idaholab / Malcolm

Malcolm is a powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts (PCAP files), Zeek logs and Suricata alerts.
https://idaholab.github.io/Malcolm/
Other
353 stars 58 forks source link

handle multiple NetBox sites #449

Closed mmguero closed 3 months ago

mmguero commented 6 months ago

NetBox has the concept of sites. Malcolm doesn't handle multiple sites very well (at all, really), it just lets the user provide a NETBOX_DEFAULT_SITE value that is checked against tags for upload and used for live capture.

We should allow multiple sites, which means we need to provide a way to associate captured data with a particular site. This includes:

This needs to come through for all uploaded data and captured with Zeek and Suricata. We could look at arkime as well although I'm not sure where it would be specified for arkime data. The value is stored today in source.device.site and source.segment.site and destination.device.site and destination.segment.site.

mmguero commented 3 months ago

Site will be definable in upload window, queried from NetBox's list of extant sites:

Image

mmguero commented 3 months ago

Image

Image

Image

Image

Image

Image

As far as I can tell this is all working correctly now. I'll continue to test and reopen if I find anything. Also there may be improvements we can do in the future for this, but for now I think it seems good.