recog_standardize: handle missing files, detect removed identifiers, unify device type tracking #438
Conversation
|
What do you think about changes that would be compatible with the |
TomSellers
changed the title
|
@mkienow-r7 - I've reworked this PR so that it should work just fine with the commit hook. Now detection of values that need to be removed is handled on every run and a console line which includes the text |
| @@ -5672,11 +5672,11 @@ Copyright (c) 1995-2005 by Cisco Systems | |||
| =======================================================================--> | |||
|
|
|||
| <fingerprint pattern="^PARADYNE T1 DSU/CSU; model: ([^;]+); S/W Release: ([^;]+);"> | |||
| <description>Paradyne CSU/DSU</description> | |||
| <description>Paradyne DSU/CSU</description> | |||
There was a problem hiding this comment.
Here and below. Simple typo as can been seen in the example. Changed to align with correct usage elsewhere.
| <param pos="0" name="os.device" value="HiPath"/> | ||
| <param pos="0" name="os.family" value="WAP"/> | ||
| <param pos="0" name="os.family" value="HiPath"/> | ||
| <param pos="0" name="os.device" value="WAP"/> |
There was a problem hiding this comment.
This was a typo that switched the values between the family and device params.
|
@mkienow-r7 |
There was a problem hiding this comment.
Nice work improving recog_standardize and cleaning up the identifiers. Thank you for the contribution @TomSellers!
Includes updates from: * rapid7/recog#444 * rapid7/recog#441 * rapid7/recog#440 * rapid7/recog#439 * rapid7/recog#438 * rapid7/recog#443
Description
This PR fixes #384 and makes a few other changes.
Changes
Adds error handling so that if a particular identifiers file is missing the script will return an empty string so that the contents can be populated from the existing fingerprint database corpus.
Adds logic to detect and notify the user when values have been removed from an indicators list. This is useful when performing cleanups or widespread changes of values. No flag is required to enable this behavior, it works just like the previous detection of new values.
Unifies
*.deviceidentifiers inindicators/device.txtand removes the existingos.deviceandhw.devicefiles. This has already helped identify a few issues which I have addressed.Example output after deleting 3 valid entries from the
device.txtand adding one bonus entry ofSample Device Type Thingy.How Has This Been Tested?
ruby bin/recog_standardize xml/*.xmland reviewing the changesTypes of changes
Checklist: