cisagov / XFD

CyHy Dashboard
Creative Commons Zero v1.0 Universal
8 stars 6 forks source link

Only display domains that are directly attributable to a cidr #647

Closed DJensen94 closed 1 month ago

DJensen94 commented 1 month ago

๐Ÿ—ฃ Description

We only want to display data for domains whose IP is directly attributable to a user provided CIDR. We only want this functionality for non-FCEB organizations.

  1. Add new column to Domains table called "fromCyhyCidr", which will be a boolean for if the domains ip links to a cidr provided to VS
  2. Create a helper function that accepts an organization_id and an ip and returns true if the ip is found inside a cidr block owned by the given org, it will check this against the cidr table in the mini datalake that is updated daily from the VS data in the AE
  3. We will make a crossfeed scan that loops through all domains and runs the ips through the newly created helper function and correctly checks the "fromCyhyCidr" column
  4. Update the api calls that pull domains to filter out domains where "fromCyhyCidr" is false

๐Ÿ’ญ Motivation and context

This is to avoid reporting issues with IPs that belong to cloud providers and incorrectly attributed domains

๐Ÿงช Testing

I have tested locally with both in-cidr and out-cidr ips as well as on fceb and non fceb organizations

โœ… Pre-approval checklist

โœ… Pre-merge checklist

โœ… Post-merge checklist