provide browser access to Zeek-extracted files directory (quarantined, preserved) #34
Assignees
Labels
carving
Relating to carving (extraction) of files from traffic and the scanning of those files
enhancement
New feature or request
nginx
Relating to Malcolm's use of nginx
Comments
mmguero
added
carving
mmguero
added a commit
to mmguero-dev/Malcolm
that referenced
this issue
Jan 25, 2021
mmguero
added a commit
to cisagov/Malcolm
that referenced
this issue
Feb 5, 2021
Malcolm v2.6.1 contains the following changes: v2.6.0...v2.6.1 * Added [TFTP](https://en.wikipedia.org/wiki/Trivial_File_Transfer_Protocol) [Zeek parser](https://github.com/zeek/spicy-tftp) and corresponding Logstash parsing, Arkime WISE support and Kibana dashboards * Provide browser-based access to zeek/extracted-files directory (idaholab#34) * Fix LDAP analyzer not parsing all events (idaholab#35) * Provide more fine-tuned controls for Zeek's node.cfg in Hedgehog sensor (idaholab#36, /pull/158) * set zeek.uid to conn_uids for files.log entries (idaholab#33) * Modify Zeek build chain to use default GCC compilers instead of LLVM/clang,which reduces build dependencies * Use Firefox instead of Chromium for browser in ISO-installed versions of Malcolm and in Hedgehog Linux * Updated copyright notices in text from "2020" to "2021" (which is the bulk of the changed files in this commit) * Version bumps * Yara to 4.0.4
|
Released in Malcolm v2.6.1 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Zeek-extracted files can be preserved/"quarantined" based on scanning results, but there's not a real convenient way to get at those files.
I've added optional environment variables for a new feature:
EXTRACTED_FILE_HTTP_SERVER_ENABLE– if set totrue, the directory containing Zeek-extracted files will be served over HTTP at./extracted-files/(e.g., https://localhost/extracted-files/ if you are connecting locally)EXTRACTED_FILE_HTTP_SERVER_ENCRYPT– if set totrue, those Zeek-extracted files will be AES-256-CBC-encrypted in anopenssl enc-compatible format (e.g.,openssl enc -aes-256-cbc -d -in example.exe.encrypted -out example.exe)EXTRACTED_FILE_HTTP_SERVER_KEY– specifies the AES-256-CBC decryption password for encrypted Zeek-extracted files; used in conjunction withEXTRACTED_FILE_HTTP_SERVER_ENCRYPTThe encryption is more for safety's sake than anything (as the files may contain live malware). It's a very no-frills HTTP server. It's disabled by default.
The text was updated successfully, but these errors were encountered: