[IntelMQ-dev] classification attributes in IntelMQ Shadowserver parser schema

Sebix sebix at sebix.at
Fri Feb 2 16:53:30 CET 2024


For the sake of completeness:

On 1/31/24 16:05, Thomas Hungenberg wrote:

> Sebastian (sebix) told me it was agreed that with the translation
> from the current parser _config.py (included with IntelMQ 3.2.1)
> to the new schema, no classification.* attributes will be changed.
I stated this based on 
https://docs.intelmq.org/latest/user/bots/#shadowserver
>
> *Schema contract*
>
> Once set in the schema, the |classification.identifier|, 
> |classification.taxonomy|, and |classification.type| fields will 
> remain static for a specific report.
>
> The schema revision history is maintained at 
> https://github.com/The-Shadowserver-Foundation/report_schema/.
>
which was a result of a discussion on the Pull Request 
(https://github.com/certtools/intelmq/pull/2372)

Thank you Thomas and elsif for analyzing and fixing the schema!

best regards

-- 
Institute for Common Good Technology
gemeinnütziger Kulturverein - nonprofit cultural society
https://commongoodtechnology.org/
ZVR 1510673578
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.cert.at/pipermail/intelmq-dev/attachments/20240202/4bd727fe/attachment.htm>


More information about the IntelMQ-dev mailing list