory GHSA-537c-gmf6-5ccf 🧹 Code and project maintenance Broad spelling, grammar, naming consistency, and documentation cleanup across scripts, configuration, dashboards, and documentation #990Expand and restructure documentation to provide better project context for developers and LLM-assisted code analysis #964Malcolm Dashboard ReferenceSearch Queries in Arkime and OpenSearch DashboardsImprove installer validation, environment-variable mapping tests, and configuration item metadataRefresh dashboards, index templates, field mappings, protocol documentation, and navigation linksMinor improvements to the Hedgehog Raspberry Pi image build process. 📄 Configuration changes for Malcolm (in environment variables in ./config/). The Malcolm control script (e.g., ./scripts/status, ./scripts/start) automatically handles creation and migration of variables according to ./config/env-var-actions.yml. LOGSTASH_NETBOX_ENRICHMENT_DATASETS in logstash.env now defaults to default and may contain default, ics/ot, all, explicit provider.dataset values, or a comma-separated combination of these valuesZEEK_DISABLE_ICS_IEC104 in zeek.env controls whether the IEC 104 Zeek plugin is disabledSAFE_EXTRACT_MAX_ENTRIES, SAFE_EXTRACT_MAX_DEPTH, and SAFE_EXTRACT_MAX_BYTES in upload-common.env set archive extraction resource limits for uploaded archive files (e.g., containing Zeek logs for processing); their defaults are 5,000 entries, 20 directory levels, and 4 GiB of expanded data Malcolm is a powerful, easily deployable network 🖧 traffic analysis tool suite for network security monitoring 🕵🏻‍♀️. Malcolm operates as a cluster of containers 📦, isolated sandboxes which each serve a dedicated function of the system. This makes Malcolm deployable with frameworks like Docker 🐋, Podman 🦭, and Kubernetes ⎈. Check out the Quick Start guide for examples on how to get up and running. Alternatively, dedicated official ISO installer images 💿 for Malcolm and Hedgehog Linux 🦔 can be downloaded from Malcolm's releases page on GitHub. Due to limits on individual files in GitHub releases, these ISO files have been split 🪓 into 2GB chunks and can be reassembled with scripts provided for both Bash 🐧 (release_cleaver.sh) and PowerShell 🪟 (release_cleaver.ps1). See Downloading Malcolm - Installer ISOs for instructions. As always, join us on the Malcolm discussions board 💬 to engage with the community, or pop some corn 🍿 and watch a video 📼. #Malcolm #HedgehogLinux #Zeek #Arkime #Strelka #NetBox #OpenSearch #Elasticsearch #Suricata #PCAP #NetworkTrafficAnalysis #networksecuritymonitoring #OT #ICS #icssecurity #CyberSecurity #Cyber #Infosec #INL