Skip to content

Commit f2b4593

Browse files
mmguerommguero
committed
Merge remote-tracking branch 'cisa/master' for v2.4.1 release
2 parents 144c1e1 + 5ef8381 commit f2b4593

18 files changed

Lines changed: 99 additions & 94 deletions

‎Dockerfiles/curator.Dockerfile‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -55,9 +55,10 @@ ENV CURATOR_SNAPSHOT_REPO $CURATOR_SNAPSHOT_REPO
5555
ENV CURATOR_SNAPSHOT_COMPRESSED $CURATOR_SNAPSHOT_COMPRESSED
5656
ENV CURATOR_SNAPSHOT_DISABLED $CURATOR_SNAPSHOT_DISABLED
5757

58-
ENV SUPERCRONIC_URL "https://github.com/aptible/supercronic/releases/download/v0.1.9/supercronic-linux-amd64"
58+
ENV SUPERCRONIC_VERSION "0.1.11"
59+
ENV SUPERCRONIC_URL "https://github.com/aptible/supercronic/releases/download/v$SUPERCRONIC_VERSION/supercronic-linux-amd64"
5960
ENV SUPERCRONIC "supercronic-linux-amd64"
60-
ENV SUPERCRONIC_SHA1SUM "5ddf8ea26b56d4a7ff6faecdd8966610d5cb9d85"
61+
ENV SUPERCRONIC_SHA1SUM "a2e2d47078a8dafc5949491e5ea7267cc721d67c"
6162
ENV SUPERCRONIC_CRONTAB "/etc/crontab"
6263

6364
ENV CURATOR_VERSION "5.8.1"

‎Dockerfiles/filebeat.Dockerfile‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -38,9 +38,10 @@ ARG FILEBEAT_NGINX_LOG_PATH="/data/nginx"
3838
ARG NGINX_LOG_ACCESS_AND_ERRORS=false
3939
ARG AUTO_TAG=true
4040

41-
ENV SUPERCRONIC_URL "https://github.com/aptible/supercronic/releases/download/v0.1.9/supercronic-linux-amd64"
41+
ENV SUPERCRONIC_VERSION "0.1.11"
42+
ENV SUPERCRONIC_URL "https://github.com/aptible/supercronic/releases/download/v$SUPERCRONIC_VERSION/supercronic-linux-amd64"
4243
ENV SUPERCRONIC "supercronic-linux-amd64"
43-
ENV SUPERCRONIC_SHA1SUM "5ddf8ea26b56d4a7ff6faecdd8966610d5cb9d85"
44+
ENV SUPERCRONIC_SHA1SUM "a2e2d47078a8dafc5949491e5ea7267cc721d67c"
4445
ENV SUPERCRONIC_CRONTAB "/etc/crontab"
4546

4647
USER root

‎Dockerfiles/kibana.Dockerfile‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -39,9 +39,10 @@ ENV KIBANA_OFFLINE_REGION_MAPS_PORT $KIBANA_OFFLINE_REGION_MAPS_PORT
3939
ENV PATH="/data:${PATH}"
4040
ENV ELASTICSEARCH_URL $ELASTICSEARCH_URL
4141

42-
ENV SUPERCRONIC_URL "https://github.com/aptible/supercronic/releases/download/v0.1.9/supercronic-linux-amd64"
42+
ENV SUPERCRONIC_VERSION "0.1.11"
43+
ENV SUPERCRONIC_URL "https://github.com/aptible/supercronic/releases/download/v$SUPERCRONIC_VERSION/supercronic-linux-amd64"
4344
ENV SUPERCRONIC "supercronic-linux-amd64"
44-
ENV SUPERCRONIC_SHA1SUM "5ddf8ea26b56d4a7ff6faecdd8966610d5cb9d85"
45+
ENV SUPERCRONIC_SHA1SUM "a2e2d47078a8dafc5949491e5ea7267cc721d67c"
4546
ENV SUPERCRONIC_CRONTAB "/etc/crontab"
4647

4748
USER root

‎Dockerfiles/nginx.Dockerfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -100,7 +100,7 @@ ENV NGINX_LDAP_TLS_STUNNEL_CHECK_IP $NGINX_LDAP_TLS_STUNNEL_CHECK_IP
100100
ENV NGINX_LDAP_TLS_STUNNEL_VERIFY_LEVEL $NGINX_LDAP_TLS_STUNNEL_VERIFY_LEVEL
101101

102102
# build latest nginx with nginx-auth-ldap
103-
ENV NGINX_VERSION=1.19.0
103+
ENV NGINX_VERSION=1.19.3
104104
ENV NGINX_AUTH_LDAP_BRANCH=master
105105

106106
ADD https://codeload.github.com/mmguero-dev/nginx-auth-ldap/tar.gz/$NGINX_AUTH_LDAP_BRANCH /nginx-auth-ldap.tar.gz

‎Dockerfiles/zeek.Dockerfile‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -6,17 +6,17 @@ ENV DEBIAN_FRONTEND noninteractive
66

77
# build zeek and plugins (spicy, additional protocol parsers, etc.)
88

9-
ENV BISON_VERSION "3.6.2"
9+
ENV BISON_VERSION "3.7.2"
1010
ENV CCACHE_DIR "/var/spool/ccache"
1111
ENV CCACHE_COMPRESS 1
1212
ENV CMAKE_DIR "/opt/cmake"
13-
ENV CMAKE_VERSION "3.17.2"
13+
ENV CMAKE_VERSION "3.18.4"
1414
ENV SPICY_DIR "/opt/spicy"
1515
ENV SRC_BASE_DIR "/usr/local/src"
1616
ENV ZEEK_DIR "/opt/zeek"
1717
ENV ZEEK_PATCH_DIR "${SRC_BASE_DIR}/zeek-patches"
1818
ENV ZEEK_SRC_DIR "${SRC_BASE_DIR}/zeek-${ZEEK_VERSION}"
19-
ENV ZEEK_VERSION "3.0.10"
19+
ENV ZEEK_VERSION "3.0.11"
2020

2121
# using clang now instead of gcc because Spicy depends on it
2222
ENV LLVM_VERSION "10"
@@ -171,8 +171,8 @@ ENV PATH "${ZEEK_DIR}/bin:${SPICY_DIR}/bin:${PATH}"
171171

172172
# sanity check to make sure the plugins installed and copied over correctly
173173
# these ENVs should match the number of third party plugins installed by zeek_install_plugins.sh
174-
ENV ZEEK_THIRD_PARTY_PLUGINS_COUNT 22
175-
ENV ZEEK_THIRD_PARTY_GREP_STRING "(spicy/main|Bro_LDAP/scripts/main|Corelight/PE_XOR/main|Salesforce/GQUIC/main|Zeek_AF_Packet/scripts/init|bzar/main|cve-2020-0601/cve-2020-0601|cve-2020-13777/cve-2020-13777|hassh/hassh|ja3/ja3|zeek-community-id/main|zeek-EternalSafety/main|zeek-httpattacks/main|zeek-plugin-bacnet/main|zeek-plugin-enip/main|zeek-plugin-profinet/main|zeek-plugin-s7comm/main|zeek-plugin-tds/main|zeek-sniffpass/main|CVE-2020-1350|ripple20|callstranger)\.(zeek|bro)"
174+
ENV ZEEK_THIRD_PARTY_PLUGINS_COUNT 25
175+
ENV ZEEK_THIRD_PARTY_GREP_STRING "(Bro_LDAP/scripts/main|bzar/main|callstranger|Corelight/PE_XOR/main|cve-2020-0601|CVE-2020-1350|cve-2020-13777|CVE-2020-16898|hassh/hassh|ja3/ja3|ripple20|Salesforce/GQUIC/main|spicy-noise|spicy/main|zeek-community-id/main|zeek-EternalSafety/main|zeek-httpattacks/main|zeek-plugin-bacnet/main|zeek-plugin-enip/main|zeek-plugin-profinet/main|zeek-plugin-s7comm/main|zeek-plugin-tds/main|zeek-sniffpass/main|Zeek_AF_Packet/scripts/init|zerologon/main)\.(zeek|bro)"
176176

177177
RUN mkdir -p /tmp/logs && \
178178
cd /tmp/logs && \

‎README.md‎

Lines changed: 34 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -157,22 +157,22 @@ You can then observe that the images have been retrieved by running `docker imag
157157
```
158158
$ docker images
159159
REPOSITORY TAG IMAGE ID CREATED SIZE
160-
malcolmnetsec/curator 2.4.0 xxxxxxxxxxxx 40 hours ago 256MB
161-
malcolmnetsec/elastalert 2.4.0 xxxxxxxxxxxx 40 hours ago 410MB
162-
malcolmnetsec/elasticsearch-oss 2.4.0 xxxxxxxxxxxx 40 hours ago 690MB
163-
malcolmnetsec/file-monitor 2.4.0 xxxxxxxxxxxx 39 hours ago 470MB
164-
malcolmnetsec/file-upload 2.4.0 xxxxxxxxxxxx 39 hours ago 199MB
165-
malcolmnetsec/filebeat-oss 2.4.0 xxxxxxxxxxxx 39 hours ago 555MB
166-
malcolmnetsec/freq 2.4.0 xxxxxxxxxxxx 39 hours ago 390MB
167-
malcolmnetsec/htadmin 2.4.0 xxxxxxxxxxxx 39 hours ago 180MB
168-
malcolmnetsec/kibana-oss 2.4.0 xxxxxxxxxxxx 40 hours ago 1.16GB
169-
malcolmnetsec/logstash-oss 2.4.0 xxxxxxxxxxxx 39 hours ago 1.41GB
170-
malcolmnetsec/moloch 2.4.0 xxxxxxxxxxxx 17 hours ago 683MB
171-
malcolmnetsec/name-map-ui 2.4.0 xxxxxxxxxxxx 39 hours ago 137MB
172-
malcolmnetsec/nginx-proxy 2.4.0 xxxxxxxxxxxx 39 hours ago 120MB
173-
malcolmnetsec/pcap-capture 2.4.0 xxxxxxxxxxxx 39 hours ago 111MB
174-
malcolmnetsec/pcap-monitor 2.4.0 xxxxxxxxxxxx 39 hours ago 157MB
175-
malcolmnetsec/zeek 2.4.0 xxxxxxxxxxxx 39 hours ago 887MB
160+
malcolmnetsec/curator 2.4.1 xxxxxxxxxxxx 40 hours ago 256MB
161+
malcolmnetsec/elastalert 2.4.1 xxxxxxxxxxxx 40 hours ago 410MB
162+
malcolmnetsec/elasticsearch-oss 2.4.1 xxxxxxxxxxxx 40 hours ago 690MB
163+
malcolmnetsec/file-monitor 2.4.1 xxxxxxxxxxxx 39 hours ago 470MB
164+
malcolmnetsec/file-upload 2.4.1 xxxxxxxxxxxx 39 hours ago 199MB
165+
malcolmnetsec/filebeat-oss 2.4.1 xxxxxxxxxxxx 39 hours ago 555MB
166+
malcolmnetsec/freq 2.4.1 xxxxxxxxxxxx 39 hours ago 390MB
167+
malcolmnetsec/htadmin 2.4.1 xxxxxxxxxxxx 39 hours ago 180MB
168+
malcolmnetsec/kibana-oss 2.4.1 xxxxxxxxxxxx 40 hours ago 1.16GB
169+
malcolmnetsec/logstash-oss 2.4.1 xxxxxxxxxxxx 39 hours ago 1.41GB
170+
malcolmnetsec/moloch 2.4.1 xxxxxxxxxxxx 17 hours ago 683MB
171+
malcolmnetsec/name-map-ui 2.4.1 xxxxxxxxxxxx 39 hours ago 137MB
172+
malcolmnetsec/nginx-proxy 2.4.1 xxxxxxxxxxxx 39 hours ago 120MB
173+
malcolmnetsec/pcap-capture 2.4.1 xxxxxxxxxxxx 39 hours ago 111MB
174+
malcolmnetsec/pcap-monitor 2.4.1 xxxxxxxxxxxx 39 hours ago 157MB
175+
malcolmnetsec/zeek 2.4.1 xxxxxxxxxxxx 39 hours ago 887MB
176176
```
177177

178178
#### Import from pre-packaged tarballs
@@ -235,6 +235,7 @@ Malcolm leverages the following excellent open source tools, among others.
235235
* Andrew Klaus's [Sniffpass](https://github.com/cybera/zeek-sniffpass) plugin for detecting cleartext passwords in HTTP POST requests
236236
* Andrew Klaus's [zeek-httpattacks](https://github.com/precurse/zeek-httpattacks) plugin for detecting noncompliant HTTP requests
237237
* Corelight's [bro-xor-exe](https://github.com/corelight/bro-xor-exe-plugin) plugin
238+
* Corelight's ["bad neighbor" (CVE-2020-16898)](https://github.com/corelight/CVE-2020-16898) plugin
238239
* Corelight's [callstranger-detector](https://github.com/corelight/callstranger-detector) plugin
239240
* Corelight's [community ID](https://github.com/corelight/zeek-community-id) flow hashing plugin
240241
* Corelight's [ripple20](https://github.com/corelight/ripple20) plugin
@@ -1430,7 +1431,7 @@ Building the ISO may take 30 minutes or more depending on your system. As the bu
14301431

14311432
```
14321433
…
1433-
Finished, created "/malcolm-build/malcolm-iso/malcolm-2.4.0.iso"
1434+
Finished, created "/malcolm-build/malcolm-iso/malcolm-2.4.1.iso"
14341435
…
14351436
```
14361437

@@ -1829,22 +1830,22 @@ Pulling zeek ... done
18291830
18301831
user@host:~/Malcolm$ docker images
18311832
REPOSITORY TAG IMAGE ID CREATED SIZE
1832-
malcolmnetsec/curator 2.4.0 xxxxxxxxxxxx 40 hours ago 256MB
1833-
malcolmnetsec/elastalert 2.4.0 xxxxxxxxxxxx 40 hours ago 410MB
1834-
malcolmnetsec/elasticsearch-oss 2.4.0 xxxxxxxxxxxx 40 hours ago 690MB
1835-
malcolmnetsec/file-monitor 2.4.0 xxxxxxxxxxxx 39 hours ago 470MB
1836-
malcolmnetsec/file-upload 2.4.0 xxxxxxxxxxxx 39 hours ago 199MB
1837-
malcolmnetsec/filebeat-oss 2.4.0 xxxxxxxxxxxx 39 hours ago 555MB
1838-
malcolmnetsec/freq 2.4.0 xxxxxxxxxxxx 39 hours ago 390MB
1839-
malcolmnetsec/htadmin 2.4.0 xxxxxxxxxxxx 39 hours ago 180MB
1840-
malcolmnetsec/kibana-oss 2.4.0 xxxxxxxxxxxx 40 hours ago 1.16GB
1841-
malcolmnetsec/logstash-oss 2.4.0 xxxxxxxxxxxx 39 hours ago 1.41GB
1842-
malcolmnetsec/moloch 2.4.0 xxxxxxxxxxxx 17 hours ago 683MB
1843-
malcolmnetsec/name-map-ui 2.4.0 xxxxxxxxxxxx 39 hours ago 137MB
1844-
malcolmnetsec/nginx-proxy 2.4.0 xxxxxxxxxxxx 39 hours ago 120MB
1845-
malcolmnetsec/pcap-capture 2.4.0 xxxxxxxxxxxx 39 hours ago 111MB
1846-
malcolmnetsec/pcap-monitor 2.4.0 xxxxxxxxxxxx 39 hours ago 157MB
1847-
malcolmnetsec/zeek 2.4.0 xxxxxxxxxxxx 39 hours ago 887MB
1833+
malcolmnetsec/curator 2.4.1 xxxxxxxxxxxx 40 hours ago 256MB
1834+
malcolmnetsec/elastalert 2.4.1 xxxxxxxxxxxx 40 hours ago 410MB
1835+
malcolmnetsec/elasticsearch-oss 2.4.1 xxxxxxxxxxxx 40 hours ago 690MB
1836+
malcolmnetsec/file-monitor 2.4.1 xxxxxxxxxxxx 39 hours ago 470MB
1837+
malcolmnetsec/file-upload 2.4.1 xxxxxxxxxxxx 39 hours ago 199MB
1838+
malcolmnetsec/filebeat-oss 2.4.1 xxxxxxxxxxxx 39 hours ago 555MB
1839+
malcolmnetsec/freq 2.4.1 xxxxxxxxxxxx 39 hours ago 390MB
1840+
malcolmnetsec/htadmin 2.4.1 xxxxxxxxxxxx 39 hours ago 180MB
1841+
malcolmnetsec/kibana-oss 2.4.1 xxxxxxxxxxxx 40 hours ago 1.16GB
1842+
malcolmnetsec/logstash-oss 2.4.1 xxxxxxxxxxxx 39 hours ago 1.41GB
1843+
malcolmnetsec/moloch 2.4.1 xxxxxxxxxxxx 17 hours ago 683MB
1844+
malcolmnetsec/name-map-ui 2.4.1 xxxxxxxxxxxx 39 hours ago 137MB
1845+
malcolmnetsec/nginx-proxy 2.4.1 xxxxxxxxxxxx 39 hours ago 120MB
1846+
malcolmnetsec/pcap-capture 2.4.1 xxxxxxxxxxxx 39 hours ago 111MB
1847+
malcolmnetsec/pcap-monitor 2.4.1 xxxxxxxxxxxx 39 hours ago 157MB
1848+
malcolmnetsec/zeek 2.4.1 xxxxxxxxxxxx 39 hours ago 887MB
18481849
```
18491850

18501851
Finally, we can start Malcolm. When Malcolm starts it will stream informational and debug messages to the console. If you wish, you can safely close the console or use `Ctrl+C` to stop these messages; Malcolm will continue running in the background.

‎docker-compose-standalone.yml‎

Lines changed: 16 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -126,7 +126,7 @@ x-pcap-capture-variables: &pcap-capture-variables
126126

127127
services:
128128
elasticsearch:
129-
image: malcolmnetsec/elasticsearch-oss:2.4.0
129+
image: malcolmnetsec/elasticsearch-oss:2.4.1
130130
restart: "no"
131131
stdin_open: false
132132
tty: true
@@ -161,7 +161,7 @@ services:
161161
retries: 3
162162
start_period: 180s
163163
kibana:
164-
image: malcolmnetsec/kibana-oss:2.4.0
164+
image: malcolmnetsec/kibana-oss:2.4.1
165165
restart: "no"
166166
stdin_open: false
167167
tty: true
@@ -187,7 +187,7 @@ services:
187187
retries: 3
188188
start_period: 210s
189189
elastalert:
190-
image: malcolmnetsec/elastalert:2.4.0
190+
image: malcolmnetsec/elastalert:2.4.1
191191
restart: "no"
192192
stdin_open: false
193193
tty: true
@@ -215,7 +215,7 @@ services:
215215
retries: 3
216216
start_period: 210s
217217
curator:
218-
image: malcolmnetsec/curator:2.4.0
218+
image: malcolmnetsec/curator:2.4.1
219219
restart: "no"
220220
stdin_open: false
221221
tty: true
@@ -234,7 +234,7 @@ services:
234234
retries: 3
235235
start_period: 30s
236236
logstash:
237-
image: malcolmnetsec/logstash-oss:2.4.0
237+
image: malcolmnetsec/logstash-oss:2.4.1
238238
restart: "no"
239239
stdin_open: false
240240
tty: true
@@ -267,7 +267,7 @@ services:
267267
retries: 3
268268
start_period: 600s
269269
filebeat:
270-
image: malcolmnetsec/filebeat-oss:2.4.0
270+
image: malcolmnetsec/filebeat-oss:2.4.1
271271
restart: "no"
272272
stdin_open: false
273273
tty: true
@@ -304,7 +304,7 @@ services:
304304
retries: 3
305305
start_period: 60s
306306
moloch:
307-
image: malcolmnetsec/moloch:2.4.0
307+
image: malcolmnetsec/moloch:2.4.1
308308
restart: "no"
309309
stdin_open: false
310310
tty: true
@@ -343,7 +343,7 @@ services:
343343
retries: 3
344344
start_period: 210s
345345
zeek:
346-
image: malcolmnetsec/zeek:2.4.0
346+
image: malcolmnetsec/zeek:2.4.1
347347
restart: "no"
348348
stdin_open: false
349349
tty: true
@@ -369,7 +369,7 @@ services:
369369
retries: 3
370370
start_period: 60s
371371
file-monitor:
372-
image: malcolmnetsec/file-monitor:2.4.0
372+
image: malcolmnetsec/file-monitor:2.4.1
373373
restart: "no"
374374
stdin_open: false
375375
tty: true
@@ -390,7 +390,7 @@ services:
390390
retries: 3
391391
start_period: 60s
392392
pcap-capture:
393-
image: malcolmnetsec/pcap-capture:2.4.0
393+
image: malcolmnetsec/pcap-capture:2.4.1
394394
restart: "no"
395395
stdin_open: false
396396
tty: true
@@ -416,7 +416,7 @@ services:
416416
retries: 3
417417
start_period: 60s
418418
pcap-monitor:
419-
image: malcolmnetsec/pcap-monitor:2.4.0
419+
image: malcolmnetsec/pcap-monitor:2.4.1
420420
restart: "no"
421421
stdin_open: false
422422
tty: true
@@ -439,7 +439,7 @@ services:
439439
retries: 3
440440
start_period: 90s
441441
upload:
442-
image: malcolmnetsec/file-upload:2.4.0
442+
image: malcolmnetsec/file-upload:2.4.1
443443
restart: "no"
444444
stdin_open: false
445445
tty: true
@@ -465,7 +465,7 @@ services:
465465
retries: 3
466466
start_period: 60s
467467
htadmin:
468-
image: malcolmnetsec/htadmin:2.4.0
468+
image: malcolmnetsec/htadmin:2.4.1
469469
restart: "no"
470470
stdin_open: false
471471
tty: true
@@ -487,7 +487,7 @@ services:
487487
retries: 3
488488
start_period: 60s
489489
freq:
490-
image: malcolmnetsec/freq:2.4.0
490+
image: malcolmnetsec/freq:2.4.1
491491
restart: "no"
492492
stdin_open: false
493493
tty: true
@@ -505,7 +505,7 @@ services:
505505
retries: 3
506506
start_period: 60s
507507
name-map-ui:
508-
image: malcolmnetsec/name-map-ui:2.4.0
508+
image: malcolmnetsec/name-map-ui:2.4.1
509509
restart: "no"
510510
stdin_open: false
511511
tty: true
@@ -526,7 +526,7 @@ services:
526526
retries: 3
527527
start_period: 60s
528528
nginx-proxy:
529-
image: malcolmnetsec/nginx-proxy:2.4.0
529+
image: malcolmnetsec/nginx-proxy:2.4.1
530530
restart: "no"
531531
stdin_open: false
532532
tty: true

0 commit comments

Comments
 (0)