Code

Malcolm v24.03.1#454

Code

Merged

mmguero merged 80 commits intomainidaholab/Malcolm:mainfrom v24.03.1_merge_idaholabidaholab/Malcolm:v24.03.1_merge_idaholabCopy head branch name to clipboardMar 27, 2024

+9,542-8,365

Commits

Commits on Mar 6, 2024

• minute tweaks to virter scrit

  mmguero

  committed
  ff3b97a

• version bump for v24.03.1 development

  mmguero

  committed
  d50767f

• fix github_image_helper.sh

  mmguero

  committed
  7a8882c

• use built-in community-id for zeek instead of external plugin

  mmguero

  committed
  8c0e0f9

• documentation update

  mmguero

  committed
  a89c8a3

Commits on Mar 7, 2024

• point to a testing branch for this feature (#423) and allow to enable debugging

  mmguero

  committed
  02f00e7

• point to a testing branch for this feature (#423) and allow to enable debugging

  mmguero

  committed
  73ac02d

Commits on Mar 11, 2024

• update documentation for MALCOLM_NETWORK_INDEX_SUFFIX

  mmguero

  committed
  436069a

• added ascii art for malcolm banner

  mmguero

  committed
  e4cd3fe

Commits on Mar 12, 2024

• slides update

  mmguero

  committed
  e99854e

• Merge branch 'development' of https://github.com/mmguero-dev/Malcolm into arkime_search_indices_423

  mmguero

  committed
  567170c

• for #437; for capture using the zeek-live container, af_packet isn't being used for capture. the issue was a missing lb_custom.InterfacePrefix=af_packet:: line in zeekctl.cfg, which was being set…

  Show description for b5f2d78
  mmguero

  committed
  b5f2d78

Commits on Mar 13, 2024

• fix an issue where using a different value for MALCOLM_OTHER_INDEX_PATTERN was not being applied correctly

  mmguero

  committed
  ea67d08

• missed some replacers in a few dashboards

  mmguero

  committed
  0baf9ca

• fix packet capture dashboard for suricata statistics to take into account the search time frame

  mmguero

  committed
  4244740

• added release_carver.sh, see #440

  mmguero

  committed
  d46d6ac

• added release_carver.sh, see #440

  mmguero

  committed
  7c98508

• added release_carver.ps1, see #440

  mmguero

  committed
  2392498

• added release_carver.ps1, see #440

  mmguero

  committed
  04a2b39

Commits on Mar 14, 2024

• Added 'twice daily' option to examples in documentation for index rotation

  mmguero

  committed
  52b0eb5

• Added 'twice daily' option to examples in documentation for index rotation

  mmguero

  committed
  93eab42

• make sure index names are lowercased, which is a requirement for opensearch

  mmguero

  committed
  df00078

• added release_carver.ps1, see #440

  mmguero

  committed
  51ffa93

• added release_carver.ps1, see #440

  mmguero

  committed
  760f3d2

• added release_carver.ps1, see #440

  mmguero

  committed
  f949546

• #440, rearrange download page

  mmguero

  committed
  a30f20b

• fix misspelling

  mmguero

  committed
  f676774

• doc update

  mmguero

  committed
  f318cae

• doc update

  mmguero

  committed
  d314c80

• move a bunch of environment variables from logstash.env to netbox-common.env as it makes more sense for them to be there (beginning #436)

  mmguero

  committed
  a7d6dfe

• removing preloading catch-all prefixes (#436)

  mmguero

  committed
  ec9efd2

• work in progress for subnet discovery (#436)

  mmguero

  committed
  217cdb1

Commits on Mar 15, 2024

• Bump Zeek to v6.2.0

  mmguero

  committed
  2ab4001

• parsing updates for zeek 6.2.0

  mmguero

  committed
  df86b97

• netbox_enrich.rb work in progress for subnet discovery (#436)

  mmguero

  committed
  e2a8430

• netbox_enrich.rb major refactoring while working on #436

  mmguero

  committed
  9aed3b1

• minor fixes for zeek v6.2.0 ldap logs

  mmguero

  committed
  34d31d7

Commits on Mar 18, 2024

• work for #445, supporting suricata eve.json rotation

  mmguero

  committed
  699e75c

• try to do install_required_packages earlier in install.py

  mmguero

  committed
  fd6b605

• try to do install_required_packages earlier in install.py

  mmguero

  committed
  f3805ea

Commits on Mar 19, 2024

• uniformly increase number of results for table visualizations in Dashboards (#447)

  Show description for 12f4802
  mmguero

  committed
  12f4802

• change default for suricatal log rotation to 1h (from 5 minutes), #445

  mmguero

  committed
  c441b7f

• don't trigger all workflows for suricata scripts

  mmguero

  committed
  20fdc98

• moved common malcolm fields into another composable component rather than defining it directly in the malcolm_template

  mmguero

  committed
  936bf15

• Revert "uniformly increase number of results for table visualizations in Dashboards (#447)"

  Show description for ee277a9
  mmguero

  committed
  ee277a9

• adjust some dashbaords line endings

  mmguero

  committed
  46666e0

• #447, make sure otherBuckets is set to true for all tables

  mmguero

  committed
  b748390

• #447, set size:100 for dashboards table

  mmguero

  committed
  78c7b6d

• related to 936bf15, make sure index-refresh.py can handle templates without any fields in them

  mmguero

  committed
  9ce8c25

• related to 936bf15, make sure index-refresh.py can handle templates without any fields in them

  mmguero

  committed
  5ba67e5

Commits on Mar 20, 2024

• Fix syntax error in malcolm_common.py

  mmguero

  committed
  928d999

• minor dashboard fixes

  mmguero

  committed
  b9caae9

• point TDS plugin back upstream to amazon's github repo; rename log policy to match merge from upstream

  mmguero

  committed
  ba30292

• working on #266, Malcolm ISO should format bigger drives for index and artifact storage, NOT DONE YET

  mmguero

  committed
  dd9b376

• working on #266, Malcolm ISO should format bigger drives for index and artifact storage, NOT DONE YET

  mmguero

  committed
  366c34a

• ignore stderr in output of docker compose ps -q

  mmguero

  committed
  2bc9214

• working on #266, Malcolm ISO should format bigger drives for index and artifact storage, NOT DONE YET

  mmguero

  committed
  e207704

• working on #266, Malcolm ISO should format bigger drives for index and artifact storage, NOT DONE YET

  mmguero

  committed
  a035107

• working on #266, Malcolm ISO should format bigger drives for index and artifact storage, NOT DONE YET

  mmguero

  committed
  e7bb0d1

• working on #266, Malcolm ISO should format bigger drives for index and artifact storage, NOT DONE YET

  mmguero

  committed
  ba699c0

• working on #266, Malcolm ISO should format bigger drives for index and artifact storage, NOT DONE YET

  mmguero

  committed
  50df2b6

• working on #266, Malcolm ISO should format bigger drives for index and artifact storage, NOT DONE YET

  mmguero

  committed
  1b18a08

• working on #266, Malcolm ISO should format bigger drives for index and artifact storage, NOT DONE YET

  mmguero

  committed
  94c8235

• working on #266, Malcolm ISO should format bigger drives for index and artifact storage, NOT DONE YET

  mmguero

  committed
  3b94d3c

Commits on Mar 21, 2024

• testing #266, Malcolm ISO should format bigger drives for index and artifact storage

  mmguero

  committed
  139957b

• testing #266, Malcolm ISO should format bigger drives for index and artifact storage

  mmguero

  committed
  4ae65fe

• testing #266, Malcolm ISO should format bigger drives for index and artifact storage

  mmguero

  committed
  2b11765

• don't kick off github workflow builds for changes to os-disk-config.py

  mmguero

  committed
  441c060

• bump fluent bit to v3.0.0

  mmguero

  committed
  87f5cdf

• replace salesforce with corelight hassh plugin

  mmguero

  committed
  4a72770

Commits on Mar 25, 2024

• update opensearch-py to v2.5.0 (https://github.com/opensearch-project/opensearch-py/releases/tag/v2.5.0)

  mmguero

  committed
  319c3c6

• update arkime build for investigate allowing specifying another index pattern for Arkime to query in addition to arkime_sessions3-* (#423)

  mmguero

  committed
  4256298

• move profinet plugin to point upstream at amzn/zeek-plugin-profinet now that the PR has been pulled

  mmguero

  committed
  a24781a

• ignore warnings from compose

  mmguero

  committed
  84c68b5

• notice.log seems to have community ID on it now, so parsing that

  mmguero

  committed
  05a38d2

• update local.zeek for sensor

  mmguero

  committed
  2ae04f7

Commits on Mar 26, 2024

• update kubernetes manifests to point to correct images

  mmguero

  committed
  8428a40

• Merge branch 'development' of https://github.com/mmguero-dev/Malcolm into v24.03.1_merge_idaholab

  mmguero

  committed
  6e2f7d0

Commits on Mar 27, 2024

• fix for #266, Malcolm ISO should format bigger drives for index and artifact storage; fix directory permissions

  mmguero

  committed
  8a18311

• Merge branch 'development' of https://github.com/mmguero-dev/Malcolm into v24.03.1_merge_idaholab

  mmguero

  committed
  97874a6