[IntelMQ-dev] Re: Shadowserver IntelMQ schema / CVEs in Vulnerable ISAKMP report

All of the scan reports would benefit from this addition.  I will publish an update today.

Thanks,

Jason

On 12/22/25 12:42 AM, Thomas Hungenberg wrote:

Hi Jason,

in the Vulnerable ISAKMP report, the field "tag" now can include (multiple) CVEs.

For easier processing of CVEs, we already have

[             "extra.cve",             "tag",             "extract_cve_from_tag"          ]

in the schema for reports like scan_http_vulnerable.

Could you please add this to the schema for scan_isakmp and scan6_isakmp as well? Maybe at the end of the "optional fields" after

[             "extra.",             "amplification",             "convert_float"          ]

Thanks,

- Thomas