Hi Jason,
It would be nice to have this version field documented in the affected feeds on the Shadowserver feed info pages (under https://www.shadowserver.org/what-we-do/network-reporting). There are many feeds that do have a device_version/product_version documented, but if this new version field appears alongside in the alerts, it can be quite confusing to our clients. Among them, the level of skills and expertise vary a lot.
E.g., a sample of our today's Accessible Rsync report contained:
"extra.version": "33.0 sha512 sha256 sha1 md5 md4"
I'm a bit reluctant to send this out to our clients since I can only give an educated guess on what the hash algorithm abbreviations in the list mean in the context of the version number.
Br, Mika
________________________________ From: elsif via IntelMQ-dev intelmq-dev@lists.cert.at Sent: Thursday, 29 October 2026 20.51 To: Developer mailing list for intelmq: https://github.com/certtools/intelmq intelmq-dev@lists.cert.at Subject: [IntelMQ-dev] Shadowserver IntelMQ schema - version field additions
Hello,
A version field has been added to a number of scan feeds. Please note that in most cases the version field will be different from the device_version/product.version.
The version field will list technologies identified by a version present in the product stack. This may reflect the device_version but have multiple technologies identified in addition. For example, PHP version or Apache version such as "apache:1.3.41;php:4.4.9".
Regards,
Jason
_______________________________________________ IntelMQ-dev mailing list -- intelmq-dev@lists.cert.at To unsubscribe send an email to intelmq-dev-leave@lists.cert.at
The information in this email may be confidential and is intended solely for the use of the individual or entity to whom it is intended. If you are not the intended recipient of this message, please delete the message and notify the sender immediately. For information on how we process personal data and our contact information, please see CSC's website: Privacyhttps://csc.fi/en/privacy
T?m?n s?hk?postin tiedot voivat olla luottamuksellisia ja ne on tarkoitettu yksinomaan sen henkil?n tai yhteis?n k?ytt??n, jolle ne on osoitettu. Jos et ole viestiss? tarkoitettu vastaanottaja, tuhoa viesti ja ilmoita asiasta v?litt?m?sti viestin l?hett?j?lle. Tietoja henkil?tietojen ja yhteystietojen k?sittelyst? l?yd?t CSC:n verkkosivuilta: Tietosuojahttps://csc.fi/tietosuoja