Severity field in IDF #2575
Open
Severity field in IDF #2575
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
sebix
requested changes
Mar 3, 2025
|
Upgrade function in |
sebix
requested changes
Apr 3, 2025
Severity is expected in IntelMQ for a long time and partially, it's already used by e.g. ShadowServer reports. This implementation is based on their understanding of the field, but with explicit mentioning that operators could adjust it based on their knowledge. This is not intended to be an ultimate severity classification, but a help for first triage of recived events. Close certtools#2365
Co-authored-by: Sebastian <sebix@sebix.at>
|
@sebix What would you like to add to |
|
@aaronkaplan Do you want to review this before merging? |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Severity is expected in IntelMQ for a long time and partially, it's already used by e.g. ShadowServer reports. This implementation is based on their understanding of the field, but with explicit mentioning that operators could adjust it based on their knowledge.
This is not intended to be an ultimate severity classification, but a help for first triage of received events.
As the topic has already been discussed in #2365, I do not open a separated IEP for that. The discussion didn't have a clear outcome, but since then the severity information from Shadowserver has already been implemented and is in use by at least some IntelMQ instances. Implementing it in the default IDF helps wider adoption and prioritisation.
Compatibility: as no bot uses the field by default at the moment, there is no incompatibility risk if the local operator uses modified IDF schema or stores all data in e.g. SQL database. To prevent issues, until the next major release the official bots using the field should fall back to
extra.<field name>if the field does not exist in the local IDF.Close #2365