IntelMQ-dev December 2024

intelmq-dev@lists.cert.at

5 participants
3 discussions

RFC: scan_msrpc report
by elsif 07 Jan '25

07 Jan '25

Hello, A new report for accessible MS-RPC will begin distribution tonight. Please let me know if the sample schema mapping below is acceptable or if any changes are needed. Regards, Jason -- "scan_msrpc" : { "constant_fields" : { "classification.identifier" : "accessible-msrpc", "classification.taxonomy" : "vulnerable", "classification.type" : "vulnerable-system" }, "feed_name" : "Accessible-MS-RPC-Endpoint-Mapper", "file_name" : "scan_msrpc", "optional_fields" : [ [ "extra.", "packet_type_value", "convert_int" ], [ "extra.", "fragment_length", "convert_int" ], [ "extra.", "max_transmit", "convert_int" ], [ "extra.", "max_receive", "convert_int" ], [ "extra.", "severity", "validate_to_none" ], [ "protocol.transport", "protocol" ], [ "source.reverse_dns", "hostname" ], [ "extra.", "tag", "validate_to_none" ], [ "source.asn", "asn", "invalidate_zero" ], [ "source.geolocation.cc", "geo" ], [ "source.geolocation.region", "region" ], [ "source.geolocation.city", "city" ], [ "extra.source.naics", "naics", "invalidate_zero" ], [ "extra.", "hostname_source", "validate_to_none" ], [ "extra.source.sector", "sector", "validate_to_none" ], [ "extra.", "version", "validate_to_none" ], [ "extra.", "packet_type", "validate_to_none" ], [ "extra.", "packet_flags", "validate_to_none" ], [ "extra.", "data_representation", "validate_to_none" ], [ "extra.", "auth_length", "validate_to_none" ], [ "extra.", "call_id", "validate_to_none" ], [ "extra.", "association_group", "validate_to_none" ], [ "extra.", "raw_response", "validate_to_none" ] ], "required_fields" : [ [ "time.source", "timestamp", "add_UTC_to_timestamp" ], [ "source.ip", "ip", "validate_ip" ], [ "source.port", "port", "convert_int" ] ], "url" : "https://www.shadowserver.org/what-we-do/network-reporting/what-we-do/networ…" }

5 12

RFC: Shadowserver POP3 and IMAP reports
by elsif 06 Jan '25

06 Jan '25

Hello, We have new reports for POP3 and IMAP that will be available soon. https://www.shadowserver.org/what-we-do/network-reporting/accessible-imap-r… https://www.shadowserver.org/what-we-do/network-reporting/vulnerable-imap-r… https://www.shadowserver.org/what-we-do/network-reporting/accessible-pop3-r… https://www.shadowserver.org/what-we-do/network-reporting/vulnerable-pop3-r… The draft schema is attached. Please let me know if any changes are needed or if the schema is ready to be published. Regards, Jason

2 5

A suitable collector for the Abusech Feodo Tracker feed
by Mika Silander 16 Dec '24

16 Dec '24

Hi, I'm attempting to find a suitable collector for retrieving the Abusech Feodo Tracker feed (https://feodotracker.abuse.ch/downloads/ipblocklist.json). Afaiks, the ready-made Abusech Feodo Tracker parser expects reports in plain JSON but the available http collectors are manipulating the retrieved information in one way or the other before passing it on to the parser. This makes me doubt the success of parsing the incoming reports using the said parser. Or should I try downloading the report in CSV format instead and have a CSV parser take care of the parsing? All hints are welcome. Best regards, Mika

2 5

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

IntelMQ-dev December 2024