v23.03.0 development #156

mmguero · 2023-03-08T15:27:33Z

Malcolm v23.03.0 is a release with enhancements, component version updates and bug fixes.

Enhancements
- Replace Zeek's misc/scan.zeek with ncsa/bro-simple-scan
- terminate start and restart scripts once Malcolm has started properly (Idea: Terminate ./script/start once Malcolm has started properly. cisagov/Malcolm#240 and Terminate ./script/start once Malcolm has started properly. cisagov/Malcolm#241, thanks @Njinx)
- minor usability improvements for ISO-installed Malcolm and Hedgehog (minor usability improvements for ISO-installed Malcolm and Hedgehog #155)
  - Added a "Configure Malcolm" menu item (under the "Internet" GTK menu with the other Malcolm stuff) and launcher on the top panel of icons in Malcolm. This runs ./scripts/install.py --configure in full screen. May look at starting this automatically on first boot in the future. (Malcolm)
  - Added Malcolm shortcut to gtk-3.0/bookmarks so it shows up in Thunar sidebar (Malcolm)
  - Added /opt/sensor/sensor_ctl shortcut to gtk-3.0/bookmarks so it shows up in Thunar sidebar (Hedgehog)
  - Have tilix from launcher panel start in /opt/sensor/sensor_ctl (Hedgehog)
- minor tweaks to defaults for install.py --configure (enable offline-capable file scanners by default)
- interrupt NetBox startup import script when netbox-restore is run
- added NetBox restore logic to reset_and_auto_populate.sh script (used mostly for demos and presentations)
Component version updates
- Arkime to v4.2.0
- OpenSearch and OpenSearch Dashboards to 2.6.0
- Logstash from v8.4.0 to v8.6.1
- Beats to v8.6.2
- Zeek to v5.0.7
- OpenSearch-Py to v2.2.0 (and remove opensearch-dsl which is now part of opensearch-py)
- Supercronic to v0.2.2
- Capa to v5.0.0
- Fluent Bit to v2.0.9
- Version updates to various Python package dependencies
Fixes
- last few seconds' Zeek logs prior to log rotation may be lost (last few seconds' Zeek logs prior to log rotation may be lost #151)
- in ISO-packaged Malcolm installation scripts directory, symlink netbox-backup and netbox-restore to control.py
- improve opensearchpy connect/health check logig in pcap_watcher.py in pcap-monitor container

…zeek/zeek/blob/cdadc329859810244244c8800f0102543e4f134f/NEWS#L540-L541)

…cript

…leases/tag/v0.2.2)

…rtup is "finished". for cisagov#241 and cisagov#240.

… doesn't take so long

… Logstash from v8.4.0 to v8.6.1 - https://github.com/opensearch-project/OpenSearch/blob/bc50a2edcf29c3c41b7a777575c61e1874847d8a/release-notes/opensearch.release-notes-2.6.0.md - https://github.com/opensearch-project/OpenSearch-Dashboards/blob/69bcbfeea9bb345364e47f048cd5bcfe64c9c242/release-notes/opensearch-dashboards.release-notes-2.6.0.md - https://www.elastic.co/guide/en/logstash/current/releasenotes.html

…ddded0d303da07acc8c9ac3af5f405a7/CHANGELOG#L33-L60)

…/opensearch-py/releases/tag/v2.2.0) (still needs testing)

…g rotation may be lost

…into v23.03.0_merge_idaholab

mmguero and others added 30 commits February 3, 2023 15:22

bump development for v23.02.1

bffcbca

replace misc/scan.zeek with ncsa/bro-simple-scan (https://github.com/…

602d7b5

…zeek/zeek/blob/cdadc329859810244244c8800f0102543e4f134f/NEWS#L540-L541)

Added dependency for simple scan script

adaebdc

bump capa to v5.0.0 and fluent-bit to 2.0.9 for windows convenience s…

0dda49b

…cript

in packaged malcolm, symlink netbox-backup and netbox-restore

7d0f637

scan files with offline scanners by default

438e7a2

terminate netbox_init.py prior to restoring previous netbox database

e7e4413

terminate netbox_init.py prior to restoring previous netbox database

a5089d6

terminate netbox_init.py prior to restoring previous netbox database

e9af582

terminate netbox_init.py prior to restoring previous netbox database

e0f9f1e

update beats to v8.6.2

5fce775

Bump werkzeug from 1.0.1 to 2.2.3 in /sensor-iso/interface

0709fdc

update python package versions for sensor

3c29c42

Update zeek to v5.0.7 (https://github.com/zeek/zeek/releases/tag/v5.0.7)

9627daa

bump supercronic to v0.2.2 (https://github.com/aptible/supercronic/re…

abe8ffa

…leases/tag/v0.2.2)

Moved list of Malcolm URLs to when Malcolm is actually finished starting

23665c3

Stop ./scripts/start once Malcolm has finished starting

2177413

minor tweaks for the changes for start/restart exiting logs after sta…

9248f78

…rtup is "finished". for cisagov#241 and cisagov#240.

Modify a words

69151eb

change venv files to root ownership so that startup for non-1000 UIDs…

d1e1275

… doesn't take so long

Bump version to v23.03.0

19f6fa8

Bump Arkime to v4.2.0 (https://github.com/arkime/arkime/blob/6d549e51…

bc424c8

…ddded0d303da07acc8c9ac3af5f405a7/CHANGELOG#L33-L60)

update opensearch-py to v2.2.0 (https://github.com/opensearch-project…

6317045

…/opensearch-py/releases/tag/v2.2.0) (still needs testing)

Fix issue with new opensearch-py

ebfa54e

Added a 'configure malcolm' menu item

fda6c98

added better reconnect/checking in pcap_watcher.py

a4506eb

minor usability tweaks for ISO

3084dcb

(hopefully) fix idaholab#151, last few seconds' Zeek logs prior to lo…

43e63a4

…g rotation may be lost

Merge branch 'development' of https://github.com/mmguero-dev/Malcolm …

cd61e41

…into v23.03.0_merge_idaholab

mmguero added 2 commits March 8, 2023 08:24

some documentation updates prior to release

a9da1e1

Merge branch 'development' of https://github.com/mmguero-dev/Malcolm …

46bbaaa

…into v23.03.0_merge_idaholab

mmguero added the PR Pull request label Mar 8, 2023

mmguero self-assigned this Mar 8, 2023

mmguero merged commit 4adf3c9 into idaholab:main Mar 8, 2023

mmguero deleted the v23.03.0_merge_idaholab branch March 8, 2023 20:33

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

v23.03.0 development #156

v23.03.0 development #156

mmguero commented Mar 8, 2023 •

edited

Loading

v23.03.0 development #156

v23.03.0 development #156

Conversation

mmguero commented Mar 8, 2023 • edited Loading

mmguero commented Mar 8, 2023 •

edited

Loading