I can schedule the change for a specific date.

On 10/20/26 2:18 AM, L. Aaron Kaplan via IntelMQ-dev wrote:

Sounds good. What about existing scripts which already parse the fields as they currently are? Will they break? how to migrate this change ?

...

On 20.10.2026, at 10:12, Thomas Hungenberg via IntelMQ-dev intelmq-dev@lists.cert.at wrote:

Hi all,

some Shadowserver reports include information on the User-Agent in "http_agent" which is mapped to "extra.http_agent" by the IntelMQ schema, e.g.

event4_sinkhole_http

     [
        "extra.",
        "http_agent",
        "validate_to_none"
     ],

For other reports, the value of "http_agent" is mapped to "extra.user_agent":

event_honeypot_http_scan

     [
        "extra.user_agent",
        "http_agent",
        "validate_to_none"
     ],

Other reports already include the information in "user_agent" which is mapped to "extra.user_agent" as well:

sandbox_url

     [
        "extra.",
        "user_agent",
        "validate_to_none"
     ],

I'd like to propose harmonizing this by mapping the User-Agent information to "extra.user_agent" for all reports.

What do you think?

- Thomas

---

IntelMQ-dev mailing list -- intelmq-dev@lists.cert.at To unsubscribe send an email to intelmq-dev-leave@lists.cert.at

---

IntelMQ-dev mailing list -- intelmq-dev@lists.cert.at To unsubscribe send an email to intelmq-dev-leave@lists.cert.at

Excellent, thanks very much!

- Thomas

On 21.10.26 17:00, elsif via IntelMQ-dev wrote:

Hello,

The http_agent field will be mapped to extra.user_agent in the DDoS-Participant, Honeypot-DDoS, Microsoft-Sinkhole-Events-HTTP, and Sinkhole-Events- HTTP feeds.

I will schedule the update for October 28th.

Regards,

Jason

On 10/20/26 1:12 AM, Thomas Hungenberg via IntelMQ-dev wrote:

...

Hi all,

some Shadowserver reports include information on the User-Agent in "http_agent" which is mapped to "extra.http_agent" by the IntelMQ schema, e.g.

event4_sinkhole_http

[             "extra.",             "http_agent",             "validate_to_none"          ],

For other reports, the value of "http_agent" is mapped to "extra.user_agent":

event_honeypot_http_scan

[             "extra.user_agent",             "http_agent",             "validate_to_none"          ],

Other reports already include the information in "user_agent" which is mapped to "extra.user_agent" as well:

sandbox_url

[             "extra.",             "user_agent",             "validate_to_none"          ],

I'd like to propose harmonizing this by mapping the User-Agent information to "extra.user_agent" for all reports.

What do you think?

- Thomas

---

IntelMQ-dev mailing list -- intelmq-dev@lists.cert.at To unsubscribe send an email to intelmq-dev-leave@lists.cert.at

---

IntelMQ-dev mailing list -- intelmq-dev@lists.cert.at To unsubscribe send an email to intelmq-dev-leave@lists.cert.at