Severity field in IDF #2575
Severity field in IDF #2575
Conversation
|
Upgrade function in |
|
@sebix What would you like to add to |
|
@aaronkaplan Do you want to review this before merging? |
Severity is expected in IntelMQ for a long time and partially, it's already used by e.g. ShadowServer reports. This implementation is based on their understanding of the field, but with explicit mentioning that operators could adjust it based on their knowledge. This is not intended to be an ultimate severity classification, but a help for first triage of recived events. Close certtools#2365
Co-authored-by: Sebastian <sebix@sebix.at>
|
Rebased on develop, but the version numbers in the upgrade function makes no sense |
|
okay, @sebix would it be a disaster if we leave the ver numbers now as is and merge? |
kind of, yes. the version numbers are used by the upgrade function in intelmqctl, which writes the numbering and function names to the state file. leaving wrong numbers where would lead to confusion in the support and when debugging stuff |
|
@aaronkaplan this PR is waiting for your approval |
Severity is expected in IntelMQ for a long time and partially, it's already used by e.g. ShadowServer reports. This implementation is based on their understanding of the field, but with explicit mentioning that operators could adjust it based on their knowledge.
This is not intended to be an ultimate severity classification, but a help for first triage of received events.
As the topic has already been discussed in #2365, I do not open a separated IEP for that. The discussion didn't have a clear outcome, but since then the severity information from Shadowserver has already been implemented and is in use by at least some IntelMQ instances. Implementing it in the default IDF helps wider adoption and prioritisation.
Compatibility: as no bot uses the field by default at the moment, there is no incompatibility risk if the local operator uses modified IDF schema or stores all data in e.g. SQL database. To prevent issues, until the next major release the official bots using the field should fall back to
extra.<field name>if the field does not exist in the local IDF.Close #2365