Looks good to me, thanks for sharing!
Best regards
// Kamil Mańkowski mankowski@cert.at - T: +43 676 898 298 7204 // CERT Austria - https://www.cert.at/ // CERT.at GmbH, FB-Nr. 561772k, HG Wien
On 8/26/25 21:42, elsif via IntelMQ-dev wrote:
Hello,
Below is the proposed mapping for a new report as documented at https:// www.shadowserver.org/what-we-do/network-reporting/accessible-ntrip-report.
Please let me know if you have any changes before September 2nd.
Regards,
Jason
{ "constant_fields" : { "classification.identifier" : "accessible-ntrip", "classification.taxonomy" : "other", "classification.type" : "other", "protocol.application" : "ntrip" }, "feed_name" : "Accessible-NTRIP", "file_name" : "population_ntrip", "optional_fields" : [ [ "extra.", "authentication", "convert_bool" ], [ "extra.", "fee", "convert_bool" ], [ "extra.", "bit_rate", "convert_int" ], [ "extra.", "severity", "validate_to_none" ], [ "protocol.transport", "protocol" ], [ "source.reverse_dns", "hostname" ], [ "extra.", "tag" ], [ "source.asn", "asn", "invalidate_zero" ], [ "source.geolocation.cc", "geo" ], [ "source.geolocation.region", "region" ], [ "source.geolocation.city", "city" ], [ "extra.source.naics", "naics", "invalidate_zero" ], [ "extra.", "hostname_source", "validate_to_none" ], [ "extra.source.sector", "sector", "validate_to_none" ], [ "extra.", "ntrip", "validate_to_none" ], [ "extra.", "ntrip_code", "validate_to_none" ], [ "extra.", "ntrip_reason", "validate_to_none" ], [ "extra.", "content_type", "validate_to_none" ], [ "extra.", "connection", "validate_to_none" ], [ "extra.", "server", "validate_to_none" ], [ "extra.", "content_length", "convert_int" ], [ "extra.", "ntrip_version", "validate_to_none" ], [ "extra.", "ntrip_date", "validate_to_none" ], [ "extra.", "ntrip_type", "validate_to_none" ], [ "extra.", "mount_point", "validate_to_none" ], [ "extra.", "identifier", "validate_to_none" ], [ "extra.", "format", "validate_to_none" ], [ "extra.", "format_details", "validate_to_none" ], [ "extra.", "carrier", "validate_to_none" ], [ "extra.", "nav_system", "validate_to_none" ], [ "extra.", "network", "validate_to_none" ], [ "extra.", "ntrip_country", "validate_to_none" ], [ "extra.", "ntrip_latitude", "validate_to_none" ], [ "extra.", "ntrip_longitude", "validate_to_none" ], [ "extra.", "nmea", "validate_to_none" ], [ "extra.", "solution", "validate_to_none" ], [ "extra.", "generator", "validate_to_none" ], [ "extra.", "compression", "validate_to_none" ], [ "extra.", "misc", "validate_to_none" ], [ "extra.", "header_base64", "validate_to_none" ], [ "extra.", "body_base64", "validate_to_none" ] ], "required_fields" : [ [ "time.source", "timestamp", "add_UTC_to_timestamp" ], [ "source.ip", "ip", "validate_ip" ], [ "source.port", "port", "convert_int" ] ], "url" : "https://www.shadowserver.org/what-we-do/network-reporting/ accessible-ntrip-report" } _______________________________________________ IntelMQ-dev mailing list -- intelmq-dev@lists.cert.at To unsubscribe send an email to intelmq-dev-leave@lists.cert.at