search

CybOXProject / schemas

CybOX Schemas and Schema Development
42 stars 17 forks source link

Add Ability to Capture Socket Service Banner #387

Open ikiril01 opened 8 years ago

ikiril01 commented 8 years ago

We should consider adding the ability to the Network Socket Object to capture the banner message of the service that may be running on the socket. E.g., "SSH-2.0-OpenSSH_5.9p1."

gtback commented 8 years ago

The banner doesn't run on the socket. If anything, it is a property of a process listening on a socket, or on a connection to a socket.

ikiril01 commented 8 years ago

@gtback good point! I think in most cases it's likely to be associated with the process listening on a socket. I'm wondering if this should instead be a field on the Process Object (if it makes sense at all).