Hi Jason,
It would be nice to have this version field documented in the affected feeds on the Shadowserver feed info pages (under
https://www.shadowserver.org/what-we-do/network-reporting). There are many feeds that do have a device_version/product_version documented, but if this new version field appears alongside in the alerts, it can be quite confusing to our clients. Among them,
the level of skills and expertise vary a lot.
E.g., a sample of our today's Accessible Rsync report contained:
"extra.version": "33.0 sha512 sha256 sha1 md5 md4"
I'm a bit reluctant to send this out to our clients since I can only give an educated guess on what the hash algorithm abbreviations in the list mean in the context of the version number.
Br, Mika
From: elsif via IntelMQ-dev <intelmq-dev@lists.cert.at>
Sent: Thursday, 29 October 2026 20.51
To: Developer mailing list for intelmq: https://github.com/certtools/intelmq <intelmq-dev@lists.cert.at>
Subject: [IntelMQ-dev] Shadowserver IntelMQ schema - version field additions
Hello,
A version field has been added to a number of scan feeds. Please note
that in most cases the version field will be different from the
device_version/product.version.
The version field will list technologies identified by a version present
in the product stack. This may reflect the device_version but have
multiple technologies identified in addition. For example, PHP version
or Apache version such as "apache:1.3.41;php:4.4.9".
Regards,
Jason
_______________________________________________
IntelMQ-dev mailing list -- intelmq-dev@lists.cert.at
To unsubscribe send an email to intelmq-dev-leave@lists.cert.at
The information in this email may be confidential and is intended solely for the use of the individual or entity to whom it is intended. If you are not the intended recipient of this message, please delete the message and notify the sender immediately.
For information on how we process personal data and our contact information, please see CSC's website:
Privacy
Tämän sähköpostin tiedot voivat olla luottamuksellisia ja ne on tarkoitettu yksinomaan sen henkilön tai yhteisön käyttöön, jolle ne on osoitettu. Jos et ole viestissä tarkoitettu vastaanottaja, tuhoa viesti ja ilmoita asiasta välittömästi viestin lähettäjälle.
Tietoja henkilötietojen ja yhteystietojen käsittelystä löydät CSC:n verkkosivuilta:
Tietosuoja