diff --git a/Dockerfiles/arkime.Dockerfile b/Dockerfiles/arkime.Dockerfile index ec42a0cdf..710abfc9c 100644 --- a/Dockerfiles/arkime.Dockerfile +++ b/Dockerfiles/arkime.Dockerfile @@ -88,10 +88,10 @@ FROM debian:buster-slim LABEL maintainer="malcolm.netsec@gmail.com" LABEL org.opencontainers.image.authors='malcolm.netsec@gmail.com' -LABEL org.opencontainers.image.url='https://github.com/cisagov/Malcolm' -LABEL org.opencontainers.image.documentation='https://github.com/cisagov/Malcolm/blob/master/README.md' -LABEL org.opencontainers.image.source='https://github.com/cisagov/Malcolm' -LABEL org.opencontainers.image.vendor='Cybersecurity and Infrastructure Security Agency' +LABEL org.opencontainers.image.url='https://github.com/idaholab/Malcolm' +LABEL org.opencontainers.image.documentation='https://github.com/idaholab/Malcolm/blob/master/README.md' +LABEL org.opencontainers.image.source='https://github.com/idaholab/Malcolm' +LABEL org.opencontainers.image.vendor='Idaho National Laboratory' LABEL org.opencontainers.image.title='malcolmnetsec/arkime' LABEL org.opencontainers.image.description='Malcolm container providing Arkime' diff --git a/Dockerfiles/curator.Dockerfile b/Dockerfiles/curator.Dockerfile index e0fb5acc7..4926fd854 100644 --- a/Dockerfiles/curator.Dockerfile +++ b/Dockerfiles/curator.Dockerfile @@ -3,10 +3,10 @@ FROM debian:buster-slim # Copyright (c) 2021 Battelle Energy Alliance, LLC. All rights reserved. LABEL maintainer="malcolm.netsec@gmail.com" LABEL org.opencontainers.image.authors='malcolm.netsec@gmail.com' -LABEL org.opencontainers.image.url='https://github.com/cisagov/Malcolm' -LABEL org.opencontainers.image.documentation='https://github.com/cisagov/Malcolm/blob/master/README.md' -LABEL org.opencontainers.image.source='https://github.com/cisagov/Malcolm' -LABEL org.opencontainers.image.vendor='Cybersecurity and Infrastructure Security Agency' +LABEL org.opencontainers.image.url='https://github.com/idaholab/Malcolm' +LABEL org.opencontainers.image.documentation='https://github.com/idaholab/Malcolm/blob/master/README.md' +LABEL org.opencontainers.image.source='https://github.com/idaholab/Malcolm' +LABEL org.opencontainers.image.vendor='Idaho National Laboratory' LABEL org.opencontainers.image.title='malcolmnetsec/elastalert' LABEL org.opencontainers.image.description='Malcolm container providing curation for Elasticsearch indices' diff --git a/Dockerfiles/elastalert.Dockerfile b/Dockerfiles/elastalert.Dockerfile index c980133fb..505ef3223 100644 --- a/Dockerfiles/elastalert.Dockerfile +++ b/Dockerfiles/elastalert.Dockerfile @@ -3,10 +3,10 @@ FROM mmguero/elastalert:2.0.5 # Copyright (c) 2021 Battelle Energy Alliance, LLC. All rights reserved. LABEL maintainer="malcolm.netsec@gmail.com" LABEL org.opencontainers.image.authors='malcolm.netsec@gmail.com' -LABEL org.opencontainers.image.url='https://github.com/cisagov/Malcolm' -LABEL org.opencontainers.image.documentation='https://github.com/cisagov/Malcolm/blob/master/README.md' -LABEL org.opencontainers.image.source='https://github.com/cisagov/Malcolm' -LABEL org.opencontainers.image.vendor='Cybersecurity and Infrastructure Security Agency' +LABEL org.opencontainers.image.url='https://github.com/idaholab/Malcolm' +LABEL org.opencontainers.image.documentation='https://github.com/idaholab/Malcolm/blob/master/README.md' +LABEL org.opencontainers.image.source='https://github.com/idaholab/Malcolm' +LABEL org.opencontainers.image.vendor='Idaho National Laboratory' LABEL org.opencontainers.image.title='malcolmnetsec/elastalert' LABEL org.opencontainers.image.description='Malcolm container providing an alerting framework for Elasticsearch' diff --git a/Dockerfiles/elasticsearch.Dockerfile b/Dockerfiles/elasticsearch.Dockerfile index 07694a837..2c791acb8 100644 --- a/Dockerfiles/elasticsearch.Dockerfile +++ b/Dockerfiles/elasticsearch.Dockerfile @@ -3,10 +3,10 @@ FROM docker.elastic.co/elasticsearch/elasticsearch-oss:7.6.2 # Copyright (c) 2021 Battelle Energy Alliance, LLC. All rights reserved. LABEL maintainer="malcolm.netsec@gmail.com" LABEL org.opencontainers.image.authors='malcolm.netsec@gmail.com' -LABEL org.opencontainers.image.url='https://github.com/cisagov/Malcolm' -LABEL org.opencontainers.image.documentation='https://github.com/cisagov/Malcolm/blob/master/README.md' -LABEL org.opencontainers.image.source='https://github.com/cisagov/Malcolm' -LABEL org.opencontainers.image.vendor='Cybersecurity and Infrastructure Security Agency' +LABEL org.opencontainers.image.url='https://github.com/idaholab/Malcolm' +LABEL org.opencontainers.image.documentation='https://github.com/idaholab/Malcolm/blob/master/README.md' +LABEL org.opencontainers.image.source='https://github.com/idaholab/Malcolm' +LABEL org.opencontainers.image.vendor='Idaho National Laboratory' LABEL org.opencontainers.image.title='malcolmnetsec/elasticsearch-oss' LABEL org.opencontainers.image.description='Malcolm container providing Elasticsearch (the Apache-licensed variant)' diff --git a/Dockerfiles/file-monitor.Dockerfile b/Dockerfiles/file-monitor.Dockerfile index e3385c330..5d1c38fff 100644 --- a/Dockerfiles/file-monitor.Dockerfile +++ b/Dockerfiles/file-monitor.Dockerfile @@ -3,10 +3,10 @@ FROM debian:buster-slim # Copyright (c) 2021 Battelle Energy Alliance, LLC. All rights reserved. LABEL maintainer="malcolm.netsec@gmail.com" LABEL org.opencontainers.image.authors='malcolm.netsec@gmail.com' -LABEL org.opencontainers.image.url='https://github.com/cisagov/Malcolm' -LABEL org.opencontainers.image.documentation='https://github.com/cisagov/Malcolm/blob/master/README.md' -LABEL org.opencontainers.image.source='https://github.com/cisagov/Malcolm' -LABEL org.opencontainers.image.vendor='Cybersecurity and Infrastructure Security Agency' +LABEL org.opencontainers.image.url='https://github.com/idaholab/Malcolm' +LABEL org.opencontainers.image.documentation='https://github.com/idaholab/Malcolm/blob/master/README.md' +LABEL org.opencontainers.image.source='https://github.com/idaholab/Malcolm' +LABEL org.opencontainers.image.vendor='Idaho National Laboratory' LABEL org.opencontainers.image.title='malcolmnetsec/file-monitor' LABEL org.opencontainers.image.description='Malcolm container for scanning files extracted by Zeek' diff --git a/Dockerfiles/file-upload.Dockerfile b/Dockerfiles/file-upload.Dockerfile index 4df450447..c8ae22420 100644 --- a/Dockerfiles/file-upload.Dockerfile +++ b/Dockerfiles/file-upload.Dockerfile @@ -27,10 +27,10 @@ FROM debian:buster-slim AS runtime LABEL maintainer="malcolm.netsec@gmail.com" LABEL org.opencontainers.image.authors='malcolm.netsec@gmail.com' -LABEL org.opencontainers.image.url='https://github.com/cisagov/Malcolm' -LABEL org.opencontainers.image.documentation='https://github.com/cisagov/Malcolm/blob/master/README.md' -LABEL org.opencontainers.image.source='https://github.com/cisagov/Malcolm' -LABEL org.opencontainers.image.vendor='Cybersecurity and Infrastructure Security Agency' +LABEL org.opencontainers.image.url='https://github.com/idaholab/Malcolm' +LABEL org.opencontainers.image.documentation='https://github.com/idaholab/Malcolm/blob/master/README.md' +LABEL org.opencontainers.image.source='https://github.com/idaholab/Malcolm' +LABEL org.opencontainers.image.vendor='Idaho National Laboratory' LABEL org.opencontainers.image.title='malcolmnetsec/file-upload' LABEL org.opencontainers.image.description='Malcolm container providing an interface for uploading PCAP files and Zeek logs for processing' diff --git a/Dockerfiles/filebeat.Dockerfile b/Dockerfiles/filebeat.Dockerfile index a945f0b0a..bd2c81bb0 100644 --- a/Dockerfiles/filebeat.Dockerfile +++ b/Dockerfiles/filebeat.Dockerfile @@ -3,10 +3,10 @@ FROM docker.elastic.co/beats/filebeat-oss:7.6.2 # Copyright (c) 2021 Battelle Energy Alliance, LLC. All rights reserved. LABEL maintainer="malcolm.netsec@gmail.com" LABEL org.opencontainers.image.authors='malcolm.netsec@gmail.com' -LABEL org.opencontainers.image.url='https://github.com/cisagov/Malcolm' -LABEL org.opencontainers.image.documentation='https://github.com/cisagov/Malcolm/blob/master/README.md' -LABEL org.opencontainers.image.source='https://github.com/cisagov/Malcolm' -LABEL org.opencontainers.image.vendor='Cybersecurity and Infrastructure Security Agency' +LABEL org.opencontainers.image.url='https://github.com/idaholab/Malcolm' +LABEL org.opencontainers.image.documentation='https://github.com/idaholab/Malcolm/blob/master/README.md' +LABEL org.opencontainers.image.source='https://github.com/idaholab/Malcolm' +LABEL org.opencontainers.image.vendor='Idaho National Laboratory' LABEL org.opencontainers.image.title='malcolmnetsec/filebeat-oss' LABEL org.opencontainers.image.description='Malcolm container providing Filebeat (the Apache-licensed variant)' diff --git a/Dockerfiles/freq.Dockerfile b/Dockerfiles/freq.Dockerfile index a677a52a6..2e6707494 100644 --- a/Dockerfiles/freq.Dockerfile +++ b/Dockerfiles/freq.Dockerfile @@ -3,10 +3,10 @@ FROM debian:buster-slim # Copyright (c) 2021 Battelle Energy Alliance, LLC. All rights reserved. LABEL maintainer="malcolm.netsec@gmail.com" LABEL org.opencontainers.image.authors='malcolm.netsec@gmail.com' -LABEL org.opencontainers.image.url='https://github.com/cisagov/Malcolm' -LABEL org.opencontainers.image.documentation='https://github.com/cisagov/Malcolm/blob/master/README.md' -LABEL org.opencontainers.image.source='https://github.com/cisagov/Malcolm' -LABEL org.opencontainers.image.vendor='Cybersecurity and Infrastructure Security Agency' +LABEL org.opencontainers.image.url='https://github.com/idaholab/Malcolm' +LABEL org.opencontainers.image.documentation='https://github.com/idaholab/Malcolm/blob/master/README.md' +LABEL org.opencontainers.image.source='https://github.com/idaholab/Malcolm' +LABEL org.opencontainers.image.vendor='Idaho National Laboratory' LABEL org.opencontainers.image.title='malcolmnetsec/freq' LABEL org.opencontainers.image.description='Malcolm container providing an interface to Mark Baggett''s freq_server.py' diff --git a/Dockerfiles/htadmin.Dockerfile b/Dockerfiles/htadmin.Dockerfile index 3ce311095..5bb3cb1b2 100644 --- a/Dockerfiles/htadmin.Dockerfile +++ b/Dockerfiles/htadmin.Dockerfile @@ -3,10 +3,10 @@ FROM debian:buster-slim # Copyright (c) 2021 Battelle Energy Alliance, LLC. All rights reserved. LABEL maintainer="malcolm.netsec@gmail.com" LABEL org.opencontainers.image.authors='malcolm.netsec@gmail.com' -LABEL org.opencontainers.image.url='https://github.com/cisagov/Malcolm' -LABEL org.opencontainers.image.documentation='https://github.com/cisagov/Malcolm/blob/master/README.md' -LABEL org.opencontainers.image.source='https://github.com/cisagov/Malcolm' -LABEL org.opencontainers.image.vendor='Cybersecurity and Infrastructure Security Agency' +LABEL org.opencontainers.image.url='https://github.com/idaholab/Malcolm' +LABEL org.opencontainers.image.documentation='https://github.com/idaholab/Malcolm/blob/master/README.md' +LABEL org.opencontainers.image.source='https://github.com/idaholab/Malcolm' +LABEL org.opencontainers.image.vendor='Idaho National Laboratory' LABEL org.opencontainers.image.title='malcolmnetsec/htadmin' LABEL org.opencontainers.image.description='Malcolm container providing htadmin for managing login accounts in an htpasswd file' diff --git a/Dockerfiles/kibana.Dockerfile b/Dockerfiles/kibana.Dockerfile index 8e5bf837e..284f71da7 100644 --- a/Dockerfiles/kibana.Dockerfile +++ b/Dockerfiles/kibana.Dockerfile @@ -3,10 +3,10 @@ FROM docker.elastic.co/kibana/kibana-oss:7.6.2 # Copyright (c) 2021 Battelle Energy Alliance, LLC. All rights reserved. LABEL maintainer="malcolm.netsec@gmail.com" LABEL org.opencontainers.image.authors='malcolm.netsec@gmail.com' -LABEL org.opencontainers.image.url='https://github.com/cisagov/Malcolm' -LABEL org.opencontainers.image.documentation='https://github.com/cisagov/Malcolm/blob/master/README.md' -LABEL org.opencontainers.image.source='https://github.com/cisagov/Malcolm' -LABEL org.opencontainers.image.vendor='Cybersecurity and Infrastructure Security Agency' +LABEL org.opencontainers.image.url='https://github.com/idaholab/Malcolm' +LABEL org.opencontainers.image.documentation='https://github.com/idaholab/Malcolm/blob/master/README.md' +LABEL org.opencontainers.image.source='https://github.com/idaholab/Malcolm' +LABEL org.opencontainers.image.vendor='Idaho National Laboratory' LABEL org.opencontainers.image.title='malcolmnetsec/kibana-oss' LABEL org.opencontainers.image.description='Malcolm container providing Kibana (the Apache-licensed variant)' diff --git a/Dockerfiles/logstash.Dockerfile b/Dockerfiles/logstash.Dockerfile index b0e89a1c5..bf34d5ac4 100644 --- a/Dockerfiles/logstash.Dockerfile +++ b/Dockerfiles/logstash.Dockerfile @@ -26,10 +26,10 @@ FROM docker.elastic.co/logstash/logstash-oss:7.6.2 LABEL maintainer="malcolm.netsec@gmail.com" LABEL org.opencontainers.image.authors='malcolm.netsec@gmail.com' -LABEL org.opencontainers.image.url='https://github.com/cisagov/Malcolm' -LABEL org.opencontainers.image.documentation='https://github.com/cisagov/Malcolm/blob/master/README.md' -LABEL org.opencontainers.image.source='https://github.com/cisagov/Malcolm' -LABEL org.opencontainers.image.vendor='Cybersecurity and Infrastructure Security Agency' +LABEL org.opencontainers.image.url='https://github.com/idaholab/Malcolm' +LABEL org.opencontainers.image.documentation='https://github.com/idaholab/Malcolm/blob/master/README.md' +LABEL org.opencontainers.image.source='https://github.com/idaholab/Malcolm' +LABEL org.opencontainers.image.vendor='Idaho National Laboratory' LABEL org.opencontainers.image.title='malcolmnetsec/logstash-oss' LABEL org.opencontainers.image.description='Malcolm container providing Logstash (the Apache-licensed variant)' diff --git a/Dockerfiles/name-map-ui.Dockerfile b/Dockerfiles/name-map-ui.Dockerfile index 90a300a8c..dd0030f1f 100644 --- a/Dockerfiles/name-map-ui.Dockerfile +++ b/Dockerfiles/name-map-ui.Dockerfile @@ -3,10 +3,10 @@ FROM alpine:3.12 # Copyright (c) 2021 Battelle Energy Alliance, LLC. All rights reserved. LABEL maintainer="malcolm.netsec@gmail.com" LABEL org.opencontainers.image.authors='malcolm.netsec@gmail.com' -LABEL org.opencontainers.image.url='https://github.com/cisagov/Malcolm' -LABEL org.opencontainers.image.documentation='https://github.com/cisagov/Malcolm/blob/master/README.md' -LABEL org.opencontainers.image.source='https://github.com/cisagov/Malcolm' -LABEL org.opencontainers.image.vendor='Cybersecurity and Infrastructure Security Agency' +LABEL org.opencontainers.image.url='https://github.com/idaholab/Malcolm' +LABEL org.opencontainers.image.documentation='https://github.com/idaholab/Malcolm/blob/master/README.md' +LABEL org.opencontainers.image.source='https://github.com/idaholab/Malcolm' +LABEL org.opencontainers.image.vendor='Idaho National Laboratory' LABEL org.opencontainers.image.title='malcolmnetsec/name-map-ui' LABEL org.opencontainers.image.description='Malcolm container providing a user interface for mapping names to network hosts and subnets' diff --git a/Dockerfiles/nginx.Dockerfile b/Dockerfiles/nginx.Dockerfile index 7ce6be0a7..8d81bc268 100644 --- a/Dockerfiles/nginx.Dockerfile +++ b/Dockerfiles/nginx.Dockerfile @@ -50,10 +50,10 @@ FROM alpine:3.12 LABEL maintainer="malcolm.netsec@gmail.com" LABEL org.opencontainers.image.authors='malcolm.netsec@gmail.com' -LABEL org.opencontainers.image.url='https://github.com/cisagov/Malcolm' -LABEL org.opencontainers.image.documentation='https://github.com/cisagov/Malcolm/blob/master/README.md' -LABEL org.opencontainers.image.source='https://github.com/cisagov/Malcolm' -LABEL org.opencontainers.image.vendor='Cybersecurity and Infrastructure Security Agency' +LABEL org.opencontainers.image.url='https://github.com/idaholab/Malcolm' +LABEL org.opencontainers.image.documentation='https://github.com/idaholab/Malcolm/blob/master/README.md' +LABEL org.opencontainers.image.source='https://github.com/idaholab/Malcolm' +LABEL org.opencontainers.image.vendor='Idaho National Laboratory' LABEL org.opencontainers.image.title='malcolmnetsec/nginx-proxy' LABEL org.opencontainers.image.description='Malcolm container providing an NGINX reverse proxy for the other services' diff --git a/Dockerfiles/pcap-capture.Dockerfile b/Dockerfiles/pcap-capture.Dockerfile index de575e6e0..97b2c481b 100644 --- a/Dockerfiles/pcap-capture.Dockerfile +++ b/Dockerfiles/pcap-capture.Dockerfile @@ -3,10 +3,10 @@ FROM debian:buster-slim # Copyright (c) 2021 Battelle Energy Alliance, LLC. All rights reserved. LABEL maintainer="malcolm.netsec@gmail.com" LABEL org.opencontainers.image.authors='malcolm.netsec@gmail.com' -LABEL org.opencontainers.image.url='https://github.com/cisagov/Malcolm' -LABEL org.opencontainers.image.documentation='https://github.com/cisagov/Malcolm/blob/master/README.md' -LABEL org.opencontainers.image.source='https://github.com/cisagov/Malcolm' -LABEL org.opencontainers.image.vendor='Cybersecurity and Infrastructure Security Agency' +LABEL org.opencontainers.image.url='https://github.com/idaholab/Malcolm' +LABEL org.opencontainers.image.documentation='https://github.com/idaholab/Malcolm/blob/master/README.md' +LABEL org.opencontainers.image.source='https://github.com/idaholab/Malcolm' +LABEL org.opencontainers.image.vendor='Idaho National Laboratory' LABEL org.opencontainers.image.title='malcolmnetsec/pcap-capture' LABEL org.opencontainers.image.description='Malcolm container providing network traffic capture capabilities via netsniff-ng and tcpdump' diff --git a/Dockerfiles/pcap-monitor.Dockerfile b/Dockerfiles/pcap-monitor.Dockerfile index 072264648..4ca3cdadd 100644 --- a/Dockerfiles/pcap-monitor.Dockerfile +++ b/Dockerfiles/pcap-monitor.Dockerfile @@ -3,10 +3,10 @@ FROM debian:buster-slim # Copyright (c) 2021 Battelle Energy Alliance, LLC. All rights reserved. LABEL maintainer="malcolm.netsec@gmail.com" LABEL org.opencontainers.image.authors='malcolm.netsec@gmail.com' -LABEL org.opencontainers.image.url='https://github.com/cisagov/Malcolm' -LABEL org.opencontainers.image.documentation='https://github.com/cisagov/Malcolm/blob/master/README.md' -LABEL org.opencontainers.image.source='https://github.com/cisagov/Malcolm' -LABEL org.opencontainers.image.vendor='Cybersecurity and Infrastructure Security Agency' +LABEL org.opencontainers.image.url='https://github.com/idaholab/Malcolm' +LABEL org.opencontainers.image.documentation='https://github.com/idaholab/Malcolm/blob/master/README.md' +LABEL org.opencontainers.image.source='https://github.com/idaholab/Malcolm' +LABEL org.opencontainers.image.vendor='Idaho National Laboratory' LABEL org.opencontainers.image.title='malcolmnetsec/pcap-monitor' LABEL org.opencontainers.image.description='Malcolm container watching for captured or uploaded artifacts to be processed' diff --git a/Dockerfiles/zeek.Dockerfile b/Dockerfiles/zeek.Dockerfile index df7806072..9adb79f71 100644 --- a/Dockerfiles/zeek.Dockerfile +++ b/Dockerfiles/zeek.Dockerfile @@ -75,10 +75,10 @@ FROM debian:buster-slim LABEL maintainer="malcolm.netsec@gmail.com" LABEL org.opencontainers.image.authors='malcolm.netsec@gmail.com' -LABEL org.opencontainers.image.url='https://github.com/cisagov/Malcolm' -LABEL org.opencontainers.image.documentation='https://github.com/cisagov/Malcolm/blob/master/README.md' -LABEL org.opencontainers.image.source='https://github.com/cisagov/Malcolm' -LABEL org.opencontainers.image.vendor='Cybersecurity and Infrastructure Security Agency' +LABEL org.opencontainers.image.url='https://github.com/idaholab/Malcolm' +LABEL org.opencontainers.image.documentation='https://github.com/idaholab/Malcolm/blob/master/README.md' +LABEL org.opencontainers.image.source='https://github.com/idaholab/Malcolm' +LABEL org.opencontainers.image.vendor='Idaho National Laboratory' LABEL org.opencontainers.image.title='malcolmnetsec/zeek' LABEL org.opencontainers.image.description='Malcolm container providing Zeek' diff --git a/License.txt b/License.txt index 3cd0fd5f5..b2dd7d150 100644 --- a/License.txt +++ b/License.txt @@ -19,7 +19,7 @@ publicly and display publicly MALCOLM, in any manner, including by electronic means, and for any purpose whatsoever. -https://github.com/cisagov/Malcolm +https://github.com/idaholab/Malcolm Copyright 2021 Battelle Energy Alliance, LLC diff --git a/Notice.txt b/Notice.txt index 8ffd0cae8..4578f2468 100644 --- a/Notice.txt +++ b/Notice.txt @@ -1,6 +1,6 @@ This project contains code from Idaho National Laboratory's Malcolm Project -https://github.com/cisagov/Malcolm +https://github.com/idaholab/Malcolm See License.txt for license terms. diff --git a/README.md b/README.md index 711d59634..79a188e44 100644 --- a/README.md +++ b/README.md @@ -2,7 +2,7 @@ ![](./docs/images/logo/Malcolm_banner.png) -[Malcolm](https://github.com/cisagov/Malcolm) is a powerful network traffic analysis tool suite designed with the following goals in mind: +[Malcolm](https://github.com/idaholab/Malcolm) is a powerful network traffic analysis tool suite designed with the following goals in mind: * **Easy to use** – Malcolm accepts network traffic data in the form of full packet capture (PCAP) files and Zeek (formerly Bro) logs. These artifacts can be uploaded via a simple browser-based interface or captured live and forwarded to Malcolm using lightweight forwarders. In either case, the data is automatically normalized, enriched, and correlated for analysis. * **Powerful traffic analysis** – Visibility into network communications is provided through two intuitive interfaces: Kibana, a flexible data visualization plugin with dozens of prebuilt dashboards providing an at-a-glance overview of network protocols; and Arkime, a powerful tool for finding and identifying the network sessions comprising suspected security incidents. @@ -15,10 +15,6 @@ Although all of the open source tools which make up Malcolm are already availabl In short, Malcolm provides an easily deployable network analysis tool suite for full packet capture artifacts (PCAP files) and Zeek logs. While Internet access is required to build it, it is not required at runtime. -#### Official CISA source code repository for Malcolm - -Malcolm has moved! The main repository for Malcolm has moved to [https://github.com/cisagov/Malcolm](https://github.com/cisagov/Malcolm) in an effort for [CISA](https://www.cisa.gov/) to consolidate all of the open source projects CISA sponsors into one place. If you have outstanding pull requests and you commit back they should now go back to the main Malcolm repo unless you specifically target them elsewhere. We look forward to hosting more CISA sponsored open source code for ICS and other projects in the future! Commit today, secure tomorrow! - ## Table of Contents * [Quick start](#QuickStart) @@ -93,6 +89,7 @@ Malcolm has moved! The main repository for Malcolm has moved to [https://github. * [Known issues](#Issues) * [Installation example using Ubuntu 20.04 LTS](#InstallationExample) * [Upgrading Malcolm](#UpgradePlan) +* [Forks](#Forks) * [Copyright](#Footer) ## Quick start @@ -103,7 +100,7 @@ For a `TL;DR` example of downloading, configuring, and running Malcolm on a Linu #### Source code -The files required to build and run Malcolm are available on its [GitHub page](https://github.com/cisagov/Malcolm/tree/master). Malcolm's source code is released under the terms of a permissive open source software license (see see `License.txt` for the terms of its release). +The files required to build and run Malcolm are available on the [Idaho National Lab's GitHub page](https://github.com/idaholab/Malcolm/tree/master). Malcolm's source code is released under the terms of a permissive open source software license (see see `License.txt` for the terms of its release). #### Cross-platform considerations when running Python scripts @@ -299,7 +296,7 @@ Malcolm uses [Zeek](https://docs.zeek.org/en/stable/script-reference/proto-analy |Secure Sockets Layer (SSL) / Transport Layer Security (TLS)|[🔗](https://en.wikipedia.org/wiki/Transport_Layer_Security)|[🔗](https://tools.ietf.org/html/rfc5246)|[✓](https://github.com/arkime/arkime/blob/master/capture/parsers/socks.c)|[✓](https://docs.zeek.org/en/stable/scripts/base/protocols/ssl/main.zeek.html#type-SSL::Info)| |Syslog|[🔗](https://en.wikipedia.org/wiki/Syslog)|[🔗](https://tools.ietf.org/html/rfc5424)|[✓](https://github.com/arkime/arkime/blob/master/capture/parsers/tls.c)|[✓](https://docs.zeek.org/en/stable/scripts/base/protocols/syslog/main.zeek.html#type-Syslog::Info)| |Tabular Data Stream|[🔗](https://en.wikipedia.org/wiki/Tabular_Data_Stream)|[🔗](https://www.freetds.org/tds.html) [🔗](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-tds/b46a581a-39de-4745-b076-ec4dbb7d13ec)|[✓](https://github.com/arkime/arkime/blob/master/capture/parsers/tds.c)|[✓](https://github.com/amzn/zeek-plugin-tds/blob/master/scripts/main.zeek)| -|Telnet / remote shell (rsh) / remote login (rlogin)|[🔗](https://en.wikipedia.org/wiki/Telnet)[🔗](https://en.wikipedia.org/wiki/Berkeley_r-commands)|[🔗](https://tools.ietf.org/html/rfc854)[🔗](https://tools.ietf.org/html/rfc1282)|[✓](https://github.com/arkime/arkime/blob/master/capture/parsers/misc.c#L336)|[✓](https://docs.zeek.org/en/current/scripts/base/bif/plugins/Zeek_Login.events.bif.zeek.html)[❋](https://github.com/cisagov/Malcolm/blob/master/zeek/config/login.zeek)| +|Telnet / remote shell (rsh) / remote login (rlogin)|[🔗](https://en.wikipedia.org/wiki/Telnet)[🔗](https://en.wikipedia.org/wiki/Berkeley_r-commands)|[🔗](https://tools.ietf.org/html/rfc854)[🔗](https://tools.ietf.org/html/rfc1282)|[✓](https://github.com/arkime/arkime/blob/master/capture/parsers/misc.c#L336)|[✓](https://docs.zeek.org/en/current/scripts/base/bif/plugins/Zeek_Login.events.bif.zeek.html)[❋](https://github.com/idaholab/Malcolm/blob/master/zeek/config/login.zeek)| |TFTP (Trivial File Transfer Protocol)|[🔗](https://en.wikipedia.org/wiki/Trivial_File_Transfer_Protocol)|[🔗](https://tools.ietf.org/html/rfc1350)||[✓](https://github.com/zeek/spicy-tftp)| |WireGuard|[🔗](https://en.wikipedia.org/wiki/WireGuard)|[🔗](https://www.wireguard.com/protocol/)[🔗](https://www.wireguard.com/papers/wireguard.pdf)||[✓](https://github.com/theparanoids/spicy-noise/blob/master/zeek/spicy-noise.zeek)| |various tunnel protocols (e.g., GTP, GRE, Teredo, AYIYA, IP-in-IP, etc.)|[🔗](https://en.wikipedia.org/wiki/Tunneling_protocol)||[✓](https://github.com/arkime/arkime/blob/master/capture/packet.c)|[✓](https://docs.zeek.org/en/stable/scripts/base/frameworks/tunnels/main.zeek.html#type-Tunnel::Info)| @@ -317,7 +314,7 @@ See [Zeek log integration](#ArkimeZeek) for more information on how Malcolm inte ## Development -Checking out the [Malcolm source code](https://github.com/cisagov/Malcolm/tree/master) results in the following subdirectories in your `malcolm/` working copy: +Checking out the [Malcolm source code](https://github.com/idaholab/Malcolm/tree/master) results in the following subdirectories in your `malcolm/` working copy: * `curator` - code and configuration for the `curator` container which define rules for closing and/or deleting old Elasticsearch indices * `Dockerfiles` - a directory containing build instructions for Malcolm's docker images @@ -882,14 +879,14 @@ Note that currently Microsoft Windows and Apple macOS platforms run Docker insid ### Using a network sensor appliance -A remote network sensor appliance can be used to monitor network traffic, capture PCAP files, and forward Zeek logs, Arkime sessions, or other information to Malcolm. [Hedgehog Linux](https://github.com/cisagov/Malcolm/tree/master/sensor-iso/) is a Debian-based operating system built to +A remote network sensor appliance can be used to monitor network traffic, capture PCAP files, and forward Zeek logs, Arkime sessions, or other information to Malcolm. [Hedgehog Linux](https://github.com/idaholab/Malcolm/tree/master/sensor-iso/) is a Debian-based operating system built to * monitor network interfaces * capture packets to PCAP files * detect file transfers in network traffic and extract and scan those files for threats -* generate and forward Zeek logs, Arkime sessions, and other information to [Malcolm](https://github.com/cisagov/Malcolm) +* generate and forward Zeek logs, Arkime sessions, and other information to [Malcolm](https://github.com/idaholab/malcolm) -Please see the [Hedgehog Linux README](https://github.com/cisagov/Malcolm/blob/master/sensor-iso/README.md) for more information. +Please see the [Hedgehog Linux README](https://github.com/idaholab/Malcolm/blob/master/sensor-iso/README.md) for more information. ### Manually forwarding Zeek logs from an external source @@ -1632,13 +1629,13 @@ After Malcolm ingests your data (or, more specifically, after it has ingested a ## Installation example using Ubuntu 20.04 LTS -Here's a step-by-step example of getting [Malcolm from GitHub](https://github.com/cisagov/Malcolm/tree/master), configuring your system and your Malcolm instance, and running it on a system running Ubuntu Linux. Your mileage may vary depending on your individual system configuration, but this should be a good starting point. +Here's a step-by-step example of getting [Malcolm from GitHub](https://github.com/idaholab/Malcolm/tree/master), configuring your system and your Malcolm instance, and running it on a system running Ubuntu Linux. Your mileage may vary depending on your individual system configuration, but this should be a good starting point. The commands in this example should be executed as a non-root user. -You can use `git` to clone Malcolm into a local working copy, or you can download and extract the artifacts from the [latest release](https://github.com/cisagov/Malcolm/releases). +You can use `git` to clone Malcolm into a local working copy, or you can download and extract the artifacts from the [latest release](https://github.com/idaholab/Malcolm/releases). -To install Malcolm from the latest Malcolm release, browse to the [Malcolm releases page on GitHub](https://github.com/cisagov/Malcolm/releases) and download at a minimum `install.py` and the `malcolm_YYYYMMDD_HHNNSS_xxxxxxx.tar.gz` file, then navigate to your downloads directory: +To install Malcolm from the latest Malcolm release, browse to the [Malcolm releases page on GitHub](https://github.com/idaholab/Malcolm/releases) and download at a minimum `install.py` and the `malcolm_YYYYMMDD_HHNNSS_xxxxxxx.tar.gz` file, then navigate to your downloads directory: ``` user@host:~$ cd Downloads/ user@host:~/Downloads$ ls @@ -1647,7 +1644,7 @@ malcolm_common.py install.py malcolm_20190611_095410_ce2d8de.tar.gz If you are obtaining Malcolm using `git` instead, run the following command to clone Malcolm into a local working copy: ``` -user@host:~$ git clone https://github.com/cisagov/Malcolm +user@host:~$ git clone https://github.com/idaholab/Malcolm Cloning into 'Malcolm'... remote: Enumerating objects: 443, done. remote: Counting objects: 100% (443/443), done. @@ -1943,7 +1940,7 @@ If you checked out a working copy of the Malcolm repository from GitHub with a ` ### Scenario 2: Malcolm was installed from a packaged tarball -If you installed Malcolm from [pre-packaged installation files](https://github.com/cisagov/Malcolm#Packager), here are the basic steps to perform an upgrade: +If you installed Malcolm from [pre-packaged installation files](https://github.com/idaholab/malcolm#Packager), here are the basic steps to perform an upgrade: 1. stop Malcolm * `./scripts/stop` @@ -1980,12 +1977,27 @@ After upgrading following one of the previous outlines, give Malcolm several min Once the upgraded instance Malcolm has started up, you'll probably want to import the new dashboards and visualizations for Kibana. You can signal Malcolm to load the new visualizations by opening Kibana, clicking **Management** → **Index Patterns**, then selecting the `sessions2-*` index pattern and clicking the delete **🗑** button near the upper-right of the window. Confirm the **Delete index pattern?** prompt by clicking **Delete**. Close the Kibana browser window. After a few minutes the missing index pattern will be detected and Kibana will be signalled to load its new dashboards and visualizations. +## Forks + +[CISA](https://www.cisa.gov/) maintains the original source code repository for Malcolm at [https://github.com/cisagov/Malcolm](https://github.com/cisagov/Malcolm). The [Idaho National Lab](https://inl.gov/)'s fork of Malcolm, which is currently kept up-to-date with CISA's upstream development, can be found at [https://github.com/idaholab/Malcolm](https://github.com/idaholab/Malcolm). + ## Copyright -[Malcolm](https://github.com/cisagov/Malcolm) is Copyright 2021 Battelle Energy Alliance, LLC, and is developed and released through the cooperation of the [Cybersecurity and Infrastructure Security Agency](https://www.cisa.gov/) of the [U.S. Department of Homeland Security](https://www.dhs.gov/). +[Malcolm](https://github.com/idaholab/Malcolm) is Copyright 2021 Battelle Energy Alliance, LLC, and is developed and released through the cooperation of the [Cybersecurity and Infrastructure Security Agency](https://www.cisa.gov/) of the [U.S. Department of Homeland Security](https://www.dhs.gov/). See [`License.txt`](./License.txt) for the terms of its release. ### Contact information of author(s): [Seth Grover](mailto:malcolm.netsec@gmail.com?subject=Malcolm) + +## Other Software +Idaho National Laboratory is a cutting edge research facility which is constantly producing high quality research and software. Feel free to take a look at our other software and scientific offerings at: + +[Primary Technology Offerings Page](https://www.inl.gov/inl-initiatives/technology-deployment) + +[Supported Open Source Software](https://github.com/idaholab) + +[Raw Experiment Open Source Software](https://github.com/IdahoLabResearch) + +[Unsupported Open Source Software](https://github.com/IdahoLabCuttingBoard) diff --git a/kibana/scripts/kibana_index_refresh.py b/kibana/scripts/kibana_index_refresh.py index 436b60843..eaabc63e4 100755 --- a/kibana/scripts/kibana_index_refresh.py +++ b/kibana/scripts/kibana_index_refresh.py @@ -107,7 +107,7 @@ def main(): # define field formatting map for Kibana -> Arkime drilldown and other URL drilldowns # - # see: https://github.com/cisagov/Malcolm/issues/133 + # see: https://github.com/idaholab/Malcolm/issues/133 # https://github.com/mmguero-dev/kibana-plugin-drilldownmenu # # fieldFormatMap is diff --git a/logstash/pipelines/zeek/11_zeek_logs.conf b/logstash/pipelines/zeek/11_zeek_logs.conf index cdbcebded..8b91c7fd6 100644 --- a/logstash/pipelines/zeek/11_zeek_logs.conf +++ b/logstash/pipelines/zeek/11_zeek_logs.conf @@ -274,7 +274,7 @@ filter { } else if ([source] == "bacnet") { ############################################################################################################################# # bacnet.log - # https://github.com/cisagov/ICSNPP + # https://github.com/idaholab/ICSNPP dissect { id => "dissect_zeek_bacnet" @@ -307,7 +307,7 @@ filter { } else if ([source] == "bsap_ip_header") { ############################################################################################################################# # bsap_ip_header.log - # https://github.com/cisagov/ICSNPP + # https://github.com/idaholab/ICSNPP dissect { id => "dissect_zeek_bsap_ip_header" @@ -340,7 +340,7 @@ filter { } else if ([source] == "bsap_ip_rdb") { ############################################################################################################################# # bsap_ip_rdb.log - # https://github.com/cisagov/ICSNPP + # https://github.com/idaholab/ICSNPP dissect { id => "dissect_zeek_bsap_ip_rdb" @@ -379,7 +379,7 @@ filter { } else if ([source] == "bsap_ip_unknown") { ############################################################################################################################# # bsap_ip_unknown.log (dropped for now, see above) - # https://github.com/cisagov/ICSNPP + # https://github.com/idaholab/ICSNPP dissect { id => "dissect_zeek_bsap_ip_unknown" @@ -412,7 +412,7 @@ filter { } else if ([source] == "bsap_serial_header") { ############################################################################################################################# # bsap_serial_header.log - # https://github.com/cisagov/ICSNPP + # https://github.com/idaholab/ICSNPP dissect { id => "dissect_zeek_bsap_serial_header" @@ -445,7 +445,7 @@ filter { } else if ([source] == "bsap_serial_rdb") { ############################################################################################################################# # bsap_serial_rdb.log - # https://github.com/cisagov/ICSNPP + # https://github.com/idaholab/ICSNPP dissect { id => "dissect_zeek_bsap_serial_rdb" @@ -484,7 +484,7 @@ filter { } else if ([source] == "bsap_serial_rdb_ext") { ############################################################################################################################# # bsap_serial_rdb_ext.log - # https://github.com/cisagov/ICSNPP + # https://github.com/idaholab/ICSNPP dissect { id => "dissect_zeek_bsap_serial_rdb_ext" @@ -523,7 +523,7 @@ filter { } else if ([source] == "bsap_serial_unknown") { ############################################################################################################################# # bsap_serial_unknown.log (dropped for now, see above) - # https://github.com/cisagov/ICSNPP + # https://github.com/idaholab/ICSNPP dissect { id => "dissect_zeek_bsap_serial_unknown" @@ -556,7 +556,7 @@ filter { } else if ([source] == "bacnet_discovery") { ############################################################################################################################# # bacnet_discovery.log - # https://github.com/cisagov/ICSNPP + # https://github.com/idaholab/ICSNPP dissect { id => "dissect_zeek_bacnet_discovery" @@ -589,7 +589,7 @@ filter { } else if ([source] == "bacnet_property") { ############################################################################################################################# # bacnet_property.log - # https://github.com/cisagov/ICSNPP + # https://github.com/idaholab/ICSNPP dissect { id => "dissect_zeek_bacnet_property" @@ -622,7 +622,7 @@ filter { } else if ([source] == "cip") { ############################################################################################################################# # cip.log - # https://github.com/cisagov/ICSNPP + # https://github.com/idaholab/ICSNPP # # todo: class_id, instance_id is a hex integer, should it be converted to an integer? @@ -654,7 +654,7 @@ filter { } else if ([source] == "cip_identity") { ############################################################################################################################# # cip_identity.log - # https://github.com/cisagov/ICSNPP + # https://github.com/idaholab/ICSNPP # # TODO: device_status and device_state are a hex int string, convert to int? @@ -686,7 +686,7 @@ filter { } else if ([source] == "cip_io") { ############################################################################################################################# # cip_io.log - # https://github.com/cisagov/ICSNPP + # https://github.com/idaholab/ICSNPP # dissect { @@ -897,7 +897,7 @@ filter { } else if ([source] == "dnp3_control") { ############################################################################################################################# # dnp3_control.log - # https://github.com/cisagov/ICSNPP + # https://github.com/idaholab/ICSNPP dissect { id => "dissect_zeek_dnp3_control" @@ -927,7 +927,7 @@ filter { } else if ([source] == "dnp3_objects") { ############################################################################################################################# # dnp3_objects.log - # https://github.com/cisagov/ICSNPP + # https://github.com/idaholab/ICSNPP dissect { id => "dissect_zeek_dnp3_objects" @@ -1019,7 +1019,7 @@ filter { } else if ([source] == "enip") { ############################################################################################################################# # enip.log - # https://github.com/cisagov/ICSNPP + # https://github.com/idaholab/ICSNPP # dissect { @@ -1640,7 +1640,7 @@ filter { } else if ([source] == "modbus_detailed") { ############################################################################################################################# # modbus_detailed.log - # https://github.com/cisagov/ICSNPP + # https://github.com/idaholab/ICSNPP dissect { id => "dissect_zeek_modbus_detailed" @@ -1670,7 +1670,7 @@ filter { } else if ([source] == "modbus_mask_write_register") { ############################################################################################################################# # modbus_mask_write_register.log - # https://github.com/cisagov/ICSNPP + # https://github.com/idaholab/ICSNPP dissect { id => "dissect_zeek_modbus_mask_write_register" @@ -1700,7 +1700,7 @@ filter { } else if ([source] == "modbus_read_write_multiple_registers") { ############################################################################################################################# # modbus_read_write_multiple_registers.log - # https://github.com/cisagov/ICSNPP + # https://github.com/idaholab/ICSNPP dissect { id => "dissect_zeek_modbus_read_write_multiple_registers" # zeek's default delimiter is a literal tab, MAKE SURE YOUR EDITOR DOESN'T SCREW IT UP diff --git a/moloch/wise/source.zeeklogs.js b/moloch/wise/source.zeeklogs.js index 5ea8f37f1..b44901e98 100755 --- a/moloch/wise/source.zeeklogs.js +++ b/moloch/wise/source.zeeklogs.js @@ -5,13 +5,13 @@ var wiseSource = require('./wiseSource.js') ////////////////////////////////////////////////////////////////////////////////// // Arkime WISE Data Source definition for Zeek logs. // -// Part of Malcolm (https://github.com/cisagov/Malcolm) +// Part of Malcolm (https://github.com/idaholab/malcolm) // // Data may be populated with Malcolm's Zeek Logstash filters: -// (particularly https://raw.githubusercontent.com/cisagov/Malcolm/master/logstash/pipeline-main/11_zeek_logs.conf) +// (particularly https://raw.githubusercontent.com/idaholab/Malcolm/master/logstash/pipeline-main/11_zeek_logs.conf) // // Copyright (c) 2021 Battelle Energy Alliance, LLC. All rights reserved. -// see https://raw.githubusercontent.com/cisagov/Malcolm/master/License.txt +// see https://raw.githubusercontent.com/idaholab/Malcolm/master/License.txt ////////////////////////////////////////////////////////////////////////////////// function ZeekLogs (api, section) { ZeekLogs.super_.call(this, api, section); diff --git a/scripts/beats/README.md b/scripts/beats/README.md index 3fb79a11d..d1356c959 100644 --- a/scripts/beats/README.md +++ b/scripts/beats/README.md @@ -172,9 +172,9 @@ KeyboardInterrupt # Copyright -[Malcolm](https://github.com/cisagov/Malcolm) is Copyright 2021 Battelle Energy Alliance, LLC, and is developed and released through the cooperation of the Cybersecurity and Infrastructure Security Agency of the U.S. Department of Homeland Security. +[Malcolm](https://github.com/idaholab/Malcolm) is Copyright 2021 Battelle Energy Alliance, LLC, and is developed and released through the cooperation of the Cybersecurity and Infrastructure Security Agency of the U.S. Department of Homeland Security. -See [`License.txt`](https://raw.githubusercontent.com/cisagov/Malcolm/master/License.txt) for the terms of its release. +See [`License.txt`](https://raw.githubusercontent.com/idaholab/Malcolm/master/License.txt) for the terms of its release. ### Contact information of author(s): diff --git a/scripts/beats/windows_vm_example/Malcolm_Windows_Forwarder_Download_and_Config.ps1 b/scripts/beats/windows_vm_example/Malcolm_Windows_Forwarder_Download_and_Config.ps1 index 10dac34bc..480ef9f62 100644 --- a/scripts/beats/windows_vm_example/Malcolm_Windows_Forwarder_Download_and_Config.ps1 +++ b/scripts/beats/windows_vm_example/Malcolm_Windows_Forwarder_Download_and_Config.ps1 @@ -1,5 +1,5 @@ # configure a windows host to forward auditbeat and winlogbeat logs -# to Malcolm (see https://github.com/cisagov/Malcolm/tree/master/scripts/beats) +# to Malcolm (see https://github.com/idaholab/Malcolm/tree/master/scripts/beats) $beatversion = "7.6.2" @@ -25,7 +25,7 @@ function Uninstall-Beat { # # - Download $beat-$beatversion-windows-x86_64.zip from artifacts.elastic.co # - Unzip to C:\Program Files\beat -# - Download sample config for $beat from cisagov/Malcolm to C:\Program Files\beat +# - Download sample config for $beat from idaholab/Malcolm to C:\Program Files\beat # function Download-Beat { param( [string]$beat ) @@ -37,13 +37,13 @@ function Download-Beat { ((Get-Content -path "C:\\Program Files\\$beat\\install-service-$beat.ps1" -Raw) -replace 'ProgramData','Program Files') | Set-Content -Path "C:\\Program Files\\$beat\\install-service-$beat.ps1" ((Get-Content -path "C:\\Program Files\\$beat\\install-service-$beat.ps1" -Raw) -replace ' -path',' --path') | Set-Content -Path "C:\\Program Files\\$beat\\install-service-$beat.ps1" - Invoke-WebRequest -UseBasicParsing -OutFile "C:\\Program Files\\$beat\\$beat.yml" -Uri https://raw.githubusercontent.com/cisagov/Malcolm/master/scripts/beats/windows_vm_example/$beat.yml + Invoke-WebRequest -UseBasicParsing -OutFile "C:\\Program Files\\$beat\\$beat.yml" -Uri https://raw.githubusercontent.com/idaholab/Malcolm/master/scripts/beats/windows_vm_example/$beat.yml (Get-Content "C:\\Program Files\\$beat\\$beat.yml") | Set-Content "C:\\Program Files\\$beat\\$beat.yml" } ################################################################################ # Connectivity boilerplate to add to the sample .yml files downloaded from -# cisagov/Malcolm +# idaholab/Malcolm # $beat_boilerplate = @' diff --git a/sensor-iso/README.md b/sensor-iso/README.md index 54b7dfdc4..c711d36dd 100644 --- a/sensor-iso/README.md +++ b/sensor-iso/README.md @@ -8,7 +8,7 @@ Hedgehog Linux is a Debian-based operating system built to * monitor network interfaces * capture packets to PCAP files * detect file transfers in network traffic and extract and scan those files for threats -* generate and forward Zeek logs, Arkime sessions and other information to [Malcolm](https://github.com/cisagov/Malcolm) +* generate and forward Zeek logs, Arkime sessions and other information to [Malcolm](https://github.com/idaholab/malcolm) ### Table of Contents @@ -154,7 +154,7 @@ In either case, upon selecting **OK** the network interface will be brought down ### Time synchronization -Returning to the configuration mode selection, choose **Time Sync**. Here you can configure the sensor to keep its time synchronized with either an NTP server (using the NTP protocol) or a local [Malcolm](https://github.com/cisagov/Malcolm) aggregator or another HTTP/HTTPS server. On the next dialog, choose the time synchronization method you wish to configure. +Returning to the configuration mode selection, choose **Time Sync**. Here you can configure the sensor to keep its time synchronized with either an NTP server (using the NTP protocol) or a local [Malcolm](https://github.com/idaholab/malcolm) aggregator or another HTTP/HTTPS server. On the next dialog, choose the time synchronization method you wish to configure. ![Time synchronization method](./docs/images/time_sync_mode.png) @@ -211,7 +211,7 @@ You'll be prompted to specify which engine(s) to use to analyze extracted files. * scanning files with [**Yara**](https://github.com/VirusTotal/yara); to enable this method, select **ZEEK_FILE_SCAN_YARA** when specifying scanners for Zeek-carved files * scanning portable executable (PE) files with [**Capa**](https://github.com/fireeye/capa); to enable this method, select **ZEEK_FILE_SCAN_CAPA** when specifying scanners for Zeek-carved files -Files which are flagged as potentially malicious will be logged as Zeek `signatures.log` entries, and can be viewed in the **Signatures** dashboard in [Kibana](https://github.com/cisagov/Malcolm#KibanaVisualizations) when forwarded to Malcolm. +Files which are flagged as potentially malicious will be logged as Zeek `signatures.log` entries, and can be viewed in the **Signatures** dashboard in [Kibana](https://github.com/idaholab/malcolm#KibanaVisualizations) when forwarded to Malcolm. ![File quarantine](./docs/images/file_quarantine.png) @@ -221,7 +221,7 @@ Finally, you will then be presented with the list of configuration variables tha ### Forwarding -Select **Configure Forwarding** to set up forwarding logs and statistics from the sensor to an aggregator server, such as [Malcolm](https://github.com/cisagov/Malcolm) or another [Elastic Stack](https://www.elastic.co/products/)-based server. +Select **Configure Forwarding** to set up forwarding logs and statistics from the sensor to an aggregator server, such as [Malcolm](https://github.com/idaholab/malcolm) or another [Elastic Stack](https://www.elastic.co/products/)-based server. ![Configure forwarders](./docs/images/forwarder_config.png) @@ -239,7 +239,7 @@ Next you are asked whether the connection used for Zeek log forwarding should be ![Filebeat SSL certificate verification](./docs/images/filebeat_ssl.png) -If **SSL** is chosen, you must choose whether to enable [SSL certificate verification](https://www.elastic.co/guide/en/beats/filebeat/current/configuring-ssl-logstash.html). If you are using a self-signed certificate (such as the one automatically created during [Malcolm's configuration](https://github.com/cisagov/Malcolm#configure-authentication), choose **None**. +If **SSL** is chosen, you must choose whether to enable [SSL certificate verification](https://www.elastic.co/guide/en/beats/filebeat/current/configuring-ssl-logstash.html). If you are using a self-signed certificate (such as the one automatically created during [Malcolm's configuration](https://github.com/idaholab/malcolm#configure-authentication), choose **None**. ![Unencrypted vs. SSL encryption for Zeek log forwarding](./docs/images/filebeat_ssl_verify.png) @@ -255,9 +255,9 @@ Once you have specified all of the filebeat parameters, you will be presented wi ### moloch-capture: Arkime session forwarding -[moloch-capture](https://github.com/arkime/arkime/tree/master/capture) is not only used to capture PCAP files, but also the parse raw traffic into sessions and forward this session metadata to an [Elasticsearch](https://www.elastic.co/products/elasticsearch) database so that it can be viewed in [Arkime viewer](https://molo.ch/), whether standalone or as part of a [Malcolm](https://github.com/cisagov/Malcolm) instance. If you're using Hedgehog Linux with Malcolm, please read [Correlating Zeek logs and Arkime sessions](https://github.com/cisagov/Malcolm#ZeekArkimeFlowCorrelation) in the Malcolm documentation for more information. +[moloch-capture](https://github.com/arkime/arkime/tree/master/capture) is not only used to capture PCAP files, but also the parse raw traffic into sessions and forward this session metadata to an [Elasticsearch](https://www.elastic.co/products/elasticsearch) database so that it can be viewed in [Arkime viewer](https://molo.ch/), whether standalone or as part of a [Malcolm](https://github.com/idaholab/malcolm) instance. If you're using Hedgehog Linux with Malcolm, please read [Correlating Zeek logs and Arkime sessions](https://github.com/idaholab/malcolm#ZeekArkimeFlowCorrelation) in the Malcolm documentation for more information. -First, select the Elasticsearch connection transport protocol, either **HTTPS** or **HTTP**. If the metrics are being forwarded to Malcolm, select **HTTPS** to encrypt messages from the sensor to the aggregator using TLS v1.2 using ECDHE-RSA-AES128-GCM-SHA256. If **HTTPS** is chosen, you must choose whether to enable SSL certificate verification. If you are using a self-signed certificate (such as the one automatically created during [Malcolm's configuration](https://github.com/cisagov/Malcolm#configure-authentication)), choose **None**. +First, select the Elasticsearch connection transport protocol, either **HTTPS** or **HTTP**. If the metrics are being forwarded to Malcolm, select **HTTPS** to encrypt messages from the sensor to the aggregator using TLS v1.2 using ECDHE-RSA-AES128-GCM-SHA256. If **HTTPS** is chosen, you must choose whether to enable SSL certificate verification. If you are using a self-signed certificate (such as the one automatically created during [Malcolm's configuration](https://github.com/idaholab/malcolm#configure-authentication)), choose **None**. ![Elasticsearch connection protocol](./docs/images/metricbeat_elastic_protocol.png) ![Elasticsearch SSL verification](./docs/images/metricbeat_elastic_ssl.png) @@ -285,7 +285,7 @@ Metricbeat gathers system resource metrics at an interval you specify. The defau ![Metricbeat interval](./docs/images/metricbeat_interval.png) -Next, select the Elasticsearch connection transport protocol, either **HTTPS** or **HTTP**. If the metrics are being forwarded to Malcolm, select **HTTPS** to encrypt messages from the sensor to the aggregator using TLS v1.2 using ECDHE-RSA-AES128-GCM-SHA256. If **HTTPS** is chosen, you must choose whether to enable SSL certificate verification. If you are using a self-signed certificate (such as the one automatically created during [Malcolm's configuration](https://github.com/cisagov/Malcolm#configure-authentication), choose **None**. +Next, select the Elasticsearch connection transport protocol, either **HTTPS** or **HTTP**. If the metrics are being forwarded to Malcolm, select **HTTPS** to encrypt messages from the sensor to the aggregator using TLS v1.2 using ECDHE-RSA-AES128-GCM-SHA256. If **HTTPS** is chosen, you must choose whether to enable SSL certificate verification. If you are using a self-signed certificate (such as the one automatically created during [Malcolm's configuration](https://github.com/idaholab/malcolm#configure-authentication), choose **None**. ![Elasticsearch connection protocol](./docs/images/metricbeat_elastic_protocol.png) ![Elasticsearch SSL verification](./docs/images/metricbeat_elastic_ssl.png) @@ -337,7 +337,7 @@ Despite configuring capture and/or forwarder services as described in previous s * **AUTOSTART_HEATBEAT** – [sensor hardware](#heatbeat) (eg., CPU and storage device temperature) metrics forwarder * **AUTOSTART_HEATBEAT_SENSORS** – the background process monitoring [hardware sensors](#heatbeat) for temperatures, voltages, fan speeds, etc. (this is required in addition to **AUTOSTART_HEATBEAT** metrics forwarding) * **AUTOSTART_METRICBEAT** – system resource utilization [metrics forwarder](#metricbeat) -* **AUTOSTART_ARKIME** – [moloch-capture](##moloch-capture) PCAP engine for traffic capture, as well as traffic parsing and metadata insertion into Elasticsearch for viewing in [Arkime](https://molo.ch/). If you are using Hedgehog Linux along with [Malcolm](https://github.com/cisagov/Malcolm) or another Arkime installation, this is probably the packet capture engine you want to use. +* **AUTOSTART_ARKIME** – [moloch-capture](##moloch-capture) PCAP engine for traffic capture, as well as traffic parsing and metadata insertion into Elasticsearch for viewing in [Arkime](https://molo.ch/). If you are using Hedgehog Linux along with [Malcolm](https://github.com/idaholab/malcolm) or another Arkime installation, this is probably the packet capture engine you want to use. * *AUTOSTART_NETSNIFF* – [netsniff-ng](http://netsniff-ng.org/) PCAP engine for saving packet capture (PCAP) files * **AUTOSTART_PRUNE_ZEEK** – storage space monitor to ensure that Zeek logs do not consume more than 90% of the total size of the storage volume to which Zeek logs are written * **AUTOSTART_PRUNE_PCAP** – storage space monitor to ensure that PCAP files do not consume more than 90% of the total size of the storage volume to which PCAP files are written @@ -390,7 +390,7 @@ zeek:zeekctl RUNNING pid 14433, uptime 8 days, 20:22:32 Official downloads of the Hedgehog Linux installer ISO are not provided: however, it can be built easily on an internet-connected Linux host running current versions of [VirtualBox](https://www.virtualbox.org/) and [Vagrant](https://www.vagrantup.com/) (with the [`vagrant-reload`](https://github.com/aidanns/vagrant-reload) plugin). -To perform a clean build the Hedgehog Linux installer ISO, navigate to your local [Malcolm](https://github.com/cisagov/Malcolm/) working copy and run: +To perform a clean build the Hedgehog Linux installer ISO, navigate to your local [Malcolm](https://github.com/idaholab/Malcolm/) working copy and run: ``` $ ./sensor-iso/build_via_vagrant.sh -f @@ -606,9 +606,9 @@ deb https://XXXXXX:443/debian buster-backports main contrib non-free 5. Update underlying system packages with `apt-get` - `apt-get update && apt-get dist-upgrade` -6. If there were [new system deb packages added](https://github.com/cisagov/Malcolm/tree/master/sensor-iso/config/package-lists) to this release of Hedgehog Linux (you might have to [manually compare](https://github.com/cisagov/Malcolm/commits/master/sensor-iso/config/package-lists) on GitHub), install them. If you're not sure, of course, you could just install everything, like this (although you may have to tweak some version numbers or something if the base distribution of your Hedgehog branch is different than `master`; in this example I'm not jumping between Debian releases, just upgrading within a release): +6. If there were [new system deb packages added](https://github.com/idaholab/Malcolm/tree/master/sensor-iso/config/package-lists) to this release of Hedgehog Linux (you might have to [manually compare](https://github.com/idaholab/Malcolm/commits/master/sensor-iso/config/package-lists) on GitHub), install them. If you're not sure, of course, you could just install everything, like this (although you may have to tweak some version numbers or something if the base distribution of your Hedgehog branch is different than `master`; in this example I'm not jumping between Debian releases, just upgrading within a release): ``` -$ for LIST in apps desktopmanager net system; do curl -L -J -O https://raw.github.com/cisagov/Malcolm/master/sensor-iso/config/package-lists/$LIST.list.chroot; done +$ for LIST in apps desktopmanager net system; do curl -L -J -O https://raw.github.com/idaholab/Malcolm/master/sensor-iso/config/package-lists/$LIST.list.chroot; done ... $ apt-get install $(cat *.list.chroot) ``` @@ -618,7 +618,7 @@ $ apt-get install $(cat *.list.chroot) * `python3 -m pip list --outdated --format=freeze | grep -v '^\-e' | cut -d = -f 1 | xargs -r -n1 python3 -m pip install -U` - if this fails for some reason, you may need to reinstall pip first with `python3 -m pip install --force -U pip` - some *very* old builds of Hedgehog Linux had separate Python 3.5 and 3.7 installations: in this case, you'd need to do this for both `python3 -m pip` and `python3.7 -m pip` (or whatever `python3.x` you have) - * If there were [new python packages](https://raw.githubusercontent.com/cisagov/Malcolm/master/sensor-iso/config/hooks/normal/0169-pip-installs.hook.chroot) added to this release of Hedgehog Linux (you might have to [manually compare](https://github.com/cisagov/Malcolm/blame/master/sensor-iso/config/hooks/normal/0169-pip-installs.hook.chroot) on GitHub), install them. If you are using a PyPI mirror, replace `XXXXXX` here with your mirror's IP. The `colorama` package is used here as an example, your package list might vary. + * If there were [new python packages](https://raw.githubusercontent.com/idaholab/Malcolm/master/sensor-iso/config/hooks/normal/0169-pip-installs.hook.chroot) added to this release of Hedgehog Linux (you might have to [manually compare](https://github.com/idaholab/Malcolm/blame/master/sensor-iso/config/hooks/normal/0169-pip-installs.hook.chroot) on GitHub), install them. If you are using a PyPI mirror, replace `XXXXXX` here with your mirror's IP. The `colorama` package is used here as an example, your package list might vary. - `python3 -m pip install --no-compile --no-cache-dir --force-reinstall --upgrade --index-url=https://XXXXXX:443/pypi/simple --trusted-host=XXXXXX:443 colorama` 8. Okay, **now** things start to get a little bit ugly. You're going to need access to the ISO of the release of Hedgehog Linux you're upgrading to, as we're going to grab some packages off of it. On another Linux system, [build it](#ISOBuild). @@ -931,7 +931,7 @@ Once the Hedgehog has come back up, check to make sure everything is working: * `sensorwatch` should show current writes to Zeek log files and PCAP files (depending on your configuration) * `tail -f /opt/sensor/sensor_ctl/log/*` should show no egregious errors * `zeek --version`, `zeek -N local` and `moloch-capture --version` ought to run and print out version information as expected -* if you are forwarding to a [Malcolm](https://github.com/cisagov/Malcolm) aggregator, you should start seeing data momentarily +* if you are forwarding to a [Malcolm](https://github.com/idaholab/malcolm) aggregator, you should start seeing data momentarily # Appendix F - Notes @@ -939,9 +939,9 @@ If you are interesting in developing your own network traffic capture appliance # Copyright -Hedgehog Linux - part of [Malcolm](https://github.com/cisagov/Malcolm) - is Copyright 2021 Battelle Energy Alliance, LLC, and is developed and released through the cooperation of the Cybersecurity and Infrastructure Security Agency of the U.S. Department of Homeland Security. +Hedgehog Linux - part of [Malcolm](https://github.com/idaholab/Malcolm) - is Copyright 2021 Battelle Energy Alliance, LLC, and is developed and released through the cooperation of the Cybersecurity and Infrastructure Security Agency of the U.S. Department of Homeland Security. -See [`License.txt`](https://raw.githubusercontent.com/cisagov/Malcolm/master/License.txt) for the terms of its release. +See [`License.txt`](https://raw.githubusercontent.com/idaholab/Malcolm/master/License.txt) for the terms of its release. ### Contact information of author(s): diff --git a/sensor-iso/docs/Notes.md b/sensor-iso/docs/Notes.md index b674bc296..a1f0b8d2e 100644 --- a/sensor-iso/docs/Notes.md +++ b/sensor-iso/docs/Notes.md @@ -1833,7 +1833,7 @@ While the examples in this document use the Elastic Stack (particularly [Logstas ## Forwarding Zeek logs -[Filebeat](https://www.elastic.co/products/beats/filebeat) can be used to forward Zeek logs (or any other kind of log) to a variety of destinations, including a [Logstash](https://www.elastic.co/products/logstash) instance for additional [parsing](https://github.com/cisagov/Malcolm/blob/master/logstash/pipelines/zeek/11_zeek_logs.conf) and [enrichment](https://github.com/cisagov/Malcolm/blob/master/logstash/pipelines/enrichment/01_input_log_enrichment.conf) or directly into an [Elasticsearch](https://www.elastic.co/products/elasticsearch) instance. +[Filebeat](https://www.elastic.co/products/beats/filebeat) can be used to forward Zeek logs (or any other kind of log) to a variety of destinations, including a [Logstash](https://www.elastic.co/products/logstash) instance for additional [parsing](https://github.com/idaholab/Malcolm/blob/master/logstash/pipelines/zeek/11_zeek_logs.conf) and [enrichment](https://github.com/idaholab/Malcolm/blob/master/logstash/pipelines/enrichment/01_input_log_enrichment.conf) or directly into an [Elasticsearch](https://www.elastic.co/products/elasticsearch) instance. Here is an example `filebeat.yml` [configuration file](https://www.elastic.co/guide/en/beats/filebeat/current/configuring-howto-filebeat.html) used to collect Zeek logs from a directory and forward them to a Logstash instance. Some values here are specified in the via environment variables with sane defaults if those environment variables are not specified: @@ -2224,9 +2224,9 @@ Hedgehog Linux targets the following guidelines for establishing a secure config # Copyright -Hedgehog Linux - part of [Malcolm](https://github.com/cisagov/Malcolm) - is Copyright 2021 Battelle Energy Alliance, LLC, and is developed and released through the cooperation of the Cybersecurity and Infrastructure Security Agency of the U.S. Department of Homeland Security. +Hedgehog Linux - part of [Malcolm](https://github.com/idaholab/Malcolm) - is Copyright 2021 Battelle Energy Alliance, LLC, and is developed and released through the cooperation of the Cybersecurity and Infrastructure Security Agency of the U.S. Department of Homeland Security. -See [`License.txt`](https://raw.githubusercontent.com/cisagov/Malcolm/master/License.txt) for the terms of its release. +See [`License.txt`](https://raw.githubusercontent.com/idaholab/Malcolm/master/License.txt) for the terms of its release. ### Contact information of author(s):