Hi all,
some Shadowserver reports include information on the User-Agent in "http_agent"
which is mapped to "extra.http_agent" by the IntelMQ schema, e.g.
event4_sinkhole_http
[
"extra.",
"http_agent",
"validate_to_none"
],
For other reports, the value of "http_agent" is mapped to "extra.user_agent":
event_honeypot_http_scan
[
"extra.user_agent",
"http_agent",
"validate_to_none"
],
Other reports already include the information in "user_agent" which is mapped to
"extra.user_agent" as well:
sandbox_url
[
"extra.",
"user_agent",
"validate_to_none"
],
I'd like to propose harmonizing this by mapping the User-Agent information to
"extra.user_agent" for all reports.
What do you think?
- Thomas