Based on the documentation:
"The [major].[minor] version of the MSRPC protocol",
do maybe let's call it "extra.msrpc_version"?
Best regards
// Kamil Mańkowski mankowski@cert.at - T: +43 676 898 298 7204 // CERT Austria - https://www.cert.at/ // CERT.at GmbH, FB-Nr. 561772k, HG Wien
On 12/3/24 09:33, Sebix wrote:
Good morning
On 12/2/24 8:36 PM, elsif wrote:
[ "extra.", "version", "validate_to_none" ],
What "version" is this?
The version of the event specification? The version of the feed? The server version of RPC? The RPC protocol version?
If I'd read just "extra.version" in the event data either as data receiver or operator, I'd have no idea what version is meant here.
best regards Sebastian