[nsp-sec] Minor Daily Reports Change: new mwtype in bots report

Tim Wilde twilde at cymru.com
Wed Jun 23 13:01:15 EDT 2010


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Good afternoon everyone,

With tomorrow's Daily Reports run, you will begin seeing a new "mwtype"
value in the "bots" report.  This new mwtype is "irc-botnet", and will
be applied to most (eventually probably all) of the entries that
previously did not have an mwtype specified, and were historically just
assume that you knew were IRC bots.  With the addition of various
different types of bots in this category over the years, we figured it's
about time to make the IRC ones explicit rather than implicit.
Hopefully this shouldn't mess up anyone's parsing too much, as this
field has been in place for quite some time.  Please don't hesitate to
let us know if you have any questions, concerns, etc!

Thanks,
Tim

- -- 
Tim Wilde, Senior Software Engineer, Team Cymru, Inc.
twilde at cymru.com | +1-630-230-5433 | http://www.team-cymru.org/
-----BEGIN PGP SIGNATURE-----

iEYEARECAAYFAkwiPdsACgkQluRbRini9tgMmwCeJ1oK0igzEBsaqKjVxfuoeU/Z
M9IAn3EN2WSNNSw8ERWC8JbFOXIJdW2N
=Nuar
-----END PGP SIGNATURE-----



More information about the nsp-security mailing list