Seth Grover6d ago

Malcolm v26.05.0 delivers a mix of feature improvements, performance improvements, bug fixes, dependency updates, and deployment refinements across Malcolm and Hedgehog for both Docker- and Kubernetes-based workflows.

If you are upgrading from an existing Malcolm installation, run ./scripts/status for Malcolm to migrate some settings prior to running ./scripts/configure, ./scripts/start, or other Malcolm control scripts.

https://github.com/idaholab/Malcolm/compare/v26.04.1...v26.05.0

  • ✨ Features and enhancements
    • #726 — use hierarchical structure for NetBox device roles
      • Expanded/reworked NetBox preloaded device roles into a hierarchical taxonomy (thanks Crubumble)
    • #867 — examine large chown'ed directories in container images and see if they can be reduced
    • #954 — allow users to provide custom netbox scripts to be automatically registered on startup (thanks PrudhviChanda)
      • Added NetBox custom script support in the container/runtime and docs, including bind-mounting ./netbox/custom-scripts and automatic script registration at startup
      • Renamed NetBox startup/control scripts from netbox/scripts to netbox/control-scripts
    • Added file.strings extraction/indexing/search support across Strelka → Logstash → OpenSearch templates (wildcard field mapping type) → Arkime/WISE
    • Added configurable Zeek file analyzer timeout via ZEEK_FILE_ANALYZER_TIMEOUT_SEC
    • netdev users in ISO-installed environment can run nmcli and nmtui to configure network interfaces.
    • the malcolm_appliance_packager.sh script that creates a tarball of Malcolm images can now package for both Malcolm and Hedgehog profiles.
  • ✅ Component version updates
  • 🐛 Bug fixes
    • #757 — multiple OpenSearch nodes (using Malcolm-Helm) fail to communicate with each other due to self-signed certs (thanks scott-jeffery)
      • OpenSearch post-start setup now supports configurable default replica counts instead of always forcing single-node replicas to 0
      • OpenSearch self-signed internal cert generation can now be skipped when external/preexisting certs are being used
    • #827 — Fix raspberry pi build which is broken since v25.12.0 Hedgehog/Malcolm platform unification
      • Updated Hedgehog Raspberry Pi docs and first-boot behavior/documentation
      • Hedgehog Raspberry Pi image now forces password change for sensor on first login and disables direct root password login by default
      • Refactored Raspberry Pi GitHub Actions build into reusable workflow .github/workflows/raspi-build-push.yml
    • #878 — Arkime capture Fails to Start on Hedgehog When WISE Web Config Is Enabled
      • Arkime RBAC role-mapping injection is now only applied when role-based access control is enabled
      • Arkime WISE configuration initialization now handles missing/empty persistent config files more robustly
      • Arkime live capture now normalizes WISE URLs better, follows redirects when probing, and avoids some bad URL construction edge cases
    • #957 — configuration script can disable ICS parsers unintentionally
    • #959 — Arkime sessions view attempts to load PCAP for Zeek and Suricata logs (which don't have PCAP) (see also arkime/arkime#3934)
    • Fixed one-off cleanup of interrupted Zeek intel files during stop --wipe
  • 🧹 Code and project maintenance
    • Documentation improvements
    • #913 — replace ingress-nginx which is EOL
      • Switched Kubernetes ingress example/docs from ingress-nginx to Traefik and replaced the old Vagrant example with a new RKE2/Traefik-based environment
      • Fixed malformed indentation in kubernetes/01-volumes-nfs.yml.example for the filescan volume section
      • Removed deprecated Kubernetes example files for ingress-nginx and the old separate NFS-server Vagrant setup
      • opensearch is no longer part of the hedgehog Docker Compose profile, and some depends_on relationships were adjusted accordingly
    • #942 - Fixed mutable default argument usage in Zeek threat feed helper functions (thanks @stef41)
    • #917 — develop IronBank (US DoD) images for Malcolm
  • 📄 Configuration changes for Malcolm (in environment variables in ./config/). The Malcolm control script (e.g., ./scripts/status, ./scripts/start) automatically handles creation and migration of variables according to ./config/env-var-actions.yml.
    • Added ZEEK_FILE_ANALYZER_TIMEOUT_SEC (default 5) to zeek.env. This is the default amount of time a file can be inactive before the file analysis gives up and discards any internal state related to the file.
    • ZEEK_CLUSTER_BACKEND can be specified in zeek.env to specify the Zeek cluster backend (ZeroMQ vs Broker).
  • ❌ Errata
    • Under NetBox → Plugins → NetBox HealthCheck Plugin → HealthCheck the error "unavailable: Unable to connect to Redis: Connection Error" is displayed. This is a side effect of #882 and does not actually indicate a problem with NetBox or its connection to Valkey. This will be fixed in the next release.

Malcolm is a powerful, easily deployable network 🖧 traffic analysis tool suite for network security monitoring 🕵🏻‍♀️.

Malcolm operates as a cluster of containers 📦, isolated sandboxes which each serve a dedicated function of the system. This makes Malcolm deployable with frameworks like Docker 🐋, Podman 🦭, and Kubernetes ⎈. Check out the Quick Start guide for examples on how to get up and running.

Alternatively, dedicated official ISO installer images 💿 for Malcolm and Hedgehog Linux 🦔 can be downloaded from Malcolm's releases page on GitHub. Due to limits on individual files in GitHub releases, these ISO files have been split 🪓 into 2GB chunks and can be reassembled with scripts provided for both Bash 🐧 (release_cleaver.sh) and PowerShell 🪟 (release_cleaver.ps1). See Downloading Malcolm - Installer ISOs for instructions.

As always, join us on the Malcolm discussions board 💬 to engage with the community, or pop some corn 🍿 and watch a video 📼.

#Malcolm #HedgehogLinux #Zeek #Arkime #Strelka #NetBox #OpenSearch #Elasticsearch #Suricata #PCAP #NetworkTrafficAnalysis #networksecuritymonitoring #OT #ICS #icssecurity #CyberSecurity #Cyber #Infosec #INL

5c0peApr 25
A curve with a view.
#travel #braga #portugal #building #architecture #inl
SciPost PhysicsApr 16

New #openaccess publication #SciPost #Physics Core

Remote spin control in Haldane spin chains

Yelko del Castillo, Alejandro Ferrón, Joaquín Fernández-Rossier
SciPost Phys. Core 9, 024 (2026)
https://scipost.org/SciPostPhysCore.9.2.024

#INL #Minhoniversity #CONICET #UNNE
#AgenciaEstatalInvestigación

Seth GroverApr 15

Malcolm v26.04.1 contains improvements, bug fixes, security updates, and component bumps.

If you are upgrading from an existing Malcolm installation, run ./scripts/status for Malcolm to migrate some settings prior to running ./scripts/configure, ./scripts/start, or other Malcolm control scripts.

v26.02.0...v26.04.1

Note that v26.04.1 is the same as v26.04.0 released last week, apart from the fix for bug #943. If you're already running v26.04.0 and don't use the encrypted install option in the installer ISO, you probably don't need to worry about updating to v26.04.1. The full release notes from v26.04.0 are also included here.

  • ✨ Features and enhancements
    • implemented easier way to enable/disable Strelka scanners #935
    • Handle nested file scanning (e.g., from ZIP files) with Strelka #922
    • index selected Strelka result fields #919
  • ✅ Component version updates
  • 🐛 Bug fixes
    • Hedgehog Linux Breaking on Reboot after Encrypted Quick Install with Multiple Drives #943
    • Fix YAML syntax error in kubernetes/15-redis.yml due to missing end quote #926
    • Using remote elasticsearch data store uses deprecated ssl_certificate_verification setting [https://github.com/cisagov/Malcolm/issues/915]
    • fix Malcolm API loopback webhook to handle RBAC and non-JSON formatted events #916
    • fix issues in zeekdeploy.sh to handle long crypto handshakes and Zeek's state DB getting out of sync
  • 🧹 Code and project maintenance
    • swap redis out for valkey #882
    • pin all third-party GitHub CI actions at known good SHA sums to mitigate things like the Trivy supply chain attack #933
    • some minor tweaks to various Dockerfiles and ISO build scripts to address vulnerability scanner findings
    • some documentation updates
  • 📄 Configuration changes for Malcolm (in environment variables in ./config/). The Malcolm control script (e.g., ./scripts/status, ./scripts/start) automatically handles creation and migration of variables according to ./config/env-var-actions.yml.
    • Added ARKIME_PCAP_LIBPCAP to arkime.env should uses wish to revert to older libpcap mode for PCAP file processing rather than faster scheme processing (default false)
    • FILEBEAT_SCANNER_FINGERPRINT_LENGTH's default in filescan.env has been changed from 1024 to 512
    • redis.env has been renamed to valkey.env and its variables also have been renamed accordingly
    • STRELKA_SCANNERS has been added to pipeline.env for #935
    • ZEEK_DISABLE_SPICY_ZIP has been added to zeek.env for #922 (default true)

Malcolm is a powerful, easily deployable network 🖧 traffic analysis tool suite for network security monitoring 🕵🏻‍♀️.

Malcolm operates as a cluster of containers 📦, isolated sandboxes which each serve a dedicated function of the system. This makes Malcolm deployable with frameworks like Docker 🐋, Podman 🦭, and Kubernetes ⎈. Check out the Quick Start guide for examples on how to get up and running.

Alternatively, dedicated official ISO installer images 💿 for Malcolm and Hedgehog Linux 🦔 can be downloaded from Malcolm's releases page on GitHub. Due to limits on individual files in GitHub releases, these ISO files have been split 🪓 into 2GB chunks and can be reassembled with scripts provided for both Bash 🐧 (release_cleaver.sh) and PowerShell 🪟 (release_cleaver.ps1). See Downloading Malcolm - Installer ISOs for instructions.

As always, join us on the Malcolm discussions board 💬 to engage with the community, or pop some corn 🍿 and watch a video 📼.

#Malcolm #HedgehogLinux #Zeek #Arkime #Strelka #NetBox #OpenSearch #Elasticsearch #Suricata #PCAP #NetworkTrafficAnalysis #networksecuritymonitoring #OT #ICS #icssecurity #CyberSecurity #Cyber #Infosec #INL

Mathrubhumi EnglishApr 11
The Indian National League (INL) has approached the Chennai Police seeking action against actor-politician Vijay. The party alleges that promotional visuals for his film 'Jana Nayagan' depict the Muslim community in a negative light. https://english.mathrubhumi.com/movies-music/news/indian-national-league-files-complaint-against-actor-vijay-over-alleged-derogatory-portrayal-of-community-p8c9v5uq?utm_source=dlvr.it&utm_medium=mastodon #Vijay #TVK #Jananaayagan #INL #ChennaiNews
Show threadMichael KoerferMar 29

Shopping on the German version of Craigslist and at flea markets was successful; two old devices are being migrated to the new version.

Before anyone asks why there are #CISA Post-its all over the hardware, they’re a reminder of good times in the U.S. at #INL, which were marked by friendship, open dialogue, and learning. And that’s where the basic configuration is noted.

Unfortunately, I don’t have any left :/

#Cybersecurity #OT #IT #Network #Hardwarehacking #SCADA #ICS #Research #OpenSource #foss

Show threadMichael KoerferMar 29

@RoganDawes I felt something was missing in my IT/OT dropboxes, and these have surpassed Phantap in terms of functionality and capabilities for years now.

The difference between an OT dropbox and an IT dropbox lies in their intended use and functionality.

Please excuse me for not revealing more, but I protect my work and research. All too often, companies like hak5... have misused the work of others for their own commercial purposes, and I won’t tolerate that. There will be discussions about the boxes, and the dropboxes will be sent to people I know personally at #INL, #CISA, #Iberdrola, and others.

And since I was asked: my employer won’t be getting a single one, for good reason.

🅱🅸🅶🅾🆁🆁🅴.🅾🆁🅶Mar 11
La météo aéronautique de aéroport de Falls International à International Falls (USA) est “KINL 111554Z AUTO 32010KT 10SM CLR M05/M11 A3010 RMK AO2 SLP212 T10501106” : Ce que ça signifie sur https://www.bigorre.org/aero/meteo/kinl/fr #aeroportdefallsinternational #aeroport #internationalfalls #usa #kinl #inl #metar #aviation #meteoaero #avgeek vl
Météo aéronautique et Infos de l'aéroport de Falls International à International Falls (Etats-Unis) KINL INL

Les infos de l'aéroport de Falls International à International Falls (Etats-Unis) : plan, hotels et la météo aéro avec les TAF et METAR bruts et décodés

Bigorre.org
Benjamin Carr, Ph.D. 👨🏻‍💻🧬Feb 13
#US is moving ahead with colocated nukes and #datacenters
#Nuclear-powered datacenters in the US are moving closer as a consortium prepares to build proposed facilities for the #DepartmentofEnergy (#DoE) at the Idaho National Laboratory (#INL).
At the end of 2025, nuclear developer #DeepAtomic submitted its proposal to the DoE to build what it calls the "nation's first nuclear-powered #AI and #HPC #datacenter campus," at INL, where commercial nuclear power was pioneered.
https://www.theregister.com/2026/02/13/us_moving_ahead_with_colocated/
US is moving ahead with colocated nukes and datacenters

: Bitbarn nuke campus to be sited at Idaho National Laboratory

The Register
Amanecer QuerétaroJan 23

👮‍♂️🌎 Querétaro fortalece su seguridad con la futura Academia de Capacitación Táctica Internacional en el Complejo Rhino. Más preparación policial significa mayor protección para la ciudadanía. 🚔
#Querétaro #Seguridad #Policía #Capacitación #INL
Más información aqui 👇

https://amanecerqro.com/queretaro-impulsa-academia-de-capacitacion-tactica-internaciona/

Querétaro impulsa Academia de Capacitación Táctica Internaciona - Amanecer Querétaro

La Academia de Capacitación Táctica Internacional en Querétaro fortalecerá la formación policial y mejorará la seguridad para la ciudadanía.

Amanecer Querétaro