<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p>Hello,</p>
<p>The schema has been updated based on your feedback:</p>
<ul dir="auto">
<li>The 'malware.name' is now mapped to 'infection' for the
event4_microsoft_sinkhole, event4_microsoft_sinkhole_http,
event6_sinkhole, event6_sinkhole_http,
event6_sinkhole_http_referer, event_sinkhole, event_sinkole_dns,
event_sinkhole_http, and event_sinkhole_http_referer reports.</li>
<li>The 'classification.identifier' is now mapped to 'infection'
for the event4_microsoft_sinkhole_http, event6_sinkhole_http,
event6_sinkhole_http_referer, event_sinkhole_http, and
event_sinkhole_http_referer reports.</li>
<li>The 'classification.taxonomy', 'classification.type', and
'protocol.application' were changed for the
event6_sinkhole_http_referer and event_sinkhole_http_referer
reports.</li>
</ul>
<p>Regards<br>
</p>
<p></p>
<div class="moz-cite-prefix">On 1/30/24 12:10 AM, Kamil Mankowski
via IntelMQ-dev wrote:<br>
</div>
<blockquote type="cite"
cite="mid:0102fa41-6a53-4b7c-bac1-d8c4a166e79f@cert.at">Hi all,
<br>
<br>
Thanks for the comments. I've forwarded the thread to
ShadowServer, and they also have just joined the list (represented
by @elsif, who works on the IntelMQ integration), so we can
discuss the feedback directly.
<br>
<br>
@Thomas - answering the question about completed schema changes, I
spoke with elsif about that a few weeks ago, and schema changelog
is available at
<a class="moz-txt-link-freetext" href="https://github.com/The-Shadowserver-Foundation/report_schema/blob/main/completed-changes.md">https://github.com/The-Shadowserver-Foundation/report_schema/blob/main/completed-changes.md</a><br>
<br>
Best regards
<br>
<br>
// Kamil Mańkowski <a class="moz-txt-link-rfc2396E" href="mailto:mankowski@cert.at"><mankowski@cert.at></a> - T: +43 676 898 298
7204
<br>
// CERT Austria - <a class="moz-txt-link-freetext" href="https://www.cert.at/">https://www.cert.at/</a>
<br>
// CERT.at GmbH, FB-Nr. 561772k, HG Wien
<br>
<br>
</blockquote>
</body>
</html>