For the sake of completeness:
On 1/31/24 16:05, Thomas Hungenberg wrote:
Sebastian (sebix) told me it was agreed that with the translation from the current parser _config.py (included with IntelMQ 3.2.1) to the new schema, no classification.* attributes will be changed.
I stated this based on https://docs.intelmq.org/latest/user/bots/#shadowserver
*Schema contract*
Once set in the schema, the |classification.identifier|, |classification.taxonomy|, and |classification.type| fields will remain static for a specific report.
The schema revision history is maintained at https://github.com/The-Shadowserver-Foundation/report_schema/.
which was a result of a discussion on the Pull Request (https://github.com/certtools/intelmq/pull/2372)
Thank you Thomas and elsif for analyzing and fixing the schema!
best regards