Hello,
The http_agent field will be mapped to extra.user_agent in the DDoS-Participant, Honeypot-DDoS, Microsoft-Sinkhole-Events-HTTP, and Sinkhole-Events-HTTP feeds.
I will schedule the update for October 28th.
Regards,
Jason
On 10/20/26 1:12 AM, Thomas Hungenberg via IntelMQ-dev wrote:
Hi all,
some Shadowserver reports include information on the User-Agent in "http_agent" which is mapped to "extra.http_agent" by the IntelMQ schema, e.g.
event4_sinkhole_http
[ "extra.", "http_agent", "validate_to_none" ],
For other reports, the value of "http_agent" is mapped to "extra.user_agent":
event_honeypot_http_scan
[ "extra.user_agent", "http_agent", "validate_to_none" ],
Other reports already include the information in "user_agent" which is mapped to "extra.user_agent" as well:
sandbox_url
[ "extra.", "user_agent", "validate_to_none" ],
I'd like to propose harmonizing this by mapping the User-Agent information to "extra.user_agent" for all reports.
What do you think?
- Thomas
IntelMQ-dev mailing list -- intelmq-dev@lists.cert.at To unsubscribe send an email to intelmq-dev-leave@lists.cert.at