Compare and highlight discrepancies between NetBox inventory and observed network traffic

[mmguero]

Feature-tracking issue dependent on #131

We can cross-check network traffic with NetBox's model to highlight entities (devices and services) observed in network traffic for which there is no corresponding entry in the list of inventoried assets.

Currently this exists in two dashboards:

• Zeek Known Summary - this dashboard draws from the periodically-generated known_ logs and software logs to provide a summary of the known devices and services in the network. The Uninventoried Observed Services and Uninventoried Observed Hosts tables show services and hosts (by IP address) that weren't found when searched via the NetBox API.

• Asset Interaction Analysis - this dashboard contains a lot of the same information from the Zeek Known Summary dashboard, but it is from a traffic standpoint rather than just an "observed" standpoint. The Uninventoried Internal Source IPs, Uninventoried Internal Destination IPs and Uninventoried Internal Assets - Logs tables highlight communications involving devices that weren't found when searched via the NetBox API.

I've also incorporated views for uninventoried hosts and services into Arkime:

[mmguero]

This DQL query (for Dashboards) could be used to show logs for devices (identified by IP address) in the network without a corresponding entry in netbox:

(NOT event.provider:arkime) AND ((NOT event.provider:zeek) OR event.dataset:(conn OR  known*)) AND ((network.direction:(internal OR inbound) AND (destination.ip:*) AND (NOT destination.device.id:*)) OR (network.direction:(internal OR outbound) AND (source.ip:*) AND (NOT source.device.id:*)))

[mmguero]

Work is moving forward for this feature. Here are two dashboards that highlight things that are missing from the inventory that are observed in network traffic.

You'll notice that the Asset Interaction Analysis has Uninventoried Internal Source IPs and Uninventoried Internal Destination IPs, while Zeek Known Summary has Uninventoried Observed Services and Uninventoried Observed Hosts visualizations. There is some overlap between these two dashboards: the Asset Interaction Analysis dashboard is more about the communications between the assets, while the Zeek Known Summary draws from the periodic summary logs that Zeek produces (software, known_*, etc.).

These visualizations give a good indication of hosts and services found in the network that aren't in the inventory.