Skip to content

Commit f9ff4c1

Browse files
monoidicWagner
monoidic
authored and
Wagner
committed
DOC: Document new supported Dataplane feeds
1 parent 9e14dc2 commit f9ff4c1

File tree

1 file changed

+174
-8
lines changed

1 file changed

+174
-8
lines changed

‎intelmq/etc/feeds.yaml‎

Lines changed: 174 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -453,15 +453,15 @@ providers:
453453
collector:
454454
module: intelmq.bots.collectors.http.collector_http
455455
parameters:
456-
http_url: http://dataplane.org/sshclient.txt
456+
http_url: https://dataplane.org/sshclient.txt
457457
rate_limit: 3600
458458
name: __FEED__
459459
provider: __PROVIDER__
460460
parser:
461461
module: intelmq.bots.parsers.dataplane.parser
462462
parameters:
463463
revision: 2018-01-20
464-
documentation: http://dataplane.org/
464+
documentation: https://dataplane.org/
465465
public: true
466466
SSH Password Authentication:
467467
description: Entries below consist of fields with identifying characteristics
@@ -474,15 +474,15 @@ providers:
474474
collector:
475475
module: intelmq.bots.collectors.http.collector_http
476476
parameters:
477-
http_url: http://dataplane.org/sshpwauth.txt
477+
http_url: https://dataplane.org/sshpwauth.txt
478478
rate_limit: 3600
479479
name: __FEED__
480480
provider: __PROVIDER__
481481
parser:
482482
module: intelmq.bots.parsers.dataplane.parser
483483
parameters:
484484
revision: 2018-01-20
485-
documentation: http://dataplane.org/
485+
documentation: https://dataplane.org/
486486
public: true
487487
SIP Query:
488488
description: Entries consist of fields with identifying characteristics of a
@@ -495,15 +495,15 @@ providers:
495495
collector:
496496
module: intelmq.bots.collectors.http.collector_http
497497
parameters:
498-
http_url: http://dataplane.org/sipquery.txt
498+
http_url: https://dataplane.org/sipquery.txt
499499
rate_limit: 3600
500500
name: __FEED__
501501
provider: __PROVIDER__
502502
parser:
503503
module: intelmq.bots.parsers.dataplane.parser
504504
parameters:
505505
revision: 2018-01-20
506-
documentation: http://dataplane.org/
506+
documentation: https://dataplane.org/
507507
public: true
508508
SIP Registration:
509509
description: Entries consist of fields with identifying characteristics of a
@@ -516,15 +516,181 @@ providers:
516516
collector:
517517
module: intelmq.bots.collectors.http.collector_http
518518
parameters:
519-
http_url: http://dataplane.org/sipregistration.txt
519+
http_url: https://dataplane.org/sipregistration.txt
520520
rate_limit: 3600
521521
name: __FEED__
522522
provider: __PROVIDER__
523523
parser:
524524
module: intelmq.bots.parsers.dataplane.parser
525525
parameters:
526526
revision: 2018-01-20
527-
documentation: http://dataplane.org/
527+
documentation: https://dataplane.org/
528+
public: true
529+
DNS Recursion Desired:
530+
description: Entries consist of fields with identifying characteristics of a
531+
source IP address that has been seen performing a DNS recursion desired query
532+
to a remote host. This report lists hosts that are suspicious of more than just
533+
port scanning. The host may be DNS server cataloging or searching for hosts
534+
to use for DNS-based DDoS amplification.
535+
additional_information:
536+
bots:
537+
collector:
538+
module: intelmq.bots.collectors.http.collector_http
539+
parameters:
540+
http_url: https://dataplane.org/dnsrd.txt
541+
rate_limit: 3600
542+
name: __FEED__
543+
provider: __PROVIDER__
544+
parser:
545+
module: intelmq.bots.parsers.dataplane.parser
546+
parameters:
547+
revision: 2021-09-09
548+
documentation: https://dataplane.org/
549+
public: true
550+
DNS Recursion Desired ANY:
551+
description: Entries consist of fields with identifying characteristics of a
552+
source IP address that has been seen performing a DNS recursion desired IN ANY query
553+
to a remote host. This report lists hosts that are suspicious of more than just
554+
port scanning. The host may be DNS server cataloging or searching for hosts
555+
to use for DNS-based DDoS amplification.
556+
additional_information:
557+
bots:
558+
collector:
559+
module: intelmq.bots.collectors.http.collector_http
560+
parameters:
561+
http_url: https://dataplane.org/dnsrdany.txt
562+
rate_limit: 3600
563+
name: __FEED__
564+
provider: __PROVIDER__
565+
parser:
566+
module: intelmq.bots.parsers.dataplane.parser
567+
parameters:
568+
revision: 2021-09-09
569+
documentation: https://dataplane.org/
570+
public: true
571+
DNS Version:
572+
description: Entries consist of fields with identifying characteristics of a
573+
source IP address that has been seen performing a DNS CH TXT version.bind query
574+
to a remote host. This report lists hosts that are suspicious of more than just
575+
port scanning. The host may be DNS server cataloging or searching for vulnerable
576+
DNS servers.
577+
additional_information:
578+
bots:
579+
collector:
580+
module: intelmq.bots.collectors.http.collector_http
581+
parameters:
582+
http_url: https://dataplane.org/dnsversion.txt
583+
rate_limit: 3600
584+
name: __FEED__
585+
provider: __PROVIDER__
586+
parser:
587+
module: intelmq.bots.parsers.dataplane.parser
588+
parameters:
589+
revision: 2021-09-09
590+
documentation: https://dataplane.org/
591+
public: true
592+
Protocol 41:
593+
description: Entries consist of fields with identifying characteristics of a
594+
host that has been detected to offer open IPv6 over IPv4 tunneling.
595+
This could allow for the host to be used a public proxy against IPv6 hosts.
596+
additional_information:
597+
bots:
598+
collector:
599+
module: intelmq.bots.collectors.http.collector_http
600+
parameters:
601+
http_url: https://dataplane.org/proto41.txt
602+
rate_limit: 3600
603+
name: __FEED__
604+
provider: __PROVIDER__
605+
parser:
606+
module: intelmq.bots.parsers.dataplane.parser
607+
parameters:
608+
revision: 2021-09-09
609+
documentation: https://dataplane.org/
610+
public: true
611+
SMTP Greet:
612+
description: Entries consist of fields with identifying characteristics of a
613+
host that has been seen initiating a SMTP HELO/EHLO operation to a remote host.
614+
The source report lists hosts that are suspicious of more than just port
615+
scanning. The host may be SMTP server cataloging or conducting various forms
616+
of email abuse.
617+
additional_information:
618+
bots:
619+
collector:
620+
module: intelmq.bots.collectors.http.collector_http
621+
parameters:
622+
http_url: https://dataplane.org/smtpgreet.txt
623+
rate_limit: 3600
624+
name: __FEED__
625+
provider: __PROVIDER__
626+
parser:
627+
module: intelmq.bots.parsers.dataplane.parser
628+
parameters:
629+
revision: 2021-09-09
630+
documentation: https://dataplane.org/
631+
public: true
632+
SMTP Data:
633+
description: Entries consist of fields with identifying characteristics of a
634+
host that has been seen initiating a SMTP DATA operation to a remote host.
635+
The source report lists hosts that are suspicious of more than just port
636+
scanning. The host may be SMTP server cataloging or conducting various forms
637+
of email abuse.
638+
additional_information:
639+
bots:
640+
collector:
641+
module: intelmq.bots.collectors.http.collector_http
642+
parameters:
643+
http_url: https://dataplane.org/smtpdata.txt
644+
rate_limit: 3600
645+
name: __FEED__
646+
provider: __PROVIDER__
647+
parser:
648+
module: intelmq.bots.parsers.dataplane.parser
649+
parameters:
650+
revision: 2021-09-09
651+
documentation: https://dataplane.org/
652+
public: true
653+
Telnet Login:
654+
description: Entries consist of fields with identifying characteristics of a
655+
host that has been seen initiating a telnet connection to a remote host.
656+
The source report lists hosts that are suspicious of more than just port
657+
scanning. The host may be telnet server cataloging or conducting
658+
authentication attack attempts.
659+
additional_information:
660+
bots:
661+
collector:
662+
module: intelmq.bots.collectors.http.collector_http
663+
parameters:
664+
http_url: https://dataplane.org/telnetlogin.txt
665+
rate_limit: 3600
666+
name: __FEED__
667+
provider: __PROVIDER__
668+
parser:
669+
module: intelmq.bots.parsers.dataplane.parser
670+
parameters:
671+
revision: 2021-09-09
672+
documentation: https://dataplane.org/
673+
public: true
674+
VNC/RFB Login:
675+
description: Entries consist of fields with identifying characteristics of a
676+
host that has been seen initiating a VNC remote buffer session to a remote host.
677+
The source report lists hosts that are suspicious of more than just port
678+
scanning. The host may be VNC/RFB server cataloging or conducting
679+
authentication attack attempts.
680+
additional_information:
681+
bots:
682+
collector:
683+
module: intelmq.bots.collectors.http.collector_http
684+
parameters:
685+
http_url: https://dataplane.org/vncrfb.txt
686+
rate_limit: 3600
687+
name: __FEED__
688+
provider: __PROVIDER__
689+
parser:
690+
module: intelmq.bots.parsers.dataplane.parser
691+
parameters:
692+
revision: 2021-09-09
693+
documentation: https://dataplane.org/
528694
public: true
529695
Turris:
530696
Greylist:

0 commit comments

Comments
 (0)