Hi all,
some Shadowserver reports include information on the User-Agent in "http_agent" which is mapped to "extra.http_agent" by the IntelMQ schema, e.g.
event4_sinkhole_http
[ "extra.", "http_agent", "validate_to_none" ],
For other reports, the value of "http_agent" is mapped to "extra.user_agent":
event_honeypot_http_scan
[ "extra.user_agent", "http_agent", "validate_to_none" ],
Other reports already include the information in "user_agent" which is mapped to "extra.user_agent" as well:
sandbox_url
[ "extra.", "user_agent", "validate_to_none" ],
I'd like to propose harmonizing this by mapping the User-Agent information to "extra.user_agent" for all reports.
What do you think?
- Thomas