Hi,
I agree with Thomas that the classification should describe content and not the source (IPv4 vs IPv6).
Based on this I also noticed something else regarding the schema: I believe all the Accessible-SERVICE feeds classified as "vulnerable-system" should be actually classified as "potentially-unwanted-accessible". They are not vulnerable per se, they are just exposing a service to the internet which is usually exposed by mistake.
Best regards,
Filip Pokorný CSIRT.CZ
On 1/31/24 16:05, Thomas Hungenberg via IntelMQ-dev wrote:
Hi,
Sebastian (sebix) told me it was agreed that with the translation from the current parser _config.py (included with IntelMQ 3.2.1) to the new schema, no classification.* attributes will be changed.
This is very important as our setup (and most probably others as well) heavily depends on known classification identifiers like "open-rdp" and classification types from the initial parsing of events up to notification_rules and formats/templates for mailgen. So with a change of a classification attribute lots of scripts and configs would need to be changed as well.
Looking at the current schema, I see the classification identifiers are still correct for some feeds for both IPv4 and IPv6 like here:
"scan_dns" : { "constant_fields" : { "classification.identifier" : "dns-open-resolver",
"scan6_dns" : { "constant_fields" : { "classification.identifier" : "dns-open-resolver",
However, for other feeds the classification identifier has been kept correctly for IPv4 like here:
"scan_rdp" : { "constant_fields" : { "classification.identifier" : "open-rdp",
"compromised_website" : { "constant_fields" : { "classification.identifier" : "compromised-website",
but for IPv6 it has changed to the name of the feed:
"scan6_rdp" : { "constant_fields" : { "classification.identifier" : "scan6-rdp", <- should be "open-rdp"
"compromised_website6" : { "constant_fields" : { "classification.identifier" : "compromised-website6", <- should be "compromised-website"
The classification.identifier should describe the incident (like "open-rdp") and not the source (like "scan6-rdp").
May I ask you to check and adjust all classification identifiers and types in the schema so they are consistent with the ones generated by the current _config.py?
Thanks a lot for all your work on the new schema based parser!
Kind regards Thomas
IntelMQ-dev mailing list https://lists.cert.at/cgi-bin/mailman/listinfo/intelmq-dev https://intelmq.readthedocs.io/