IntelMQ-dev

intelmq-dev@lists.cert.at

256 discussions

Shadowserver IntelMQ schema - version field additions
by elsif 30 Oct '26

30 Oct '26

Hello, A version field has been added to a number of scan feeds. Please note that in most cases the version field will be different from the device_version/product.version. The version field will list technologies identified by a version present in the product stack. This may reflect the device_version but have multiple technologies identified in addition. For example, PHP version or Apache version such as "apache:1.3.41;php:4.4.9". Regards, Jason

3 3

Shadowserver IntelMQ schema / User-Agent
by Thomas Hungenberg 22 Oct '26

22 Oct '26

Hi all, some Shadowserver reports include information on the User-Agent in "http_agent" which is mapped to "extra.http_agent" by the IntelMQ schema, e.g. event4_sinkhole_http [ "extra.", "http_agent", "validate_to_none" ], For other reports, the value of "http_agent" is mapped to "extra.user_agent": event_honeypot_http_scan [ "extra.user_agent", "http_agent", "validate_to_none" ], Other reports already include the information in "user_agent" which is mapped to "extra.user_agent" as well: sandbox_url [ "extra.", "user_agent", "validate_to_none" ], I'd like to propose harmonizing this by mapping the User-Agent information to "extra.user_agent" for all reports. What do you think? - Thomas

3 6

Added Accessible-MikroTik feeds
by elsif 15 Sep '26

15 Sep '26

Hello, Below is the draft mapping for a new report. Please see the attached pdf for details as our web hosting provider is still having issues with the report pages. Please let me know if you have any comments or suggestions. Regards, Jason { "constant_fields" : { "classification.identifier" : "open-mikrotik-service", "classification.taxonomy" : "other", "classification.type" : "other", "protocol.application" : "Mikrotik Service" }, "feed_name" : "Accessible-MikroTik", "file_name" : "scan_mikrotik_service", "optional_fields" : [ [ "severity", "severity", "validate_to_none" ], [ "protocol.transport", "protocol" ], [ "source.reverse_dns", "hostname" ], [ "extra.", "tag", "validate_to_none" ], [ "source.asn", "asn", "invalidate_zero" ], [ "source.geolocation.cc", "geo" ], [ "source.geolocation.region", "region" ], [ "source.geolocation.city", "city" ], [ "extra.source.naics", "naics", "invalidate_zero" ], [ "extra.", "hostname_source", "validate_to_none" ], [ "extra.source.sector", "sector", "validate_to_none" ], [ "extra.", "version", "validate_to_none" ], [ "extra.", "data_2000", "validate_to_none" ], [ "extra.", "data_winbox", "validate_to_none" ], [ "product.vulnerabilities", "tag", "extract_cve_from_tag" ] ], "required_fields" : [ [ "time.source", "timestamp", "add_UTC_to_timestamp" ], [ "source.ip", "ip", "validate_ip" ], [ "source.port", "port", "convert_int" ] ], "url" : "https://www.shadowserver.org/what-we-do/network-reporting/accessible-mikrot…" }

2 2

report.json, intelmq.json and types.md out of sync with Shadowserver feed offering?
by Mika Silander 02 Sep '26

02 Sep '26

Hi, Back from holidays I noticed that it looks like the following Shadowserver feeds have disappeared: population_bgp - https://www.shadowserver.org/what-we-do/network-reporting/accessible-bgp-se… population_ntrip - https://www.shadowserver.org/what-we-do/network-reporting/accessible-ntrip-… scan_imap_vulnerable - https://www.shadowserver.org/what-we-do/network-reporting/vulnerable-imap-r… scan_pop3_vulnerable - https://www.shadowserver.org/what-we-do/network-reporting/vulnerable-pop3-r… There are no foolproof exact matches when looking for replacements but these appears to come close: scan_bgp,scan6_bgp - https://www.shadowserver.org/what-we-do/network-reporting/open-bgp-service-… ??? - https://www.shadowserver.org/what-we-do/network-reporting/info-accessible-n… NB: this link is broken! scan_imap,scan6_imap - https://www.shadowserver.org/what-we-do/network-reporting/accessible-imap-r… scan_pop3,scan6_pop3 - https://www.shadowserver.org/what-we-do/network-reporting/accessible-pop3-r… Could someone with the proper rights please update report.json, intelmq.json and types.md under https://github.com/The-Shadowserver-Foundation/report_schema/ to fix the mismatch? And if I'm mistaken, please let me know why. Br and thank you, Mika The information in this email may be confidential and is intended solely for the use of the individual or entity to whom it is intended. If you are not the intended recipient of this message, please delete the message and notify the sender immediately. For information on how we process personal data and our contact information, please see CSC's website: Privacy<https://csc.fi/en/privacy> T?m?n s?hk?postin tiedot voivat olla luottamuksellisia ja ne on tarkoitettu yksinomaan sen henkil?n tai yhteis?n k?ytt??n, jolle ne on osoitettu. Jos et ole viestiss? tarkoitettu vastaanottaja, tuhoa viesti ja ilmoita asiasta v?litt?m?sti viestin l?hett?j?lle. Tietoja henkil?tietojen ja yhteystietojen k?sittelyst? l?yd?t CSC:n verkkosivuilta: Tietosuoja<https://csc.fi/tietosuoja>

2 4

Added Honeypot-SNMP-Scanner feed
by elsif 06 Aug '26

06 Aug '26

Hello, Below is the draft mapping for a new report as documented at https://www.shadowserver.org/what-we-do/network-reporting/honeypot-snmp-sca… Please let me know if you have any comments or suggestions. Regards, Jason { "constant_fields" : { "classification.identifier" : "honeypot-snmp-scan", "classification.taxonomy" : "information-gathering", "classification.type" : "scanner", "protocol.application" : "snmp" }, "feed_name" : "Honeypot-SNMP-Scanner", "file_name" : "event4_honeypot_snmp_scan", "optional_fields" : [ [ "malware.name", "infection", "validate_to_none" ], [ "extra.", "tag", "validate_to_none" ], [ "extra.", "family", "validate_to_none" ], [ "protocol.transport", "protocol" ], [ "source.asn", "src_asn", "invalidate_zero" ], [ "source.geolocation.cc", "src_geo" ], [ "source.geolocation.region", "src_region" ], [ "source.geolocation.city", "src_city" ], [ "source.reverse_dns", "src_hostname" ], [ "extra.source.naics", "src_naics", "invalidate_zero" ], [ "extra.source.sector", "src_sector", "validate_to_none" ], [ "product.vendor", "device_vendor", "validate_to_none" ], [ "extra.", "device_type", "validate_to_none" ], [ "product.name", "device_model", "validate_to_none" ], [ "severity", "severity", "validate_to_none" ], [ "destination.ip", "dst_ip", "validate_ip" ], [ "destination.port", "dst_port", "convert_int" ], [ "destination.asn", "dst_asn", "invalidate_zero" ], [ "destination.geolocation.cc", "dst_geo" ], [ "destination.geolocation.region", "dst_region" ], [ "destination.geolocation.city", "dst_city" ], [ "destination.reverse_dns", "dst_hostname", "validate_to_none" ], [ "extra.destination.naics", "dst_naics", "invalidate_zero" ], [ "extra.destination.sector", "dst_sector", "validate_to_none" ], [ "extra.", "public_source", "validate_to_none" ], [ "extra.", "application", "validate_to_none" ], [ "extra.", "version", "validate_to_none" ], [ "extra.", "event_id", "validate_to_none" ], [ "extra.", "vulnerability_enum", "validate_to_none" ], [ "product.vulnerabilities", "vulnerability_id", "validate_to_none" ], [ "extra.", "vulnerability_class", "validate_to_none" ], [ "extra.", "vulnerability_score", "convert_float" ], [ "extra.", "vulnerability_severity", "validate_to_none" ], [ "extra.", "vulnerability_version", "validate_to_none" ], [ "extra.", "threat_framework", "validate_to_none" ], [ "extra.", "threat_tactic_id", "validate_to_none" ], [ "extra.", "threat_technique_id", "validate_to_none" ], [ "extra.", "target_vendor", "validate_to_none" ], [ "extra.", "target_product", "validate_to_none" ], [ "extra.", "target_class", "validate_to_none" ], [ "extra.", "community", "validate_to_none" ], [ "extra.", "pdu_type", "validate_to_none" ] ], "required_fields" : [ [ "time.source", "timestamp", "add_UTC_to_timestamp" ], [ "source.ip", "src_ip", "validate_ip" ], [ "source.port", "src_port", "convert_int" ] ], "url" : "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-snmp-sca…" }

2 2

A few more optional fields to the Shadowserver Special feed (SocGholish this time around)?
by Mika Silander 25 Jun '26

25 Jun '26

Hi, The Special feed of Shadowserver was dedicated to reports on SocGholish Compromised WordPress sites a few days ago and https://github.com/The-Shadowserver-Foundation/report_schema/tree/main/inte… was updated accordingly. Today's reports contained a few more optional fields that were caught by our checker, namely, extra.account extra.estimated_server_first_seen_time, extra.estimated_server_last_seen_time extra.machine_name Will intelmq.json be updated to reflect this change? The two extra.estimated_* are probably thought of as replacements to the initial extra.first_seen_time and extra.last_seen_time. Maybe it would make sense to define a feed of its own for this instead of using Special. Especially if we expect to see remnant cases of SocGholish later. And if this is in fact a problem of our checker, my apologies, please let me know. There's so much hallucination going on these days so it would not be a surprise. Br, Mika The information in this email may be confidential and is intended solely for the use of the individual or entity to whom it is intended. If you are not the intended recipient of this message, please delete the message and notify the sender immediately. For information on how we process personal data and our contact information, please see CSC's website: Privacy<https://csc.fi/en/privacy> T?m?n s?hk?postin tiedot voivat olla luottamuksellisia ja ne on tarkoitettu yksinomaan sen henkil?n tai yhteis?n k?ytt??n, jolle ne on osoitettu. Jos et ole viestiss? tarkoitettu vastaanottaja, tuhoa viesti ja ilmoita asiasta v?litt?m?sti viestin l?hett?j?lle. Tietoja henkil?tietojen ja yhteystietojen k?sittelyst? l?yd?t CSC:n verkkosivuilta: Tietosuoja<https://csc.fi/tietosuoja>

2 1

Proposed mapping for Targeted Host
by elsif 23 Jun '26

23 Jun '26

Hello, Below is the draft mapping for a new report as documented at https://www.shadowserver.org/what-we-do/network-reporting/targeted-host-rep… Please let me know if you have any comments or suggestions. Regards, Jason { "constant_fields" : { "classification.identifier" : "targeted-host", "classification.taxonomy" : "other", "classification.type" : "system-compromise" }, "feed_name" : "Targeted-Host", "file_name" : "targeted_host", "optional_fields" : [ [ "malware.name", "family", "validate_to_none" ], [ "severity", "severity", "validate_to_none" ], [ "protocol.transport", "protocol" ], [ "source.port", "port", "convert_int" ], [ "source.reverse_dns", "hostname" ], [ "extra.", "tag" ], [ "source.asn", "asn", "invalidate_zero" ], [ "source.geolocation.cc", "geo" ], [ "source.geolocation.region", "region" ], [ "source.geolocation.city", "city" ], [ "extra.source.naics", "naics", "invalidate_zero" ], [ "extra.", "hostname_source", "validate_to_none" ], [ "extra.source.sector", "sector", "validate_to_none" ], [ "product.vendor", "device_vendor", "validate_to_none" ], [ "extra.", "device_type", "validate_to_none" ], [ "product.name", "device_model", "validate_to_none" ], [ "product.version", "device_version", "validate_to_none" ], [ "event_description.text", "category", "validate_to_none" ], [ "status", "status" ], [ "extra.", "detail", "validate_to_none" ], [ "extra.", "public_source", "validate_to_none" ], [ "extra.", "application", "validate_to_none" ] ], "required_fields" : [ [ "time.source", "timestamp", "add_UTC_to_timestamp" ], [ "source.ip", "ip", "validate_ip" ] ], "url" : "https://www.shadowserver.org/what-we-do/network-reporting/targeted-host-rep…" }

1 0

Proposed mapping for Initial Access Broker
by elsif 09 Jun '26

09 Jun '26

Hello, Below is the proposed mapping for a new report as documented at https://www.shadowserver.org/what-we-do/network-reporting/initial-access-br… Please let me know if you have any changes before June 15th. Regards, Jason { "constant_fields" : { "classification.taxonomy" : "malicious-code", "classification.type" : "infected-system" }, "feed_name" : "Initial-Access-Broker", "file_name" : "event4_initial_access_broker", "optional_fields" : [ [ "classification.identifier", "infection", "validate_to_none" ], [ "malware.name", "infection", "validate_to_none" ], [ "extra.", "tag", "validate_to_none" ], [ "extra.", "family", "validate_to_none" ], [ "protocol.transport", "protocol" ], [ "source.asn", "src_asn", "invalidate_zero" ], [ "source.geolocation.cc", "src_geo" ], [ "source.geolocation.region", "src_region" ], [ "source.geolocation.city", "src_city" ], [ "source.reverse_dns", "src_hostname" ], [ "extra.source.naics", "src_naics", "invalidate_zero" ], [ "extra.source.sector", "src_sector", "validate_to_none" ], [ "product.vendor", "device_vendor", "validate_to_none" ], [ "extra.", "device_type", "validate_to_none" ], [ "product.name", "device_model", "validate_to_none" ], [ "severity", "severity", "validate_to_none" ], [ "destination.ip", "dst_ip", "validate_ip" ], [ "destination.port", "dst_port", "convert_int" ], [ "destination.asn", "dst_asn", "invalidate_zero" ], [ "destination.geolocation.cc", "dst_geo" ], [ "destination.geolocation.region", "dst_region" ], [ "destination.geolocation.city", "dst_city" ], [ "destination.reverse_dns", "dst_hostname", "validate_to_none" ], [ "extra.destination.naics", "dst_naics", "invalidate_zero" ], [ "extra.destination.sector", "dst_sector", "validate_to_none" ], [ "extra.", "public_source", "validate_to_none" ], [ "extra.", "application", "validate_to_none" ], [ "extra.", "version", "validate_to_none" ], [ "extra.", "event_id", "validate_to_none" ], [ "source.account", "account", "validate_to_none" ], [ "extra.", "detail", "validate_to_none" ], [ "extra.", "org_domain", "validate_to_none" ], [ "extra.", "machine_name", "validate_to_none" ] ], "required_fields" : [ [ "time.source", "timestamp", "add_UTC_to_timestamp" ], [ "source.ip", "src_ip", "validate_ip" ] ], "url" : "https://www.shadowserver.org/what-we-do/network-reporting/initial-access-br…" }

3 3

Shadowserver IntelMQ schema / CVEs in Vulnerable ISAKMP report
by Thomas Hungenberg 05 Jan '26

05 Jan '26

Hi Jason, in the Vulnerable ISAKMP report, the field "tag" now can include (multiple) CVEs. For easier processing of CVEs, we already have [ "extra.cve", "tag", "extract_cve_from_tag" ] in the schema for reports like scan_http_vulnerable. Could you please add this to the schema for scan_isakmp and scan6_isakmp as well? Maybe at the end of the "optional fields" after [ "extra.", "amplification", "convert_float" ] Thanks, - Thomas

2 3

Example data for MS CTIP Interflow 'severity'
by Sebix 01 Dec '25

01 Dec '25

Dear all Does anyone receive data from Microsoft Interflow? It has a field called 'severity' which is currently mapped to the 'extra.severity' field: https://github.com/certtools/intelmq/blob/0342b7718050b1690d9e20f137b58c769… As in IntelMQ 3.5.0, we have a proper 'severity' field with standardized values; the CTIP parser should now use that one as well. However, what's unclear to me, without access to example data, is what possible values Microsoft uses, and thus whether we need to map their values to ours. So if you have any example data, please let us know what values they use :) Best regards Sebastian -- Institute for Common Good Technology gemeinnütziger Kulturverein - nonprofit cultural society https://commongoodtechnology.org/ ZVR 1510673578

2 3

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

IntelMQ-dev