activecm / rita

Real Intelligence Threat Analytics (RITA) is a framework for detecting command and control communication through network traffic analysis.
https://www.activecountermeasures.com/free-tools/rita/
GNU General Public License v3.0
189 stars 22 forks source link

Feature: Search using CIDR mask #14

Open joswr1ght opened 3 months ago

joswr1ght commented 3 months ago

RITAv5's search feature allows us to filter the display using several parameters, including src and dst IP addresses. However, we cannot filter by a network subnet to identify other hosts in nearby network ranges.

Feature request: Allow search to accept src and dst parameters using a single IP or a network number using CIDR notation.

For example, in this RITA session, 52.226.139.185 is a high severity finding. One of the questions we should investigate is if there are other hosts with similar IP addresses, possibly in the same /24. RITA does not allow us to answer that question without manually inspecting each of the listed entries.

Screenshot 2024-08-02 at 8 35 30 AM