List view

review cyclomatic complexity of Python scripts and refactor where needed

codeIssues for code cleanup/refactoring/technical debtIssues for code cleanup/refactoring/technical debt

Status: Open.

Task

#765 In cisagov/Malcolm;

· mmguero opened on Sep 4, 2025

Zeek not unloading old intel when loading new?

bugSomething isn't workingSomething isn't working

intelRelated to integration with threat intel feedsRelated to integration with threat intel feeds

performanceRelated to speed/performanceRelated to speed/performance

zeekRelating to Malcolm's use of ZeekRelating to Malcolm's use of Zeek

Status: Open.

Bug

#875 In cisagov/Malcolm;

· mmguero opened on Jan 29, 2026

examine large chown'ed directories in container images and see if they can be reduced

dockerRelating to docker and docker-compose as used by MalcolmRelating to docker and docker-compose as used by Malcolm

enhancementNew feature or requestNew feature or request

performanceRelated to speed/performanceRelated to speed/performance

Status: Open.

Feature

#867 In cisagov/Malcolm;

· mmguero opened on Jan 22, 2026

multiple OpenSearch nodes (using Malcolm-Helm) fail to communicate with each other due to self-signed certs

bugSomething isn't workingSomething isn't working

cloudRelating to deployment of Malcolm in the cloud and/or with KubernetesRelating to deployment of Malcolm in the cloud and/or with Kubernetes

opensearchRelating to Malcolm's use of OpenSearchRelating to Malcolm's use of OpenSearch

securityRelated to issues with bearing on the security of Malcolm itselfRelated to issues with bearing on the security of Malcolm itself

Status: Open.

Bug

#757 In cisagov/Malcolm;

· mmguero opened on Aug 28, 2025

code cleanup: rename zeek fields to ECS rather than just merge

arkimeRelating to Malcolm's use of ArkimeRelating to Malcolm's use of Arkime

codeIssues for code cleanup/refactoring/technical debtIssues for code cleanup/refactoring/technical debt

dashboardsRelating to Malcolm's OpenSearch Dashboards interfaceRelating to Malcolm's OpenSearch Dashboards interface

logstashRelating to Malcolm's use of LogstashRelating to Malcolm's use of Logstash

zeekRelating to Malcolm's use of ZeekRelating to Malcolm's use of Zeek

Status: Open.

#388 In cisagov/Malcolm;

· mmguero opened on Nov 4, 2024

use hierarchical structure for NetBox device roles

enhancementNew feature or requestNew feature or request

externalDepends on a bug or feature external to this projectDepends on a bug or feature external to this project

netboxRelated to Malcolm's use of NetBoxRelated to Malcolm's use of NetBox

Status: Open.

Feature

#726 In cisagov/Malcolm;

· Crubumble opened on Jul 29, 2025

Add MMS protocol support via DINA community Zeek plugins

logstashRelating to Malcolm's use of LogstashRelating to Malcolm's use of Logstash

zeekRelating to Malcolm's use of ZeekRelating to Malcolm's use of Zeek

Status: Open (in progress).

cisagov/Malcolmnumber 906

#906 In cisagov/Malcolm;

· maikbrueggemann opened on Feb 24, 2026

Fix raspberry pi build which is broken since v25.12.0 Hedgehog/Malcolm platform unification

bugSomething isn't workingSomething isn't working

buildFor issues related to compilation/buildingFor issues related to compilation/building

dockerRelating to docker and docker-compose as used by MalcolmRelating to docker and docker-compose as used by Malcolm

minihogRelated to Hedgehog Linux on Raspberry PiRelated to Hedgehog Linux on Raspberry Pi

Status: Open.

Bug

#827 In cisagov/Malcolm;

· mmguero opened on Dec 4, 2025

replace ingress-nginx which is EOL

cloudRelating to deployment of Malcolm in the cloud and/or with KubernetesRelating to deployment of Malcolm in the cloud and/or with Kubernetes

enhancementNew feature or requestNew feature or request

Status: Open.

Task

#913 In cisagov/Malcolm;

· mmguero opened on Mar 4, 2026

Arkime capture Fails to Start on Hedgehog When WISE Web Config Is Enabled

arkimeRelating to Malcolm's use of ArkimeRelating to Malcolm's use of Arkime

bugSomething isn't workingSomething isn't working

sensorFor issues dealing with the Hedgehog OS capture sensorFor issues dealing with the Hedgehog OS capture sensor

Status: Open.

Bug

#878 In cisagov/Malcolm;

· mmguero opened on Jan 30, 2026

filescan logs are not tagged with same tags as "source" logs for uploaded PCAP

bugSomething isn't workingSomething isn't working

logstashRelating to Malcolm's use of LogstashRelating to Malcolm's use of Logstash

pipelineRelating to carving (extraction) of files from traffic and the scanning of those filesRelating to carving (extraction) of files from traffic and the scanning of those files

Status: Open.

Bug

#893 In cisagov/Malcolm;

· mmguero opened on Feb 11, 2026

Feat: Add OpenEoX Hardware Lifecycle Scanner

netboxRelated to Malcolm's use of NetBoxRelated to Malcolm's use of NetBox

Status: Open (in progress).

cisagov/Malcolmnumber 907

#907 In cisagov/Malcolm;

· PrudhviChanda opened on Feb 24, 2026

feat: Add AWS cloud infrastructure logs integration

cloudRelating to deployment of Malcolm in the cloud and/or with KubernetesRelating to deployment of Malcolm in the cloud and/or with Kubernetes

logstashRelating to Malcolm's use of LogstashRelating to Malcolm's use of Logstash

Status: Open (in progress).

cisagov/Malcolmnumber 858

#858 In cisagov/Malcolm;

· bhaskarvilles opened on Jan 18, 2026

develop IronBank (US DoD) images for Malcolm

buildFor issues related to compilation/buildingFor issues related to compilation/building

cloudRelating to deployment of Malcolm in the cloud and/or with KubernetesRelating to deployment of Malcolm in the cloud and/or with Kubernetes

dockerRelating to docker and docker-compose as used by MalcolmRelating to docker and docker-compose as used by Malcolm

enhancementNew feature or requestNew feature or request

securityRelated to issues with bearing on the security of Malcolm itselfRelated to issues with bearing on the security of Malcolm itself

Status: Open.

Feature

#917 In cisagov/Malcolm;

· mmguero opened on Mar 11, 2026