I can schedule the change for a specific date.
On 10/20/26 2:18 AM, L. Aaron Kaplan via IntelMQ-dev wrote:
Sounds good. What about existing scripts which already parse the fields as they currently are? Will they break? how to migrate this change ?
On 20.10.2026, at 10:12, Thomas Hungenberg via IntelMQ-dev intelmq-dev@lists.cert.at wrote:
Hi all,
some Shadowserver reports include information on the User-Agent in "http_agent" which is mapped to "extra.http_agent" by the IntelMQ schema, e.g.
event4_sinkhole_http
[ "extra.", "http_agent", "validate_to_none" ],For other reports, the value of "http_agent" is mapped to "extra.user_agent":
event_honeypot_http_scan
[ "extra.user_agent", "http_agent", "validate_to_none" ],Other reports already include the information in "user_agent" which is mapped to "extra.user_agent" as well:
sandbox_url
[ "extra.", "user_agent", "validate_to_none" ],I'd like to propose harmonizing this by mapping the User-Agent information to "extra.user_agent" for all reports.
What do you think?
- Thomas
IntelMQ-dev mailing list -- intelmq-dev@lists.cert.at To unsubscribe send an email to intelmq-dev-leave@lists.cert.at
IntelMQ-dev mailing list -- intelmq-dev@lists.cert.at To unsubscribe send an email to intelmq-dev-leave@lists.cert.at