idaholab / Malcolm

Malcolm is a powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts (PCAP files), Zeek logs and Suricata alerts.
https://idaholab.github.io/Malcolm/
Other
353 stars 58 forks source link

autocreation and assignment of NetBox subnets in Logstash #436

Closed mmguero closed 6 months ago

mmguero commented 6 months ago

The NETBOX_PRELOAD_PREFIXES environment variable right now causes Malcolm to create three catch-all prefixes in NetBox:

- prefix: 10.0.0.0/8
  description: 10.0.0.0/8
  site: NETBOX_DEFAULT_SITE
- prefix: 172.16.0.0/12
  description: 172.16.0.0/12
  site: NETBOX_DEFAULT_SITE
- prefix: 192.168.0.0/16
  description: 192.168.0.0/16
  site: NETBOX_DEFAULT_SITE

This is probably not that practically useful. Instead, what if we did something like this: similar to what we do with netbox device autopopulation (probably as another question/setting that's not dependent on the existing autopopulation setting) we also give them a "do you want to autocreate/autopopulate creation of RFC1918 subnets?" option. Essentially, it would do this:

The RFC1918 address space includes the following networks:

10.0.0.0 – 10.255.255.255  (10/8 prefix)
172.16.0.0 – 172.31.255.255  (172.16/12 prefix)
192.168.0.0 – 192.168.255.255 (192.168/16 prefix)

I'm thinking what we would do would autocreate subnets one level down from those top-level blocks. Ie.,

FWIW I think this would replace the NETBOX_PRELOAD_PREFIXES code completely.

mmguero commented 6 months ago

Screenshots showing result of this work:

Image

Image

mmguero commented 6 months ago

This seems to be working well now.