On 30/10/2026 11:19, Mika Silander via IntelMQ-dev wrote:
E.g., a sample of our today's Accessible Rsync report contained:
"extra.version": "33.0 sha512 sha256 sha1 md5 md4"
I'm a bit reluctant to send this out to our clients since I can only give an educated guess on what the hash algorithm abbreviations in the list mean in the context of the version number.
Thanks for sharing the example data.
I'm also sceptical about it, particularly the wording. 'Version' can have various meanings, so it's unclear what it refers to here. For example, 'version' could refer to the data format or the version of the IoC event. Why not call it 'application_version'? This would be similar to the convention of application_protocol/transport_protocol.
Sebastian