Hello,
Below is the proposed mapping for a new report as documented at
Please let me know if you have any changes before September 13th.
Regards,
Jason
{
"constant_fields" : {
"classification.identifier" : "badsecret",
"classification.taxonomy" : "vulnerable",
"classification.type" : "vulnerable-system",
"protocol.application" : "http"
},
"feed_name" : "IPv6-Badsecrets",
"file_name" : "scan6_badsecrets",
"optional_fields" : [
[
"extra.",
"severity",
"validate_to_none"
],
[
"protocol.transport",
"protocol"
],
[
"source.reverse_dns",
"hostname"
],
[
"extra.",
"tag"
],
[
"source.asn",
"asn",
"invalidate_zero"
],
[
"source.geolocation.cc",
"geo"
],
[
"source.geolocation.region",
"region"
],
[
"source.geolocation.city",
"city"
],
[
"extra.source.naics",
"naics",
"invalidate_zero"
],
[
"extra.",
"hostname_source",
"validate_to_none"
],
[
"extra.source.sector",
"sector",
"validate_to_none"
],
[
"extra.",
"badsecret_location",
"validate_to_none"
],
[
"extra.",
"badsecret_module",
"validate_to_none"
],
[
"extra.",
"badsecret_type",
"validate_to_none"
],
[
"extra.",
"badsecret_product",
"validate_to_none"
],
[
"extra.",
"http",
"validate_to_none"
],
[
"extra.",
"http_code",
"convert_int"
],
[
"extra.",
"server",
"validate_to_none"
],
[
"extra.",
"request_path",
"validate_to_none"
],
[
"extra.",
"cert_serial_number",
"validate_to_none"
],
[
"extra.",
"subject_common_name",
"validate_to_none"
],
[
"extra.",
"issuer_common_name",
"validate_to_none"
],
[
"extra.",
"subject_organization_name",
"validate_to_none"
],
[
"extra.",
"issuer_organization_name",
"validate_to_none"
],
[
"extra.",
"sha1_fingerprint",
"validate_to_none"
],
[
"extra.",
"sha256_fingerprint",
"validate_to_none"
]
],
"required_fields" : [
[
"time.source",
"timestamp",
"add_UTC_to_timestamp"
],
[
"source.ip",
"ip",
"validate_ip"
],
[
"source.port",
"port",
"convert_int"
]
],
"url" :
"https://www.shadowserver.org/what-we-do/network-reporting/badsecrets-report/"
}
{
"constant_fields" : {
"classification.identifier" : "badsecret",
"classification.taxonomy" : "vulnerable",
"classification.type" : "vulnerable-system",
"protocol.application" : "http"
},
"feed_name" : "Badsecrets",
"file_name" : "scan_badsecrets",
"optional_fields" : [
[
"extra.",
"severity",
"validate_to_none"
],
[
"protocol.transport",
"protocol"
],
[
"source.reverse_dns",
"hostname"
],
[
"extra.",
"tag",
"validate_to_none"
],
[
"source.asn",
"asn",
"invalidate_zero"
],
[
"source.geolocation.cc",
"geo"
],
[
"source.geolocation.region",
"region"
],
[
"source.geolocation.city",
"city"
],
[
"extra.source.naics",
"naics",
"invalidate_zero"
],
[
"extra.",
"hostname_source",
"validate_to_none"
],
[
"extra.source.sector",
"sector",
"validate_to_none"
],
[
"extra.",
"badsecret_location",
"validate_to_none"
],
[
"extra.",
"badsecret_module",
"validate_to_none"
],
[
"extra.",
"badsecret_type",
"validate_to_none"
],
[
"extra.",
"badsecret_product",
"validate_to_none"
],
[
"extra.",
"http",
"validate_to_none"
],
[
"extra.",
"http_code",
"convert_int"
],
[
"extra.",
"server",
"validate_to_none"
],
[
"extra.",
"request_path",
"validate_to_none"
],
[
"extra.",
"cert_serial_number",
"validate_to_none"
],
[
"extra.",
"subject_common_name",
"validate_to_none"
],
[
"extra.",
"issuer_common_name",
"validate_to_none"
],
[
"extra.",
"subject_organization_name",
"validate_to_none"
],
[
"extra.",
"issuer_organization_name",
"validate_to_none"
],
[
"extra.",
"sha1_fingerprint",
"validate_to_none"
],
[
"extra.",
"sha256_fingerprint",
"validate_to_none"
]
],
"required_fields" : [
[
"time.source",
"timestamp",
"add_UTC_to_timestamp"
],
[
"source.ip",
"ip",
"validate_ip"
],
[
"source.port",
"port",
"convert_int"
]
],
"url" :
"https://www.shadowserver.org/what-we-do/network-reporting/badsecrets-report/"
}