Rumble 1.7.0 Reporting, Fingerprints, and More!

Updated

Overview #

Version 1.7.0 of Rumble Network Discovery is live with big updates to reporting. The Analysis Reports introduced in version 1.6.2 are now joined by a new Subnet Grid Report, linked off the main Subnets Report under the Explore menu.

The Query Library has been updated with small tweaks and new built-in query for finding expired TLS certificates, supported by improvements to the scan engine. The Rumble backend has been upgraded to support our larger customers as well as all of our new Starter Edition users.

The command-line runZero Scanner now generates its own Network Bridges and Switch Topology reports outside of the cloud platform. For folks who want to build their own fingerprints, the command-line scanner now supports custom Recog fingerprint stores using the --fingerprints argument and easy debugging by setting the --fingerprints-debug boolean flag.

Subnet Grid Report #

Rumble can now provide a birds-eye view of the network through the Subnet Grid Report. The backstory on this visualization needs its own blog post, but the short version is that treating the IP address space as a grid and applying color maps based on attributes can identify interesting network properties. The Subnet Grid Report can be found linked with a icon off of the main Subnets Report. The example below is the type color map of a public IPv4 network.

Rumble Subnet Grid Report

The runZero Scanner #

The command-line runZero Scanner now generates the Network Bridges and Switch Topology reports. These reports can help you understand the layer 2 topology and layer 3 segmentation of a network without having to upload the scans into the cloud platform.

runZero Scanner Topology Report

These report can also be generated using previous scan data. The --import option can be used multiple times to merge many raw scan files into a combined report.

$ runzero-scanner -o runzero-1.7.0 --import previous-scan/scan.rumble.gz
$ start runzero-1.7.0\bridges.html

runZero Scanner Bridges Report

More Enhancements #

Alert Rules can now be limited to a specific site or all sites, depending on your preference.

Recurring scans now show the day of the week abbreviation in the user interface.

The Rumble Agent and runZero Scanner now use version 0.9991 of npcap.

Dashboard statistics now only account for Live Assets.

The service timestamp fields ts, tls.notAfterTS, and tls.notBeforeTS can now be queried using time-based query operators.

Release Notes #

The complete release notes for v1.7.0 can be found in our documentation at the links below.

If you haven't had a chance to try runZero before, or would like to play with the new features, sign up for a free trial and let us know what you think!

Written by HD Moore

HD Moore is the co-founder and CEO of runZero. Previously, he founded the Metasploit Project and served as the main developer of the Metasploit Framework, which is the world's most widely used penetration testing framework.
More about HD Moore
Subscribe Now

Get the latest news and expert insights delivered in your inbox.

Welcome to the club! Your subscription to our newsletter is successful.


Related Articles

Product Release
Introducing the customizable dashboard, Wiz integration, and more!
Introducing the customizable dashboard, Wiz Integration, and other Q2 2024 enhancements to the runZero Platform.
Product Release
How to integrate your SIEM platform with runZero to create an actionable asset inventory
Learn how to combine runZero's real-time asset inventory with SIEM exports for comprehensive asset tracking and historical data analysis..
runZero Insights
Celebrating Women’s History Month with trailblazers & innovators
It’s Women’s History Month! runZero is celebrating all month long by highlighting innovative women who have been technological trailblazers.
Industry
Upcoming NYDFS regulatory requirements on asset inventory and vulnerability enumeration
Is your business prepared for the approaching deadlines for complying with the latest version of the NYDFS Cybersecurity Regulation (23 NYCRR 500)?...

See Results in Minutes

Get complete visibility into IT, OT, & IoT — without agents, credentials, or hardware.

© Copyright 2024 runZero, Inc. All Rights Reserved