Hi,
It looks to me there's been a small rename of a feed in the Shadowserver offering: Accessible-MS-RPC-Endpoint-Mapper is now Accessible-MS-RPC-Service and the following changes are needed to https://github.com/The-Shadowserver-Foundation/report_schema/reports.json :
- "name" : "Accessible-MS-RPC-Endpoint-Mapper", - "url" : "https://www.shadowserver.org/what-we-do/network-reporting/ms-rpc-endpoint-ma..." + "name" : "Accessible-MS-RPC-Service", + "url" : "https://www.shadowserver.org/what-we-do/network-reporting/accessible-ms-rpc-..."
and intelmq.json :
- "feed_name" : "Accessible-MS-RPC-Endpoint-Mapper", + "feed_name" : "Accessible-MS-RPC-Service", "file_name" : "scan_msrpc", "optional_fields" : [ [ @@ -22247,7 +22247,7 @@ "convert_int" ] ], - "url" : "https://www.shadowserver.org/what-we-do/network-reporting/ms-rpc-endpoint-ma..." + "url" : "https://www.shadowserver.org/what-we-do/network-reporting/accessible-ms-rpc-..."
The field names within appear unchanged.
Br, Mika
Hello,
The updates for these changes are included in IEP010:
https://github.com/elsif2/ieps/blob/main/010/README.md
Regards, Jason
On 1/22/25 5:24 AM, Mika Silander via IntelMQ-dev wrote:
Hi,
It looks to me there's been a small rename of a feed in the Shadowserver offering: Accessible-MS-RPC-Endpoint-Mapper is now Accessible-MS-RPC-Service and the following changes are needed to https://github.com/The-Shadowserver-Foundation/report_schema/reports.json :
"name" : "Accessible-MS-RPC-Endpoint-Mapper","url" : "https://www.shadowserver.org/what-we-do/network-reporting/ms-rpc-endpoint-mapper-report"
"name" : "Accessible-MS-RPC-Service","url" : "https://www.shadowserver.org/what-we-do/network-reporting/accessible-ms-rpc-service-report"and intelmq.json :
"feed_name" : "Accessible-MS-RPC-Endpoint-Mapper",
"feed_name" : "Accessible-MS-RPC-Service", "file_name" : "scan_msrpc", "optional_fields" : [ [@@ -22247,7 +22247,7 @@ "convert_int" ] ],
"url" : "https://www.shadowserver.org/what-we-do/network-reporting/ms-rpc-endpoint-mapper-report"
"url" : "https://www.shadowserver.org/what-we-do/network-reporting/accessible-ms-rpc-service-report"The field names within appear unchanged.
Br, Mika _______________________________________________ IntelMQ-dev mailing list -- intelmq-dev@lists.cert.at To unsubscribe send an email to intelmq-dev-leave@lists.cert.at
Good! I'm rushing ahead :-)
Br, Mika
----- Original Message ----- From: "elsif via IntelMQ-dev" intelmq-dev@lists.cert.at To: "Mika Silander via IntelMQ-dev" intelmq-dev@lists.cert.at Cc: "elsif" elsif@shadowserver.org Sent: Wednesday, 22 January, 2025 16:46:08 Subject: [IntelMQ-dev] Re: Shadowserver Accessible-MS-RPC-Endpoint-Mapper renamed to Accessible-MS-RPC-Service
Hello,
The updates for these changes are included in IEP010:
https://github.com/elsif2/ieps/blob/main/010/README.md
Regards, Jason
On 1/22/25 5:24 AM, Mika Silander via IntelMQ-dev wrote:
Hi,
It looks to me there's been a small rename of a feed in the Shadowserver offering: Accessible-MS-RPC-Endpoint-Mapper is now Accessible-MS-RPC-Service and the following changes are needed to https://github.com/The-Shadowserver-Foundation/report_schema/reports.json :
"name" : "Accessible-MS-RPC-Endpoint-Mapper","url" : "https://www.shadowserver.org/what-we-do/network-reporting/ms-rpc-endpoint-mapper-report"
"name" : "Accessible-MS-RPC-Service","url" : "https://www.shadowserver.org/what-we-do/network-reporting/accessible-ms-rpc-service-report"and intelmq.json :
"feed_name" : "Accessible-MS-RPC-Endpoint-Mapper",
"feed_name" : "Accessible-MS-RPC-Service", "file_name" : "scan_msrpc", "optional_fields" : [ [@@ -22247,7 +22247,7 @@ "convert_int" ] ],
"url" : "https://www.shadowserver.org/what-we-do/network-reporting/ms-rpc-endpoint-mapper-report"
"url" : "https://www.shadowserver.org/what-we-do/network-reporting/accessible-ms-rpc-service-report"The field names within appear unchanged.
Br, Mika _______________________________________________ IntelMQ-dev mailing list -- intelmq-dev@lists.cert.at To unsubscribe send an email to intelmq-dev-leave@lists.cert.at
_______________________________________________ IntelMQ-dev mailing list -- intelmq-dev@lists.cert.at To unsubscribe send an email to intelmq-dev-leave@lists.cert.at