IntelMQ-dev March 2021

intelmq-dev@lists.cert.at

10 participants
13 discussions

IEP04: IntelMQ Data Format - Meta-Information
by Sebastian Waldbauer 17 May '21

17 May '21

Dear IntelMQ Developers and Users, nowadays security incidents are more important than 10 years ago. As IntelMQ can be used as core element for automated security incident handling, we would like to provide a way to share information with other intelmq instances. This proposal is also an alternative to IEP03 insofar as solving the "multiple values" is possible by using UUIDs so "link" related events in a backwards-compatible manner. If you're interested, please let us know, so we could organize a hackathon for further discussions about the specification of the meta-information. Previously this idea was discussed in [0] and [1]. [0] https://github.com/certtools/intelmq/blob/version-3.0-ideas/docs/architectu… [1] https://github.com/certtools/intelmq/issues/1521 # IEP04: Internal Data Format: Meta Information and Data Exchange To ease data exchange between two or more IntelMQ instances, adding some meta-information to the events can make this sharing easier in certain regards. "Linking" events could be based on the same theory as `git` using it - with parent hashes ( we would call it UUID ). ### TL;DR Communication between one or more IntelMQ instances & exchange data with a backwards-compatible format. P2P or centralized architecture is a big topic, which has to be discussed after the format is being set. ### Why is metadata important? Short and simple. To avoid race conditions & being able to discard/drop already processed events from other instances. ### Meta information Metadata is used to transfer some general data, which is not likely related to the event itself. It's more or less just an information to keep events clear & sortable. A message could look like: { "meta": { "version": 1, # protocol version, so we are allowed to fallback to old versions too "uuid": { current: "cert_at:aaaa-bbbb-cccc-dddd" # format to be decided parent: "cert_at:xxxx-yyyy-zzzz-ffff" # format to be discussed, if not set -> current is the parent uuid }, "type": "event", "format": "intelmq", # i. e. this field could contain "n6" or "idea", so the receiving component can decode on demand. }, "payload": { # normal intelmq data "source.ip": "127.0.0.1", "source.fqdn": "example.com", "raw": base64-blob } } Tell us your opinion about adding non-standardized meta-information fields ( i. e. RTIR ticket number, origin, other local contact informationen ... and so on ) #### The UUID For the UUID there are multiple options: 1. Generate a random 128 bit UUID 2. A list of entities, which dealt with this event already. For example if an event was passed on from cert-at to cert-ee, the field could look like `!cert-at!cert-ee`. A message sending loop can be detected if the own name is already in this field upon reception. 3. Using CyCat: `publisher-short-name:project-short-name:UUID`. For example: `cert-at:intelmq:72ddb00c-2d0a-4eea-b7ac-ae122b8e6c3b`, or `cert-pl:n6:f60c9fb9-81f9-4e0b-8a44-ea41326a15b3`. Some more research and discussion is required before the implementation of this option. Have a look at https://www.cycat.org/services/concept/ for more details. 4. A hash: A benefit using a hash is that we're able to recalculate them on every intelmq instance. ### Exporting events to other systems In IntelMQ 2.x the events only comprise of the "payload" and no meta information. For local storages like file output or databases, the meta information may not be relevant in some use-cases. So it needs to be possible to export events *without* meta information, which is also the backwards-compatible behaviour. The "type" field exists in the current format as "__type" in the flat payload structure. In the output bots there's currently a boolean parameter `message_with_type` to include the field `__type` in the "export". For optionally exporting meta-information like uuid or format, a similar logic could be used. ### How can data exchange work? This now depends on how IntelMQ instances can communicate, either Peer-to-peer or via a central data hub. Both of them do have pro's and con's. #### P2P ( Peer 2 Peer ) Decentralized network + Less downtimes: A downtime of one instance, does not affect the whole network + Better privacy: data is not shared to an unrelated instance + More secure: data can optionally be encrypted (key-exchange between instances?) + Decentralized and local maintenance ~ Network latency depends on server locations - Networking issues may occur How would data exchange looks like between two instances: 1) Instance A has events which should be relayed to Instance B & C, because they're not sure who the actually receiver should be 2) Instance A ensures all messages have a UUID 3) Instance A sends the data to Instance B & Instance C 4) Instance B checks the data & they're sure that the data should be for Instance C 5) Instance C receives data from Instance A & Instance B 6) Instance C checks the UUID, which is the same & drops the package from Instance B #### (Central) Data hub + Less maintenance: Is maintained by the hub administrator + Central data storage (reports can optionally be cached to be downloaded later) ~ Central data analysis (e.g. statistics) is possible ~ Network latency depends on server locations - point of failure: if network problems occur, no exchange is possible As already seen above, data exchange here would be less complicated. The sending may look like: 1) Instance A has events which should be relayed to Instance B (e.g. different country) 2) Instance A ensures all messages have a UUID 3) Instance A sends these messages to the data hub The reception side can look like: 1) Instance B connects to central instance 2) Instance B queries and downloads all available messages 3) Upon reception, all messages are de-duplicated based on the UUID: a) If the UUID is already known, discard the message b) If the UUID has not been seen before, continue with processing To sum up, both exchange variants are useful. More research is needed, i. e. a mixed infrastructure with centralized parts but can be decentralized too. However, this shall not be neither the purpose nor the aim of this IEP. -- // Sebastian Waldbauer <waldbauer(a)cert.at> - T: +43 1 5056416 7202 // CERT Austria - https://www.cert.at/ // Eine Initiative der nic.at GmbH - https://www.nic.at/ // Firmenbuchnummer 172568b, LG Salzburg

7 17

IEP03: IntelMQ Data Format - Multiple Values
by Sebastian Waldbauer 22 Apr '21

22 Apr '21

Dear IntelMQ Developers and Users, an evaluation of current challenges with the internal data format led to the idea of allowing multiple values for one field in IntelMQ 3.0 (scheduled for June 2021)[0]. The idea is described below, including various advantages and disadvantages. We appreciate your input, opinion and analysis of further implications on this idea. We plan to evaluate the feedback that emerged in two weeks. [0] https://github.com/certtools/intelmq/blob/version-3.0-ideas/docs/architectu… "The new IDF shall support (sorted) lists of IPs, domains, taxonomy categories, etc. By convention the most relevant item in such a list MUST be the first item in the sorted list." https://github.com/certtools/intelmq/blob/version-3.0-ideas/docs/architectu…: n6-system "Since the new IDF shall support multiple values, mapping to n6 should be rather easy." ## Use-cases ### Network information IntelMQ's format currently allows for *exactly one* value per field. For example, every event can have *one* `source.ip` and *one* `source.fqdn`. In some use-cases, multiple values can be useful, for example when querying DNS information. One domain (`source.fqdn`) can point to multiple IP addresses (`source.ip`). The other way round, multiple domains point to the same IP address is also very common. The use-case first appeared was that one IP address can be part of multiple Autonomous systems (`source.asn`).[1][2][3] See the examples below in section Format. [1]: "Multiple ASNs/networks per IP? #543" https://github.com/certtools/intelmq/issues/543 [2]: "BOT: DNS lookup #373" https://github.com/certtools/intelmq/issues/373 [3]: "reverse DNS: Only first record is used "https://github.com/certtools/intelmq/issues/877 ### Classification Another use-case is to use multiple classifications.[5] For example, if a website was hacked and used for a phishing page, it can be assigned two classifications: For the hacking: Taxonomy: information-content-security, type: unauthorised-modification-of-information For the phishing page: Taxonomy: fraud, type: phishing Another example are reachable networks services, which should not be accessible by the internet. Shadowserver provides a lot of this data. Open XDMCP instances are both DDoS amplifiers and Potentially unwanted accessible systems. Therefore both classifications apply: Taxonomy: vulnerable, type: ddos-amplifier Taxonomy: vulnerable, type: potentially-unwanted-accessible-system A list of all fields on the RSIT can be found in the RSIT repository[6] [5]: https://github.com/enisaeu/Reference-Security-Incident-Taxonomy-Task-Force/… [6]: https://github.com/enisaeu/Reference-Security-Incident-Taxonomy-Task-Force/… ## Format Some examples: {"source.ip": ["192.0.43.8"], "source.asn": [16876, 40528]} {"source.ip": ["10.0.0.1", "10.0.0.2"], "source.url": ["http://example.com/", "http://example.net"]} {"classification.taxonomy": ["information-content-security", "fraud"], "classification.type": ["unauthorised-modification-of-information", "phishing"], "source.url": ["http://example.com/"], "source.ip": ["10.0.0.1", "10.0.0.2"]} In the bots' code multiple values need to be taken car of. For example, instead of: ip_addr = event["source.ip"] # do stuff it is necessary to loop over the values: for ip_addr in event["source.ip"]: # do stuff This logic is required for *all* fields which can have multiple values, therefore nested loops may be necessary. Everything which processes IntelMQ data needs to be adapted, including data bases. See the "Disadvantages" section below. ### Optional back-conversion ("value-explosion") One variant/option of this IEP is to create a conversion layer from the new multi-value format to the old one-value format by creating multiple events with only one value per field. Using this conversion, compatibility with external components can be kept, while the advantages only exist inside the IntelMQ core (ie. the bots). Examples: {"source.ip": ["127.0.0.1", "127.0.0.2"], "source.fqdn": ["example.com"]} -> {"source.ip": "127.0.0.1", "source.fqdn": ["example.com"]}, {"source.ip": "127.0.0.2", "source.fqdn": ["example.com"]} {"source.ip": ["127.0.0.1", "127.0.0.2"], "source.fqdn": ["example.com", "example.org"]} -> {"source.ip": "127.0.0.1", "source.fqdn": "example.com"}, {"source.ip": "127.0.0.1", "source.fqdn": "example.org"}, {"source.ip": "127.0.0.2", "source.fqdn": "example.com"}, {"source.ip": "127.0.0.2", "source.fqdn": "example.org"} ### What will change? We'll change the behaviour of the current IntelMQ internal parsing process, i. e. you'll be able to add multiple IP addresses to on field, which will be handled as multiple events, but merged into one event. This will allow us to combine i. e. a domain with multiple IP addresses to one event. ### Advantages Supporting multiple values allows us to add multiple IP addresses to one event. As opposed to using multiple events with nearly similar data, the multiple-value approach reduces data duplication and has less overhead, while on the other hand the complexity increases. If multiple events would be used instead, related events would need to be linked together by other means (see section Alternative below). ### Disadvantages (breaking behaviour) The complexity in IntelMQ and all linked components increases without doubt. All components dealing with the IntelMQ-data need to be adapted to deal with multiple values. This includes all bots, but IntelMQ administrators need to adapt their configurations (e.g. filters, etc.) as well. Without the explosion-variant, all connected databases need to be adapted (e.g. PostgreSQL, SQLite, Elastic, MongoDB etc.) additionally and all software which is processing data from IntelMQ need to be adapted. PostgreSQL support arrays for columns, but the scheme conversion can be complex and resource-hungry. IntelMQ followed the KISS ("keep it simple, stupid")[4] principle from its beginning. It is disputable if multiple values breaks with this principle. [4]: https://en.wikipedia.org/wiki/KISS_principle ## Alternatives An alternative to using multiple values per field is to set unique identifiers (e.g. UUID) per event and let events with the same origin have the same "parent" identifier. This way, related events can be linked and compatibility is easier. Relating the events to each other requires extra steps although, but keeps the KISS principle. This approach will be described in IEP04. To solve the use-case of multiple classifications per event, the primary and most important classification can be used instead of multiple ones. A possible solution for the classification use-case above would be to some sort of tagging - in short "tags". I. e. { "source.ip": ["192.0.43.8"], "source.asn": [16876, 40528], "tags": ["ddos-amplifier", "info-disclosure", "mirai-botnet"] } ## Other IoC processing formats For reference, we describe the formats of other IoC-processing systems similar to IntelMQ. Both formats, IDEA and n6 do support multiple values in different kinds. If you know of other similar formats supporting multiple values, please speak up! ### "IDEA" The IDEA-format, used by CESNET-developed Warden, supports multiple values for some fields. But the data format structure differs clearly from IntelMQ's, as you can see in the example below. The classification is defined per address and network ranges are possible as addresses, what is not supported in IntelMQ. IDEA was designed from scratch to overcome disadvantages of Warden's previous data format. Example: "Source": [ { "Type": ["Phishing"], "IP4": ["192.168.0.2-192.168.0.5", "192.168.0.10/25"], "IP6": ["2001:0db8:0000:0000:0000:ff00:0042::/112"], "Hostname": ["example.com"], "URL": ["http://example.com/cgi-bin/killemall"], "Proto": ["tcp", "http"], "AttachHand": ["att1"], "Netname": ["ripe:IANA-CBLK-RESERVED1"] } ], "Target": [ { "Type": ["Backscatter", "OriginSpam"], "Email": ["innocent(a)example.com"], "Spoofed": true }, { "IP4": ["10.2.2.0/24"], "Anonymised": true } ] Upstream documentation: https://idea.cesnet.cz/en/index https://warden.cesnet.cz/en/index ### n6 In the n6 format, the addr field is a list of arrays with `ip`, `asn`, `cc` and `dir` fields. `addr` is similar to IntelMQ's `source` namespace, but the size of `addr` is much lower and the "direction" of the address is given by a field inside the addr item. Example: [{"ipv6": "abcd::1", "cc": "PL", "asn": 12345, "dir": "dst"}] Upstream documentation: https://n6sdk.readthedocs.io/en/latest/tutorial.html#field-class-addressfie… https://n6sdk.readthedocs.io/en/latest/tutorial.html#field-class-extendedad… -- // Sebastian Waldbauer <waldbauer(a)cert.at> - T: +43 1 5056416 7202 // CERT Austria - https://www.cert.at/ // Eine Initiative der nic.at GmbH - https://www.nic.at/ // Firmenbuchnummer 172568b, LG Salzburg

4 7

intelmq-manager authentication issue on Ubuntu 20.04 LTS
by Mika Silander 08 Apr '21

08 Apr '21

Hi, Seems I have a configuration error somewhere in intelmq-manager's setup. I have configured basic authentication for this service, apache asks for the account and password and shows the start view of intelmq-manager. The start view says "Not logged in" and provides a login button below. If I press the button and use the same credentials, it still says "not logged in". Any hints? intelmq-manager, intelmq and intelmq-api were all installed from package repos for Ubuntu 20.04 LTS. Cheers, Mika

3 10

IntelMQ & API & Manager 2.3.1
by Sebastian Wagner 25 Mar '21

25 Mar '21

Dear community, This IntelMQ version did not gain any major features and is a sole product maintenance release. It covers various minor error corrections in the IntelMQ software, and usability enhancements for the new API. Some notable changes are listed below. Thanks again to all contributors! The installation instructions: https://intelmq.readthedocs.io/en/maintenance/user/installation.html Upgrade instructions: https://intelmq.readthedocs.io/en/maintenance/user/upgrade.html All packages have been published to PyPI. The deb/rpm-repositories and dockerhub are following on Friday. I'm trying to summarize the changes here, the full changelogs are linked below. The Cymru CAP Parser has been adapted to the new format for events of the category "bruteforce" (PR#1795 by Sebastian Wagner, CERT.at, fixes 1794). The Shodan Parser now supports nested conversions, improved protocol detection and has a majorly extended parser mapping (PR#1821 by Mikk Markus Möll, CERT.EE). The feed documentation gained a missing description for the Shodan Country Stream (by Sebastian Wagner, CERT.at). On the documentation front, the ecosystem document received revised sections on intelmq-cb-mailgen and fody (PR#1792 by Bernhard Reiter, Intevation). A new section in the documentation summarizes hardware requirements (PR#1811 by Sebastian Wagner, CERT.at). Minor enhancements and adaptions in the tests. # IntelMQ API-related changes The IntelMQ API documentation now has more details on the required write permission for the session database file (PR#1798 by Birger Schacht, CERT.at, fixes intelmq-api#23). See https://intelmq.readthedocs.io/en/maintenance/user/intelmq-api.html Session database permission errors: Catch the exception in the code and add a hint to check the permissions of both the file and the directory (PR#25 by Birger Schacht, CERT.at, fixes #23). The tool `intelmqsetup`, which is part of the installation routine for manual IntelMQ installations, is now able to automatically create the required directory layout and file permissions for the IntelMQ API (PR#1787 by Sebastian Wagner, CERT.at, fixes #1783) and as well covers the webserver and sudoers configuration for IntelMQ API and IntelMQ Manager (PR#1805 by Sebastian Wagner, CERT.at, fixes #1803). # IntelMQ Manager-related changes The required authentication token in save-data request of the "Configuration" tab is now sent to the backend (PR#245 by Marcos Gonzalez, CNCSRD-DO, fixes #244). On two locations the link destinations have been fixed, they still linked to the old PHP-based backend URLs: "Clear Configuration" link destination (PR#249 by Sebastian Wagner, CERT.at, fixes #248) and link to configuration page of bot on the monitor page (PR#249 by Sebastian Wagner, CERT.at, fixes #248). # Full changelogs: IntelMQ: https://github.com/certtools/intelmq/releases/tag/2.3.1 IntelMQ API: https://github.com/certtools/intelmq-api/releases/tag/2.3.1 IntelMQ Manager: https://github.com/certtools/intelmq-manager/releases/tag/2.3.1 -- // Sebastian Wagner <wagner(a)cert.at> - T: +43 1 5056416 7201 // CERT Austria - https://www.cert.at/ // Eine Initiative der nic.at GmbH - https://www.nic.at/ // Firmenbuchnummer 172568b, LG Salzburg

1 0

ShadowServer feeds vs. ShadowServer parser bot
by Mika Silander 24 Mar '21

24 Mar '21

Hi. After trying to match current ShadowServer feeds to their internal intelmq identifiers, I got stuck with a few that I cannot find a corresponding internal mapping for in intelmq/bots/parsers/shadowserver/config.py (intelmq 2.3.1). One example is the Click-Fraud Report (https://www.shadowserver.org/what-we-do/network-reporting/click-fraud-repor…). Correct me if I'm wrong in assuming all ShadowServer feeds are perhaps not (yet?) supported by the ShadowServer parser bot. Are there plans for extending the parser bot in question? Don't take me wrong, this is no criticism, the bot does a fine job. I would just like to know what the situation is and then be able to decide how to continue with our own project. Cheers, Mika

2 3

First steps to make adding custom Bots easier
by Birger Schacht 16 Mar '21

16 Mar '21

Dear *, one goal of the IntelMQ 3.0 release (which is planned for this summer) is to make the handling of configuration files easier and also to lower the bar for adding new bots. With two bigger merge requests merged in the last few weeks, we are now one step closer to that goal: The first change affects how bots handle their configuration. IntelMQ Bots used to work with a dict called `parameters` that contained all their settings and the settings of the parent bots and default values and everything was merged together at some point. When adding a bot those parameters had to be checked in the bot class itself, they had to be added to the `defaults.conf` and to the `BOTS` file. We now changed that approach and bots now simply define their parameters as (public) class attributes. When the bot is initialized, we iterate through the public attributes and check if they are set to a custom value in the configuration and if so, we use that value instead. This also works for all the attributes the bot inherits from parent classes. In addition, the default values for the variables are now set in the bot classes directly and not in a separate `defaults.conf` file. While adding all the attributes to the bots, we also tried to add typing information- we are not sure yet how exactly we will use that information, but at least its there and shows what kind of value is expected. Another additional information in the bots is the docstring, which we added to every bot class. The second change made the `BOTS` file obsolete. The `BOTS` file contained a list of all the available bots, together with their description, their modulepath and their parameters. Sebastian Waldbauer tirelessly worked on refactoring the code and added a function to generate the list of bots on the fly. Based on that Sebastian Wagner polished the PR by cleaning up a big amount of stale code in the bot classes, testing the changes and adding documentation. So it will now be possible to add new bots without having to deal with the `BOTS` file or the `defaults.conf`. The latter still exists, mainly because the `intelmqctl` script still uses it, but that will be an easy fix. We also updated the documentation accordingly, as you can see in the development version of the Developer Guide [0]. [0] https://intelmq.readthedocs.io/en/latest/dev/guide.html cheers, Birger -- // Birger Schacht <schacht(a)cert.at> // CERT Austria - https://www.cert.at/ // Eine Initiative der nic.at GmbH - https://www.nic.at/ // Firmenbuchnummer 172568b, LG Salzburg

1 0

Intercepting a bot restart and shutdown
by Mika Silander 12 Mar '21

12 Mar '21

Hi, A technicality: what is the best way to intercept a bot restart or shutdown (stopping the bot)? I see the Bot class has a stop method, so I assume overriding this method in our own bots would do the trick, correct? In practise, we'd have the usual init and process methods of the bots extended with a stop method that performs its operations and finally calls the super classes' stop(?) I'm looking for ways to write a bot's state information to disk before a restart/stopping. Best regards, Mika

2 3

Intelmq + intelmq-manager from package distribution + own bots & confs
by Mika Silander 10 Mar '21

10 Mar '21

Hi, Sorry to bother again with something which is probably evident. Now that 3.0.0 is out I'd like to retry setting up intelmq & intelmq-manager from the package distribution (Ubuntu 20.04) and then add our own bots and configurations to the setup. Is this the correct order of operations? Am I missing something? 1. install intelmq and intelmq-manager from package management (with LSB paths option) 2. copy our bots to proper subdirectories below /usr/lib/python3/dist-packages/intelmq/bots 3. copy our library modules below /usr/lib/python3/dist-packages/intelmq/lib 4. run intelmqsetup 5. adapt runtime.conf, defaults.conf, BOTS and pipeline.conf under /etc/intelmq to our needs 6. start our bot net with intelmqctl Thanks again, Mika

4 10

gitlab docker
by Marius Karotkis 09 Mar '21

09 Mar '21

Hello, maybe someone can help. I try run test from gitlab with gitlab runner on docker. But I get errors on stage build: ERROR: Cannot install intelmq 2.3.0.1 (from /builds/deployment/intelmq/dist/intelmq-2.3.0.6374.tar.gz) and intelmq 2.3.0.6374 (from /builds/deployment/intelmq/dist/intelmq-2.3.0.6374-py2.py3-none-any.whl) because these package versions have conflicting dependencies. The conflict is caused by: The user requested intelmq 2.3.0.6374 (from /builds/deployment/intelmq/dist/intelmq-2.3.0.6374-py2.py3-none-any.whl) The user requested intelmq 2.3.0.1 (from /builds/deployment/intelmq/dist/intelmq-2.3.0.6374.tar.gz)

2 1

Re: [IntelMQ-dev] [IntelMQ-users] Classification of malware itself in IntelMQ
by Sebastian Wagner 08 Mar '21

08 Mar '21

Hi, Thanks Filip for sharing your opinion. As there were no further comments on this topic, I'll implement option 2. Sebastian On 2/24/21 10:32 AM, Filip Pokorny wrote: > Hi Sebastian, > >> I'm currently in favor of option 2), as we can keep the meaning of "Malicious Code" in sync with the RSIT and still support the use-case sufficiently. But my opinion could change during the discussion :) > I agree. This combined with "malware.name", "malware.version" and > "malware.hash" seems good enough to describe malware for the IntelMQ > use-case. > > Best Regards, > Filip > > > On 2/22/21 11:24 AM, Sebastian Wagner wrote: >> Dear IntelMQ community, >> >> sorry for cross-posting, but I think this topic should be discussed in a >> wider group. >> >> IntelMQ always followed the Reference Security Incident Taxonomy (short: >> RSIT)[0] and its predecessor for its 'classification.taxonomy/type' >> fields. The Classification column in the RSIT corresponds to our >> "classification.taxonomy" field, and the RSIT's second column (currently >> called Incident examples) corresponds to our "classification.type" >> field. "classification.identifier" is an optional third level free-text >> field to give more specific context.[1] >> >> Due to historical reasons and changes on both sides - IntelMQ as well as >> the RSIT -, IntelMQ's classification scheme deviated a bit from the RSIT >> over time. I'm working on aligning them again for 3.0, which works >> straightforward in most cases. But for one case, I need your input. >> >> The predecessor of the RSIT (the eCSIRT.net taxonomy)[2] used the >> malicious code taxonomy differently: To classify malware itself into >> categories, like virus, worm, trojan, etc. The RSIT never did that, as >> classifying malware is never unambiguous and there are plenty of >> existing classification scheme out there, which do this already. Also, >> the focus of the RSIT is different, as it classifies the >> incidents/events, not malware samples. >> >> And for this reason, IntelMQ had (until < 3.0.0) the classification.type >> "malware" in IntelMQ. Most of the usages were wrong anyway, and should >> have been infected-device, malware-distribution or something else >> anyway. There is only one usage in IntelMQ, which can not be changed. >> And that one is really about malware itself (or: the hashes of samples) >> as used in the GitHub Feed parser[3] and the FireEye Parser[4]. But the >> issue is more generic, as we need to decide anyway, how we want to deal >> with such malware-IoCs. >> >> A malware (hash) does not fit into the RSIT. It's neither an Infected >> System, a C2 Server, Malware Distribution nor Malware Configuration. >> It's just a malware (hash). I see four options: >> >> 1) Deviate from the RSIT and just use 'classification.taxonomy' = >> 'Malicious Code' and 'classification.type' = 'malware' >> 2) Deviate slightly less from the RSIT and use 'classification.taxonomy' >> = 'other' and 'classification.type' = 'malware' >> 3) Adhere strictly to the RSIT and use 'classification.taxonomy' = >> 'other' and 'classification.type' = 'other' and >> "classification.identifier" = 'malware' >> 4) IntelMQ does not support this use case >> >> In cases 1) and 2) "classification.identifier" could be used to specify >> what the event is about, e.g. "hash", or the malware family. >> >> I'm currently in favor of option 2), as we can keep the meaning of >> "Malicious Code" in sync with the RSIT and still support the use-case >> sufficiently. But my opinion could change during the discussion :) >> >> Do you see any more options than I listed above? What do you favor? >> >> best regards >> Sebastian >> >> [0]: >> https://github.com/enisaeu/Reference-Security-Incident-Taxonomy-Task-Force/… >> [1]: >> https://intelmq.readthedocs.io/en/latest/dev/data-harmonization.html#classi… >> [2]: https://www.trusted-introducer.org/Incident-Classification-Taxonomy.pdf >> [3]: >> https://github.com/certtools/intelmq/blob/f7507ca2643fe8ddb3817c9be1209504e… >> [4]: https://github.com/certtools/intelmq/pull/1745 >> >> >> -- >> // Sebastian Wagner <wagner(a)cert.at> - T: +43 1 5056416 7201 >> // CERT Austria - https://www.cert.at/ >> // Eine Initiative der nic.at GmbH - https://www.nic.at/ >> // Firmenbuchnummer 172568b, LG Salzburg >> >> >> _______________________________________________ >> IntelMQ-dev mailing list >> IntelMQ-dev(a)lists.cert.at >> https://lists.cert.at/cgi-bin/mailman/listinfo/intelmq-dev >> -- // Sebastian Wagner <wagner(a)cert.at> - T: +43 1 5056416 7201 // CERT Austria - https://www.cert.at/ // Eine Initiative der nic.at GmbH - https://www.nic.at/ // Firmenbuchnummer 172568b, LG Salzburg

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

IntelMQ-dev March 2021