Overview

Today’s update comes with two significant features: Analysis Reports and the Query Library. This work brings practical analytic capabilities to the inventory data and makes it easier than ever to create and share custom queries with your team and the wider community.

Analysis Reports

Analysis Reports are now accessible via the Explore link in the navigation menu. This section includes the three existing reports (Topology, Subnets, Bridges) and introduces two new ones.

The Domain Membership report uses information gathered from the NTLMSSP responses of the SMB and RDP protocols to identify machines that are not joined to the primary domain. This report can quickly highlight unmanaged, misconfigured, and third-party systems.

Analysis Reports & Query Library

The Service Attribute report offers a combination of pre-built and configurable queries for unique service attributes. This report can highlight the most and least common values of a given attribute, using an optional attribute filter. The pre-built service attribute queries cover two-dozen common and noteworthy service attributes.

Service Attribute Report

This report provides one of the most interesting perspectives of a network. Looking at the top entries for a given attribute, as well as the long tail of unique entries, can highlight both the intended configuration and the exceptions in a way that is otherwise difficult to see.

SSH Versions Report

This report can be run against any attribute from the Analysis Reports page or via the Asset Detail page by clicking the icon next to an attribute name.

Service Attribute Search

Keep in mind that these queries only cover Live Assets, are limited to 1,000 results, and can be a little slow depending on the number of assets involved.

Query Library

The Inventory search provided by Rumble keeps getting better with each release, but can be tricky to get used to, and the right solution isn’t always obvious. To help folks become familiar with the query language and to make it easy to share useful queries, this release introduces the Query Library. Accessible via the tab in the Explore section, this library provides pre-built queries for common tasks and allows new saved queries to be created, imported, and exported.

Query Library

The Public & Private Network Connections query quickly finds any asset that might be bridging the internal network to the open internet.

Public and Private IP Address Query

If you come up with an awesome query and want to see it in the default library, please drop us a line and we can make that happen. We hope you find these updates useful and we would love your feedback.

If you haven’t had a chance to try Rumble before, or would like to play with the new features, sign up for a free trial and let us know what you think!

-HD

Similar Content

Overview Rumble 1.9.0 is out with major updates to the scan engine, reports, fingerprinting, user interface, documentation, and much more! Scan Engine Folks who scan external assets using their hostnames will now see asset correlation occur using the DNS name itself. For environments where IP addresses are constantly changing (load balancers, CDNs, etc) this leads to less churn and a more accurate inventory. The Rumble Agent and Rumble Scanner now detect and automatically filter out invalid services caused by intercepting middle devices such as Fortigate firewalls and Cisco ASAs.
Overview The 1.8.0 release of Rumble Network Discovery adds Registered Subnets to Sites, increases fingerprint coverage across databases, MAC addresses, and web applications, adds support for FreeBSD, OpenBSD, NetBSD, and DragonFly BSD, and expands support for additional Linux architectures. Tagging has been updated across the platform and numerous small bugs have been fixed. Registered Subnets Sites now allow subnets to be registered with optional tags and descriptions. These subnets work in conjunction with the normal Scope and can be used to apply tags to any assets within the defined networks.
ToneLoc The Subnet Grid Report introduced in Rumble 1.7.0 is copied from one of my favorite security tools of time, ToneLoc! ToneLoc (the tone locator) is MS-DOS wardialer written by Minor Threat and Mucho Maas that was released in the early 90s. ToneLoc was (and sometimes still is) one of the best ways to sweep telephone ranges to find accessible modems. One of the coolest features is ToneMap; a 100x100 pixel grid display of a 10,000 telephone number block.