One Trick I've Learned - Malcolm with Netbox

[trwagner1]

When setting up Malcolm with Netbox, I learned a trick.

When allowing Zeek to create data within Netbox, don't try to create multiple sites. Otherwise, your data will get duplicated. If you create a new site and move a device into that site, it will get recreated in the "default" site as soon as it is again discovered.

Allow Zeek to auto-populate Netbox with data for a good period of time, say 48 hours or a week depending on what your span port is observing. Then, open the terminal as your "service account", run the Malcolm/scripts/configure script and go through the prompts until you get to the section for Netbox. Then, indicate you do not want Zeek to update Netbox when you get to this point. After the script is finished, then restart Malcolm.

Now you can go into Netbox and create sites and assign devices to sites without duplication of data.

[mmguero]

Thanks for sharing this! This is interesting, and not something I've considered with the different sites. If I get some time I'll try to think about ways we could improve that process.

[trwagner1]

Is it possible to break out the Netbox config into it's own config for just such a thing? Perhaps, a second config script that only walks through configuring Netbox after initial configuration?

[mmguero]

There are other issues in the works for improving the configuration UI (see #395) eventually. In the meantime, of course, you can always change environment variables directly, for example, NETBOX_DEFAULT_SITE to change the site.

[trwagner1]

Copy that. Maybe an enhancement to turn on and off data from Zeek updating Netbox?

[mmguero]

Settings to turn on and off data updating netbox already exist, and the user is prompted whether or not they want to enable that during configuration:

• Should Malcolm automatically populate NetBox inventory based on observed network traffic?
• Should Malcolm automatically create missing NetBox subnet prefixes based on observed network traffic?
  This can't be changed on the fly at runtime (it does require a Malcolm restart), and we know there are some user-friendliness improvements with the configuration process we've discussed before, but it is possible to enable/disable that setting.