Overview

Version 1.7.0 of Rumble Network Discovery is live with big updates to reporting. The Analysis Reports introduced in version 1.6.2 are now joined by a new Subnet Grid Report, linked off the main Subnets Report under the Explore menu.

The Query Library has been updated with small tweaks and new built-in query for finding expired TLS certificates, supported by improvements to the scan engine. The Rumble backend has been upgraded to support our larger customers as well as all of our new Starter Edition users.

The command-line Rumble Scanner now generates its own Network Bridges and Switch Topology reports outside of the cloud platform. For folks who want to build their own fingerprints, the command-line scanner now supports custom Recog fingerprint stores using the --fingerprints argument and easy debugging by setting the --fingerprints-debug boolean flag.

Subnet Grid Report

Rumble can now provide a birds-eye view of the network through the Subnet Grid Report. The backstory on this visualization needs it own blog post, but the short version is that treating the IP address space as a grid and applying color maps based on attributes can identify interesting network properties. The Subnet Grid Report can be found linked with a icon off of the main Subnets Report. The example below is the type color map of a public IPv4 network.

Rumble Subnet Grid Report

The Rumble Scanner

The command-line Rumble Scanner now generates the Network Bridges and Switch Topology reports. These reports can help you understand the layer 2 topology and layer 3 segmentation of a network without having to upload the scans into the cloud platform.

Rumble Scanner Topology Report

These report can also be generated using previous scan data. The --import option can be used multiple times to merge many raw scan files into a combined report.

$ rumble-scanner -o rumble-1.7.0 --import previous-scan/scan.rumble.gz
$ start rumble-1.7.0\bridges.html

Rumble Scanner Bridges Report

More Enhancements

Alert Rules can now be limited to a specific site or all sites, depending on your preference.

Recurring scans now show the day of the week abbreviation in the user interface.

The Rumble Agent and Rumble Scanner now use version 0.9991 of npcap.

Dashboard statistics now only account for Live Assets.

The service timestamp fields ts, tls.notAfterTS, and tls.notBeforeTS can now be queried using time-based query operators.

Release Notes

The complete release notes for v1.7.0 can be found in our documentation at the links below.

If you haven’t had a chance to try Rumble before, or would like to play with the new features, sign up for a free trial and let us know what you think!

Similar Content

Rumble v1.11 After eleven releases and eleven months since our 1.0 launch we are happy to announce that v1.11 is live! The release adds Projects; temporary organizations that make it easy to manage one-off scans and professional services with Rumble. Also introduced in v1.11 is the ability to explore historical data, a new addon for Splunk Cloud, bulk asset changes via CSV import, over 10,000 new SNMP fingerprints, and much more!
Overview Recog may be one of the most underrated open source security projects of all time. Recog started off in the early 2000s as the fingerprinting backend for Rapid7’s Nexpose (aka InsightVM) vulnerability scanner. It was released as open source in 2014 and integrated into the Metasploit Framework and Metasploit Pro products. The fingerprint coverage continues to grow through analysis of the Project Sonar data and contributions by our team as part of Rumble development.
Overview Rumble 1.10 is live with continuous scanning, user interface updates, an event log, updates to the scan engine, additional fingerprints, and a new way to keep recurring scans in sync with their sites! Continuous Scanning All paid plans now support a new Continuous scanning option. This will run scans back-to-back, pausing only to apply agent updates. For folks who want to keep a close eye on their networks, continuous scans bring you fresher data, faster.