IntelMQ-dev September 2026

intelmq-dev@lists.cert.at

3 participants
2 discussions

Added Accessible-MikroTik feeds
by elsif 15 Sep '26

15 Sep '26

Hello, Below is the draft mapping for a new report. Please see the attached pdf for details as our web hosting provider is still having issues with the report pages. Please let me know if you have any comments or suggestions. Regards, Jason { "constant_fields" : { "classification.identifier" : "open-mikrotik-service", "classification.taxonomy" : "other", "classification.type" : "other", "protocol.application" : "Mikrotik Service" }, "feed_name" : "Accessible-MikroTik", "file_name" : "scan_mikrotik_service", "optional_fields" : [ [ "severity", "severity", "validate_to_none" ], [ "protocol.transport", "protocol" ], [ "source.reverse_dns", "hostname" ], [ "extra.", "tag", "validate_to_none" ], [ "source.asn", "asn", "invalidate_zero" ], [ "source.geolocation.cc", "geo" ], [ "source.geolocation.region", "region" ], [ "source.geolocation.city", "city" ], [ "extra.source.naics", "naics", "invalidate_zero" ], [ "extra.", "hostname_source", "validate_to_none" ], [ "extra.source.sector", "sector", "validate_to_none" ], [ "extra.", "version", "validate_to_none" ], [ "extra.", "data_2000", "validate_to_none" ], [ "extra.", "data_winbox", "validate_to_none" ], [ "product.vulnerabilities", "tag", "extract_cve_from_tag" ] ], "required_fields" : [ [ "time.source", "timestamp", "add_UTC_to_timestamp" ], [ "source.ip", "ip", "validate_ip" ], [ "source.port", "port", "convert_int" ] ], "url" : "https://www.shadowserver.org/what-we-do/network-reporting/accessible-mikrot…" }

2 2

report.json, intelmq.json and types.md out of sync with Shadowserver feed offering?
by Mika Silander 02 Sep '26

02 Sep '26

Hi, Back from holidays I noticed that it looks like the following Shadowserver feeds have disappeared: population_bgp - https://www.shadowserver.org/what-we-do/network-reporting/accessible-bgp-se… population_ntrip - https://www.shadowserver.org/what-we-do/network-reporting/accessible-ntrip-… scan_imap_vulnerable - https://www.shadowserver.org/what-we-do/network-reporting/vulnerable-imap-r… scan_pop3_vulnerable - https://www.shadowserver.org/what-we-do/network-reporting/vulnerable-pop3-r… There are no foolproof exact matches when looking for replacements but these appears to come close: scan_bgp,scan6_bgp - https://www.shadowserver.org/what-we-do/network-reporting/open-bgp-service-… ??? - https://www.shadowserver.org/what-we-do/network-reporting/info-accessible-n… NB: this link is broken! scan_imap,scan6_imap - https://www.shadowserver.org/what-we-do/network-reporting/accessible-imap-r… scan_pop3,scan6_pop3 - https://www.shadowserver.org/what-we-do/network-reporting/accessible-pop3-r… Could someone with the proper rights please update report.json, intelmq.json and types.md under https://github.com/The-Shadowserver-Foundation/report_schema/ to fix the mismatch? And if I'm mistaken, please let me know why. Br and thank you, Mika The information in this email may be confidential and is intended solely for the use of the individual or entity to whom it is intended. If you are not the intended recipient of this message, please delete the message and notify the sender immediately. For information on how we process personal data and our contact information, please see CSC's website: Privacy<https://csc.fi/en/privacy> T?m?n s?hk?postin tiedot voivat olla luottamuksellisia ja ne on tarkoitettu yksinomaan sen henkil?n tai yhteis?n k?ytt??n, jolle ne on osoitettu. Jos et ole viestiss? tarkoitettu vastaanottaja, tuhoa viesti ja ilmoita asiasta v?litt?m?sti viestin l?hett?j?lle. Tietoja henkil?tietojen ja yhteystietojen k?sittelyst? l?yd?t CSC:n verkkosivuilta: Tietosuoja<https://csc.fi/tietosuoja>

2 4

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

IntelMQ-dev September 2026