NbRisk 45.6.1

Netbox NBRisk

NetBox plugin inspired by NIST 800-30 Risk Management.

Compatibility

See the compatibility matrix for supported NetBox versions.

Installation

Add to local_requirements.txt to ensure automatic re-installation during NetBox upgrades:

echo "echo "NbRisk==^45.6.0" >> local_requirements.txt

Install, migrate, and run the initial data syncs:

source /opt/netbox/venv/bin/activate
pip install NbRisk==^45.6.0
cd /opt/netbox/netbox
python3 manage.py migrate nb_risk
python3 manage.py sync_kev       # sync CISA Known Exploited Vulnerabilities catalog
python3 manage.py sync_epss      # sync EPSS exploit prediction scores
sudo systemctl restart netbox netbox-rq

Enabling the Plugin

Add to configuration.py:

PLUGINS = ["nb_risk"]

Configuration

All configuration goes in PLUGINS_CONFIG in configuration.py:

PLUGINS_CONFIG = {
    'nb_risk': {
        # NVD API key — strongly recommended to avoid rate limiting
        # 5 req/30s without a key, 50 req/30s with one
        # Get a free key at https://nvd.nist.gov/developers/request-an-api-key
        'nvd_api_key': 'your-api-key-here',

        # Additional models to support vulnerability assignment beyond the defaults
        # Defaults: dcim.device, virtualization.virtualmachine, tenancy.tenant, dcim.site
        'additional_assets': [
            'dcim.platform',
        ],
    },
}

NVD API Key

The CVE search feature queries the NIST NVD API. Without an API key requests are rate-limited to 5 per 30 seconds; with a key the limit is 50 per 30 seconds. Get a free key at nvd.nist.gov/developers/request-an-api-key.

Proxy Settings

The plugin uses NetBox's built-in HTTP_PROXIES setting from configuration.py for all external API requests (NVD, CISA KEV, EPSS) — no separate proxy config needed:

HTTP_PROXIES = {
    'http': 'http://proxy.example.com:8080',
    'https': 'http://proxy.example.com:8080',
}

Device CVE Tab

A CVEs tab appears on every Device detail page. It queries NVD for CVEs matching the device's running software and cross-references results against the CISA KEV catalog and EPSS scores.

Requirements

• The software_version custom field must be set on the device (created automatically on first install, or manually via manage.py shell)
• A CPE Mapping must exist for the device's platform or device type (see below)

CVE result columns

CVSS score colours

EPSS score colours

CPE Mappings

CPE Mappings are the key to accurate, vendor-agnostic CVE matching. They map a NetBox Platform or Device Type to a verified NVD CPE 2.3 string. Without a mapping, CVE lookups cannot be performed reliably.

CPE Lookup Assistant

Go to Risk Assessment → CVE Integration → CPE Mappings → Lookup to search the NVD CPE dictionary by keyword and create mappings with one click.

Common platform mappings

The Target SW field (8th CPE component) scopes results to a specific platform family. For example nexus_9000_series returns only CVEs specifically affecting Nexus 9000 switches rather than all NX-OS CVEs.

CISA KEV Integration

The CISA Known Exploited Vulnerabilities catalog lists CVEs actively exploited in the wild. The plugin cross-references this automatically.

Sync command

python3 manage.py sync_kev           # sync all Vulnerability records
python3 manage.py sync_kev --dry-run # preview without changes

Run this daily — the KEV catalog is updated by CISA as new exploits are confirmed.

EPSS Integration

FIRST.org EPSS (Exploit Prediction Scoring System) provides a daily-updated probability score (0.0–1.0) that a CVE will be exploited in the next 30 days. No API key required.

Sync command

python3 manage.py sync_epss           # sync all Vulnerability records
python3 manage.py sync_epss --dry-run # preview scores without changes

EPSS scores are also fetched in real-time for CVE Search results and the Device CVE tab, with 24-hour per-CVE Redis caching.

Prioritization framework

Combining all three signals:

Management Commands

Development

A Docker Compose development environment is included. It spins up NetBox 4.5.9 with the plugin installed in editable mode alongside PostgreSQL 15 and Redis 7.

make cbuild     # build containers
make debug      # start in foreground
make start      # start in background
make stop       # stop
make destroy    # destroy including database
make nbshell    # open NetBox shell
make adduser    # create superuser
make migrations # generate migrations after model changes
make test       # run tests

Screenshots

Plugin Menu

Vulnerability View

Affected Assets

Device Vulnerabilities

Threat Event View

Risks View