Malcolm v25.05.0 adds support for the Emerson ROC Plus protocol (including a Zeek analyzer and corresponding dashboard), component updates, and bug fixes.

v25.04.1...v25.05.0

• ✨ Features and enhancements
  • Added support for ROC Plus (incorporate new ROC Plus parser into Malcolm cisagov/Malcolm#661)
  • Make Zeek metrics port configurable (thanks to @divinehawk) (cherry-picked from Make zeek metrics port configurable cisagov/Malcolm#668)
  • Improve ability to upload PCAP files via cURL
• ✅ Component version updates
  • yq v4.45.4
  • Zeek v7.2.0
• 🐛 Bug fixes
  • race condition in suricata offline container between pcap processing and suricata socket (race condition in suricata offline container between pcap processing and suricata socket cisagov/Malcolm#667)
  • NetBox autopopulation not working with prefixes correctly (NetBox autopopulation not working with prefixes correctly cisagov/Malcolm#670) (regression)
  • ensure Arkime's queryExtraIndices config.ini setting is only set when Zeek/Suricata logs are using a different index pattern
  • set number_of_replicas cluster setting to 0 for embedded single-node OpenSearch instance to avoid yellow state
• 📄 Configuration changes (in environment variables in ./config/) for Malcolm and in control_vars.conf for Hedgehog Linux
  • added ZEEK_METRICS_PORT (default blank, meaning use the default port) in zeek.env and control_vars.conf for Make zeek metrics port configurable cisagov/Malcolm#668
  • added ZEEK_DISABLE_ICS_ROC_PLUS (default blank, meaning not disabled) in zeek.env and control_vars.conf for incorporate new ROC Plus parser into Malcolm cisagov/Malcolm#661
• 🧹 Code and project maintenance
  • minor slides and documentation updates
  • Replace AWS Fargate documentation with AWS EKS Auto documentation