idaholab / Malcolm

Malcolm is a powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts (PCAP files), Zeek logs and Suricata alerts.

Home Page:https://idaholab.github.io/Malcolm/

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

autocreation and assignment of NetBox subnets in Logstash

mmguero opened this issue · comments

The NETBOX_PRELOAD_PREFIXES environment variable right now causes Malcolm to create three catch-all prefixes in NetBox:

- prefix: 10.0.0.0/8
  description: 10.0.0.0/8
  site: NETBOX_DEFAULT_SITE
- prefix: 172.16.0.0/12
  description: 172.16.0.0/12
  site: NETBOX_DEFAULT_SITE
- prefix: 192.168.0.0/16
  description: 192.168.0.0/16
  site: NETBOX_DEFAULT_SITE

This is probably not that practically useful. Instead, what if we did something like this: similar to what we do with netbox device autopopulation (probably as another question/setting that's not dependent on the existing autopopulation setting) we also give them a "do you want to autocreate/autopopulate creation of RFC1918 subnets?" option. Essentially, it would do this:

The RFC1918 address space includes the following networks:

10.0.0.0 – 10.255.255.255  (10/8 prefix)
172.16.0.0 – 172.31.255.255  (172.16/12 prefix)
192.168.0.0 – 192.168.255.255 (192.168/16 prefix)

I'm thinking what we would do would autocreate subnets one level down from those top-level blocks. Ie.,

  • 10./16 (255.255.0.0)
    • the IP address 10.9.0.215 would cause us to create and assign it to a 10.9.0.0/16 subnet
  • 192.168./24 (255.255.255.0)
    • the IP address 192.168.100.123 would cause us to create and assign it to a 192.168.100.0/24 subnet
  • 172.16./20 (255.255.240.0)
    • the IP address 172.16.29.10 would cause us to create and assign it to a 172.16.29.10/20 subnet

FWIW I think this would replace the NETBOX_PRELOAD_PREFIXES code completely.

Screenshots showing result of this work:

Image

Image

This seems to be working well now.