Collecting IP Addresses

[nil0x42]

It would be nice to have an option to collect IP Addresses of computers.
And have it in the "Service Principal Names" or even a dedicated "IP Addresses" section

[andyrobbins]

I think our major concern is networks that dynamically assign IPs to systems as opposed to using static addresses. Because we collect FQDNs for each computer, we just use those names to connect to systems, or query DNS if we need an IP. Can you describe a little more what your use-case would be?

[jesseflorig]

It might be cool to display an IP with an ingestion timestamp and put a refresh button next to it that queries DNS for a fresh IP.

[nil0x42]

@andyrobbins my use case if for big networks with a lot of tricky firewall rules that allow only certain internal IP ranges to communicate with others.

Having the IP already displayed in the machine attributes would be a big gaing of time for those cases, as we don't need to re-check each time in which subnet range is an IP before choosing the best usable path.

Generally, i think it's always useful to have this information when IPs are statically assigned, as this information helps extrapolating neighbor machines, purposes of each machine, etc..

And when the IP is dinamically assigned, we can simply ignore this field (and maybe there is a way to detect ip IPs are dinamically attributed)

[n00py]

I believe this would be a useful feature. Some entries will go stale (DHCP), but so do other collection attributes, such as sessions. When I'm hunting for a tricky pivot, I find myself constantly manually resolving hostnames.

[sbnas-project]

I believe this would be a useful feature. Some entries will go stale (DHCP), but so do other collection attributes, such as sessions. When I'm hunting for a tricky pivot, I find myself constantly manually resolving hostnames.

I second this as well, seeing good pivoting points would be very helpful.

[PwnPeter]

I totally agree, it would be an interesting feature

[randomactsofsecurity]

Agreed, would be nice to see this as well

[derekkddj]

any update? i wopuld love this feature too