recog-intrigue 2.3.7 → 2.3.14

data/xml/sip_banners.xml

@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="UTF-8"?>
+<?xml version='1.0' encoding='UTF-8'?>
 <fingerprints matches="sip_header.server" protocol="sip" database_type="service">
   <!--
   SIP Server header values are matched against these patterns to fingerprint SIP devices.
@@ -12,7 +12,7 @@
     <param pos="0" name="service.vendor" value="Cisco"/>
     <param pos="0" name="service.family" value="IOS"/>
     <param pos="0" name="service.product" value="IOS"/>
-    <param pos="0" name="service.cpe23" value="cpe:/a:cisco:ios:{os.version}"/>
+    <param pos="0" name="service.cpe23" value="cpe:/a:cisco:ios:-"/>
     <param pos="0" name="os.vendor" value="Cisco"/>
     <param pos="0" name="os.family" value="IOS"/>
     <param pos="0" name="os.product" value="IOS"/>
@@ -34,7 +34,7 @@
     <param pos="0" name="service.vendor" value="Cisco"/>
     <param pos="0" name="service.family" value="IOS"/>
     <param pos="0" name="service.product" value="IOS"/>
-    <param pos="0" name="service.cpe23" value="cpe:/a:cisco:ios:{os.version}"/>
+    <param pos="0" name="service.cpe23" value="cpe:/a:cisco:ios:-"/>
     <param pos="0" name="os.vendor" value="Cisco"/>
     <param pos="0" name="os.family" value="IOS"/>
     <param pos="0" name="os.product" value="IOS"/>
@@ -130,7 +130,6 @@
     <param pos="0" name="os.product" value="Linux"/>
     <param pos="1" name="tandberg.model"/>
     <param pos="2" name="os.version"/>
-    <param pos="0" name="os.cpe23" value="cpe:/o:cisco:telepresence:{os.version}"/>
     <param pos="0" name="hw.vendor" value="Cisco"/>
     <param pos="0" name="hw.family" value="TelePresence"/>
     <param pos="0" name="hw.device" value="Video Conferencing"/>
@@ -150,7 +149,6 @@
     <param pos="0" name="os.product" value="Linux"/>
     <param pos="2" name="tandberg.model"/>
     <param pos="3" name="os.version"/>
-    <param pos="0" name="os.cpe23" value="cpe:/o:cisco:telepresence:{os.version}"/>
     <param pos="0" name="hw.vendor" value="Cisco"/>
     <param pos="0" name="hw.family" value="TelePresence"/>
     <param pos="0" name="hw.device" value="Video Conferencing"/>
@@ -256,10 +254,10 @@
     <example hw.product="MP-124" os.version="6.00A.034.003">Audiocodes-Sip-Gateway-MP-124 FXS/v.6.00A.034.003</example>
     <example hw.product="MP-124" os.version="6.60A.342.003">MP-124 FXS/v.6.60A.342.003</example>
     <example hw.product="MP-114" os.version="6.60A.241.010">MP-114 FXS_FXO/v.6.60A.241.010</example>
-    <param pos="0" name="os.vendor" value="Audiocodes"/>
+    <param pos="0" name="os.vendor" value="AudioCodes"/>
     <param pos="0" name="os.family" value="SIP Gateway"/>
     <param pos="2" name="os.version"/>
-    <param pos="0" name="hw.vendor" value="Audiocodes"/>
+    <param pos="0" name="hw.vendor" value="AudioCodes"/>
     <param pos="0" name="hw.family" value="SIP Gateway"/>
     <param pos="0" name="hw.device" value="SIP Gateway"/>
     <param pos="1" name="hw.product"/>
@@ -296,7 +294,6 @@
     <param pos="0" name="service.family" value="PBX"/>
     <param pos="0" name="service.product" value="PBX"/>
     <param pos="1" name="service.version"/>
-    <param pos="0" name="service.cpe23" value="cpe:/a:asterisk:asterisk:{service.version}"/>
   </fingerprint>
 
   <fingerprint pattern="^Asterisk PBX$">
@@ -305,7 +302,6 @@
     <param pos="0" name="service.vendor" value="Asterisk"/>
     <param pos="0" name="service.family" value="PBX"/>
     <param pos="0" name="service.product" value="PBX"/>
-    <param pos="0" name="service.cpe23" value="cpe:/a:asterisk:asterisk:-"/>
   </fingerprint>
 
   <fingerprint pattern="^FPBX-(\S+)$">
@@ -316,7 +312,6 @@
     <param pos="0" name="service.family" value="PBX"/>
     <param pos="0" name="service.product" value="PBX"/>
     <param pos="1" name="service.version"/>
-    <param pos="0" name="service.cpe23" value="cpe:/a:freepbx:freepbx:{service.version}"/>
   </fingerprint>
 
   <fingerprint pattern="^kamailio \((\S+) \((.*)\)\)$">
@@ -327,10 +322,10 @@
     <param pos="0" name="service.product" value="SIP Server"/>
     <param pos="1" name="service.version"/>
     <param pos="2" name="kamailio.platform"/>
-    <param pos="0" name="service.cpe23" value="cpe:/a:kamailio:kamailio:{service.version}"/>
   </fingerprint>
 
   <!-- This match covers multiple product families and should be split up further -->
+
   <fingerprint pattern="^Algo-([^/]+)/(.*)$">
     <description>Algo SIP Device</description>
     <example hw.product="8186" os.version="1.7">Algo-8186/1.7</example>

data/xml/sip_user_agents.xml

@@ -1,9 +1,11 @@
-<?xml version="1.0" encoding="UTF-8"?>
+<?xml version='1.0' encoding='UTF-8'?>
 <fingerprints matches="sip_header.user_agent" protocol="sip" database_type="service">
   <!--
   SIP User Agent header values are matched against these patterns to fingerprint SIP devices.
   -->
+
   <!-- Axis devices -->
+
   <fingerprint pattern="(?i)^AXIS (\S+) Network Video Door Station$">
     <description>Axis Network Video Door stations, which have voice</description>
     <example hw.product="A8105-E">AXIS A8105-E Network Video Door Station</example>
@@ -14,6 +16,7 @@
     <param pos="0" name="os.vendor" value="AXIS"/>
     <param pos="0" name="os.family" value="Linux"/>
   </fingerprint>
+
   <fingerprint pattern="(?i)^AXIS (\S+) Network (?:Audio Bridge|(?:Cabinet|Horn) Speaker)$">
     <description>Axis Network audio devices</description>
     <example hw.product="C3003-E">AXIS C3003-E Network Horn Speaker</example>
@@ -25,7 +28,9 @@
     <param pos="0" name="os.vendor" value="AXIS"/>
     <param pos="0" name="os.family" value="Linux"/>
   </fingerprint>
+
   <!-- Cisco Devices -->
+
   <fingerprint pattern="^Cisco-SIPGateway/IOS-([\d\.x]+)$">
     <description>Cisco SIPGateway</description>
     <example>Cisco-SIPGateway/IOS-12.x</example>
@@ -34,13 +39,16 @@
     <param pos="1" name="os.version"/>
     <param pos="0" name="os.cpe23" value="cpe:/o:cisco:ios:{os.version}"/>
   </fingerprint>
+
   <!-- AVM.DE Devices -->
+
   <fingerprint pattern="^FRITZ!OS$">
     <description>AVM FritzOS Device</description>
     <example>FRITZ!OS</example>
     <param pos="0" name="os.vendor" value="AVM"/>
     <param pos="0" name="os.product" value="FRITZ!BOX"/>
   </fingerprint>
+
   <fingerprint pattern="^(?:AVM )?(FRITZ!Box .*) +(\d+\.\d+\.\d+)">
     <description>AVM FritzBox</description>
     <example>AVM FRITZ!Box Fon 06.03.13</example>
@@ -60,6 +68,7 @@
     <param pos="1" name="os.product"/>
     <param pos="2" name="os.version"/>
   </fingerprint>
+
   <fingerprint pattern="^(?:AVM )?(FRITZ!Fon .*) +(\d+\.\d+\.\d+)">
     <description>AVM FritzFon</description>
     <example>AVM FRITZ!Fon 7150 (fs) 38.04.56 (Mar 31 2008)</example>
@@ -69,6 +78,7 @@
     <param pos="1" name="os.product"/>
     <param pos="2" name="os.version"/>
   </fingerprint>
+
   <fingerprint pattern="^(?:AVM )?(Multibox .*) +(\d+\.\d+\.\d+)">
     <description>AVM Multibox</description>
     <example>AVM Multibox 7390 NGN 84.05.09 (Jan 13 2012)</example>
@@ -77,12 +87,15 @@
     <param pos="1" name="os.product"/>
     <param pos="2" name="os.version"/>
   </fingerprint>
+
   <!-- Huawei devices -->
+
   <fingerprint pattern="(?i)^Huawei$">
     <description>Huawei generic</description>
     <example>Huawei</example>
     <param pos="0" name="hw.vendor" value="Huawei"/>
   </fingerprint>
+
   <fingerprint pattern="(?i)^Huawei-HomeGateway/V(?:\d.*)$">
     <description>Huawei Home Gateway</description>
     <example>Huawei-HomeGateway/V100R001</example>
@@ -90,6 +103,7 @@
     <param pos="0" name="hw.device" value="Broadband router"/>
     <param pos="0" name="hw.product" value="Home Gateway"/>
   </fingerprint>
+
   <fingerprint pattern="(?i)^Huawei-EchoLife (HG.*)/V(?:\d.*)$">
     <description>Huawei EchoLife Home Gateway</description>
     <example hw.model="HG8121H">HUAWEI-EchoLife HG8121H/V3R018C00S110</example>
@@ -98,6 +112,7 @@
     <param pos="0" name="hw.product" value="EchoLife Home Gateway"/>
     <param pos="1" name="hw.model"/>
   </fingerprint>
+
   <fingerprint pattern="(?i)^Huawei (SoftX\d+) (?:V\d.*)$">
     <description>Huawei Softswitch</description>
     <example hw.model="SoftX3000">Huawei SoftX3000 V300R010</example>
@@ -106,6 +121,7 @@
     <param pos="0" name="hw.product" value="Softswitch"/>
     <param pos="1" name="hw.model"/>
   </fingerprint>
+
   <fingerprint pattern="^Mitel-(\S+)-SIP-Phone ([\d\.]+) (.{12})$">
     <description>Mitel SIP Phones</description>
     <example hw.product="5320" hw.version="06.05.00.11" host.mac="010203040506">Mitel-5320-SIP-Phone 06.05.00.11 010203040506</example>
@@ -115,6 +131,7 @@
     <param pos="2" name="hw.version"/>
     <param pos="3" name="host.mac"/>
   </fingerprint>
+
   <fingerprint pattern="^Mitel Border GW/(\S+)$">
     <description>Mitel SIP Gateway</description>
     <example hw.version="4.0.0.9">Mitel Border GW/4.0.0.9</example>
@@ -123,6 +140,7 @@
     <param pos="0" name="hw.product" value="Border GW"/>
     <param pos="1" name="hw.version"/>
   </fingerprint>
+
   <fingerprint pattern="^(?:Polycom/[\d\.]+ )?Polycom(SoundPoint|VVX|SoundStation)\S+_(\d+)-UA/([\d\.]+)(?:_(.{12}))?$">
     <description>Polycom SoundPoint, SountdStation, VVX VoIP phones</description>
     <example hw.version="5.8.0.13337" hw.family="VVX" hw.product="VVX 350">PolycomVVX-VVX_350-UA/5.8.0.13337</example>
@@ -138,6 +156,7 @@
     <param pos="3" name="hw.version"/>
     <param pos="4" name="host.mac"/>
   </fingerprint>
+
   <fingerprint pattern="^(?:Polycom/[\d\.]+ )?Polycom(?:RealPresenceTrio)-Trio_(\S+)-UA/([\d\.]+)(?:_(.{12}))?$">
     <description>Polycom RealPresence Trio Phones</description>
     <example hw.version="5.4.0.12197" hw.product="RealPresence Trio 8800">PolycomRealPresenceTrio-Trio_8800-UA/5.4.0.12197</example>
@@ -151,6 +170,7 @@
     <param pos="2" name="hw.version"/>
     <param pos="3" name="host.mac"/>
   </fingerprint>
+
   <fingerprint pattern="^Polycom ?HDX ?(\d+)(?: ?HD)?(?:/| \(Release - )([^\)]+)\)?">
     <description>Polycom HDX Video Conferencing</description>
     <example hw.model="9006" hw.product="HDX 9006" hw.version="3.0.6-37004">Polycom HDX 9006 (Release - 3.0.6-37004)</example>
@@ -164,6 +184,7 @@
     <param pos="1" name="hw.model"/>
     <param pos="2" name="hw.version"/>
   </fingerprint>
+
   <fingerprint pattern="^PolycomRealPresenceGroup(\d+)/([\d\._]+)+$">
     <description>Polycom RealPresence Group Video Conferencing</description>
     <example hw.model="700" hw.product="RealPresence Group 700" hw.version="6.2.0">PolycomRealPresenceGroup700/6.2.0</example>
@@ -174,6 +195,7 @@
     <param pos="1" name="hw.model"/>
     <param pos="2" name="hw.version"/>
   </fingerprint>
+
   <fingerprint pattern="^Nero SIPPS IP Phone Version ([\d\.]+)+$">
     <description>Nero SIPPS IP Phone</description>
     <example service.version="2.0.51.16">Nero SIPPS IP Phone Version 2.0.51.16</example>
@@ -183,6 +205,7 @@
     <param pos="0" name="service.product" value="SIPPS IP Phone"/>
     <param pos="1" name="service.version"/>
   </fingerprint>
+
   <fingerprint pattern="^ShoreGear/([\d\.]+)\s+\(ShoreTel \d+\)$">
     <description>ShoreTel VoIP Switch</description>
     <example hw.version="21.90.4128.0">ShoreGear/21.90.4128.0 (ShoreTel 15)</example>
@@ -191,6 +214,7 @@
     <param pos="0" name="hw.device" value="VoIP Switch"/>
     <param pos="1" name="hw.version"/>
   </fingerprint>
+
   <fingerprint pattern="^MERCURY-([a-fA-F0-9]{12})$">
     <description>Crestron Mercury</description>
     <example host.mac="00107F1ABAA0">MERCURY-00107F1ABAA0</example>
@@ -202,6 +226,7 @@
     <param pos="0" name="os.device" value="Video Conferencing"/>
     <param pos="1" name="host.mac"/>
   </fingerprint>
+
   <fingerprint pattern="^IPDECT/([\d\.]+)\s+\(MAC=([a-fA-F0-9]{12}); SER=">
     <description>Konftel IP Phone</description>
     <example host.mac="00087B0F1D30" hw.version="03.55.0013">IPDECT/03.55.0013 (MAC=00087B0F1D30; SER= 00000; HW=1)</example>
@@ -210,6 +235,7 @@
     <param pos="1" name="hw.version"/>
     <param pos="2" name="host.mac"/>
   </fingerprint>
+
   <fingerprint pattern="^Sangoma ([^\s]+) V([a-zA-Z0-9\.]+)=?">
     <description>Sangoma IP Phone</description>
     <example hw.product="S305" hw.version="3.0.4.72">Sangoma S305 V3.0.4.72</example>
@@ -218,4 +244,5 @@
     <param pos="2" name="hw.version"/>
     <param pos="1" name="hw.product"/>
   </fingerprint>
-</fingerprints>
+
+</fingerprints>

data/xml/smb_native_lm.xml

@@ -1,10 +1,12 @@
-<?xml version="1.0" encoding="UTF-8"?>
+<?xml version='1.0' encoding='UTF-8'?>
 <fingerprints matches="smb.native_lm" protocol="smb" database_type="service">
   <!--
     SMB fingerprints obtained from the Native LM (LAN manager) field of SMB
     negotations
   -->
+
   <!-- Mac OS X -->
+
   <fingerprint pattern="^Samba (3\.0\.28a-apple)$">
     <description>Samba on OS X 10.6</description>
     <example service.version="3.0.28a-apple">Samba 3.0.28a-apple</example>
@@ -18,6 +20,7 @@
     <param pos="1" name="service.version"/>
     <param pos="0" name="service.cpe23" value="cpe:/a:samba:samba:{service.version}"/>
   </fingerprint>
+
   <fingerprint pattern="^Samba (3\.0\.25b-apple)$">
     <description>Samba on OS X 10.5</description>
     <example service.version="3.0.25b-apple">Samba 3.0.25b-apple</example>
@@ -31,7 +34,9 @@
     <param pos="1" name="service.version"/>
     <param pos="0" name="service.cpe23" value="cpe:/a:samba:samba:{service.version}"/>
   </fingerprint>
+
   <!-- TODO: Detect vendor, distribution, and package versions -->
+
   <fingerprint pattern="^Samba (\d\.\d+.\d+\w*)">
     <description>Samba</description>
     <example>Samba 3.0.24</example>
@@ -45,11 +50,13 @@
     <param pos="1" name="service.version"/>
     <param pos="0" name="service.cpe23" value="cpe:/a:samba:samba:{service.version}"/>
   </fingerprint>
+
   <fingerprint pattern="^Netreon LANMAN 1.0$">
     <description>Netreon SAN software</description>
     <example>Netreon LANMAN 1.0</example>
     <param pos="0" name="service.vendor" value="Netreon"/>
   </fingerprint>
+
   <fingerprint pattern="(?i)^MikrotikSMB$">
     <description>Mikrotik</description>
     <example>MikrotikSMB</example>
@@ -59,4 +66,5 @@
     <param pos="0" name="os.product" value="RouterOS"/>
     <param pos="0" name="os.cpe23" value="cpe:/o:mikrotik:routeros:-"/>
   </fingerprint>
-</fingerprints>
+
+</fingerprints>

data/xml/smb_native_os.xml

@@ -1,8 +1,9 @@
-<?xml version="1.0" encoding="UTF-8"?>
+<?xml version='1.0' encoding='UTF-8'?>
 <fingerprints matches="smb.native_os" protocol="smb" database_type="util.os">
   <!--
     SMB fingerprints obtained from the Native OS field of SMB negotations
   -->
+
   <fingerprint pattern="^(Windows NT \d\.\d+)$">
     <description>Windows NT</description>
     <example os.product="Windows NT 4.0">Windows NT 4.0</example>
@@ -10,6 +11,7 @@
     <param pos="0" name="os.vendor" value="Microsoft"/>
     <param pos="1" name="os.product"/>
   </fingerprint>
+
   <fingerprint pattern="^(Windows (?:95|98|ME))$">
     <description>Windows 95/98/ME</description>
     <example os.product="Windows 95">Windows 95</example>
@@ -18,6 +20,7 @@
     <param pos="0" name="os.vendor" value="Microsoft"/>
     <param pos="1" name="os.product"/>
   </fingerprint>
+
   <fingerprint pattern="^Windows 5\.0$">
     <description>Windows 2000</description>
     <example>Windows 5.0</example>
@@ -26,6 +29,7 @@
     <param pos="0" name="os.product" value="Windows 2000"/>
     <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_2000:-"/>
   </fingerprint>
+
   <fingerprint pattern="^Windows 5\.1$">
     <description>Windows XP</description>
     <example>Windows 5.1</example>
@@ -34,6 +38,7 @@
     <param pos="0" name="os.product" value="Windows XP"/>
     <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_xp:-"/>
   </fingerprint>
+
   <fingerprint pattern="^Windows XP (\d+) (Service Pack \d+)$">
     <description>Windows XP with Service Pack</description>
     <example os.build="2600" os.version="Service Pack 1">Windows XP 2600 Service Pack 1</example>
@@ -44,6 +49,7 @@
     <param pos="2" name="os.version"/>
     <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_xp:{os.version}"/>
   </fingerprint>
+
   <fingerprint pattern="^Windows XP (\d+)$">
     <description>Windows XP with build number</description>
     <example os.build="2600">Windows XP 2600</example>
@@ -53,6 +59,7 @@
     <param pos="1" name="os.build"/>
     <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_xp:-"/>
   </fingerprint>
+
   <fingerprint pattern="^Windows XP (Home|Professional)(?: Edition)?$">
     <description>Windows XP without a version</description>
     <example os.edition="Home">Windows XP Home Edition</example>
@@ -63,6 +70,7 @@
     <param pos="1" name="os.edition"/>
     <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_xp:-"/>
   </fingerprint>
+
   <fingerprint pattern="^Windows \.NET">
     <description>Windows Server 2003 Beta</description>
     <param pos="0" name="os.certainty" value="1.0"/>
@@ -71,6 +79,7 @@
     <param pos="0" name="os.version" value="Beta"/>
     <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2003:Beta"/>
   </fingerprint>
+
   <fingerprint pattern="^Windows Server 2003 R2 (\d+)$">
     <description>Windows Server 2003 R2</description>
     <param pos="0" name="os.certainty" value="1.0"/>
@@ -79,6 +88,7 @@
     <param pos="1" name="os.build"/>
     <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2003:-"/>
   </fingerprint>
+
   <fingerprint pattern="^Windows Server 2003 R2 (\d+) (Service Pack \d+)(?:, v\.\d+)?$">
     <description>Windows Server 2003 R2 (SP)</description>
     <example os.build="3790" os.version="Service Pack 2">Windows Server 2003 R2 3790 Service Pack 2</example>
@@ -90,6 +100,7 @@
     <param pos="2" name="os.version"/>
     <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2003:{os.version}"/>
   </fingerprint>
+
   <fingerprint pattern="^Windows Server 2003 (\d+)$">
     <description>Windows Server 2003 with a build</description>
     <example os.build="3790">Windows Server 2003 3790</example>
@@ -99,6 +110,7 @@
     <param pos="1" name="os.build"/>
     <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2003:-"/>
   </fingerprint>
+
   <fingerprint pattern="^Windows Server 2003$">
     <description>Windows Server 2003 without a build</description>
     <example>Windows Server 2003</example>
@@ -107,6 +119,7 @@
     <param pos="0" name="os.product" value="Windows Server 2003"/>
     <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2003:-"/>
   </fingerprint>
+
   <fingerprint pattern="^Windows Server 2003 (\d+) (Service Pack \d+)(?:, v\.\d+)?$">
     <description>Windows Server 2003 (SP)</description>
     <example os.build="3790" os.version="Service Pack 1">Windows Server 2003 3790 Service Pack 1, v.3309</example>
@@ -118,7 +131,9 @@
     <param pos="2" name="os.version"/>
     <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2003:{os.version}"/>
   </fingerprint>
+
   <!-- Note that 2008 SP1 is technically "2008 Gold" according to Microsoft -->
+
   <fingerprint pattern="^Windows Server 2008$">
     <description>Windows Server 2008 without a build</description>
     <example>Windows Server 2008</example>
@@ -127,6 +142,7 @@
     <param pos="0" name="os.product" value="Windows Server 2008"/>
     <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2008:-"/>
   </fingerprint>
+
   <fingerprint pattern="^Windows Server \(R\) 2008 (\w+|\w+ \w+|\w+ \w+ \w+)(?: (?:with|without) Hyper-V|) (\d+) (Service Pack \d+)(?:, v\.\d+)?$">
     <description>Windows Server 2008</description>
     <example os.edition="Enterprise" os.version="Service Pack 1">Windows Server (R) 2008 Enterprise without Hyper-V 6001 Service Pack 1</example>
@@ -139,6 +155,7 @@
     <param pos="3" name="os.version"/>
     <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2008:{os.version}"/>
   </fingerprint>
+
   <fingerprint pattern="^Windows \(R\) Web Server 2008 (\d+) (Service Pack \d+)$">
     <description>Windows Web Server 2008 (SP)</description>
     <example os.edition="Web" os.version="Service Pack 2">Windows (R) Web Server 2008 6002 Service Pack 2</example>
@@ -150,6 +167,7 @@
     <param pos="2" name="os.version"/>
     <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2008:{os.version}"/>
   </fingerprint>
+
   <fingerprint pattern="^Windows \(R\) Web Server 2008 (\d+)$">
     <description>Windows Web Server 2008</description>
     <example>Windows (R) Web Server 2008 6002</example>
@@ -160,7 +178,9 @@
     <param pos="1" name="os.build"/>
     <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2008:-"/>
   </fingerprint>
+
   <!-- TODO: Need an example string -->
+
   <fingerprint pattern="^Windows \(R\) Storage Server 2008 (?:\w+|\w+ \w+|\w+ \w+ \w+) (\d+) (Service Pack \d+)$">
     <description>Windows Server 2008 Storage (SP)</description>
     <param pos="0" name="os.certainty" value="1.0"/>
@@ -171,7 +191,9 @@
     <param pos="2" name="os.version"/>
     <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2008:{os.version}"/>
   </fingerprint>
+
   <!-- TODO: Need an example string -->
+
   <fingerprint pattern="^Windows \(R\) Storage Server 2008 (?:\w+|\w+ \w+|\w+ \w+ \w+) (\d+)$">
     <description>Windows Web Server 2008 Storage</description>
     <param pos="0" name="os.certainty" value="1.0"/>
@@ -181,6 +203,7 @@
     <param pos="1" name="os.build"/>
     <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2008:-"/>
   </fingerprint>
+
   <fingerprint pattern="^Windows Server 2008 HPC Edition (\d+) (Service Pack \d+)$">
     <description>Windows Server 2008 HPC</description>
     <example>Windows Server 2008 HPC Edition 7601 Service Pack 1</example>
@@ -192,7 +215,9 @@
     <param pos="2" name="os.version"/>
     <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2008:{os.version}"/>
   </fingerprint>
+
   <!-- TODO: Need an example string -->
+
   <fingerprint pattern="^Windows Server 2008 HPC Edition (\d+)$">
     <description>Windows Web Server 2008 HPC</description>
     <example>Windows Server 2008 HPC Edition 7600</example>
@@ -203,7 +228,9 @@
     <param pos="1" name="os.build"/>
     <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2008:-"/>
   </fingerprint>
+
   <!-- 2008 R2 -->
+
   <fingerprint pattern="^Windows Server 2008 R2 (\w+|\w+ \w+|\w+ \w+ \w+) (\d+) (Service Pack \d+)(?:, v\.\d+)?$">
     <description>Windows Server 2008 R2</description>
     <example>Windows Server 2008 R2 Enterprise 7601 Service Pack 1</example>
@@ -216,6 +243,7 @@
     <param pos="3" name="os.version"/>
     <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2008:{os.version}"/>
   </fingerprint>
+
   <fingerprint pattern="^Windows Server 2008 R2 (\w+|\w+ \w+|\w+ \w+ \w+) (\d+)$">
     <description>Windows Server 2008 R2 without Service Pack</description>
     <example os.edition="Enterprise">Windows Server 2008 R2 Enterprise 7600</example>
@@ -228,6 +256,7 @@
     <param pos="2" name="os.build"/>
     <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2008:-"/>
   </fingerprint>
+
   <fingerprint pattern="^Windows Server 2016(?: Technical Preview \d+)? (\w+|\w+ \w+|\w+ \w+ \w+)(?: Evaluation)? (\d+)$">
     <description>Windows Server 2016 with a build, without service pack</description>
     <example os.edition="Datacenter" os.build="14393">Windows Server 2016 Datacenter 14393</example>
@@ -240,6 +269,7 @@
     <param pos="2" name="os.build"/>
     <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2016:-"/>
   </fingerprint>
+
   <fingerprint pattern="^Windows Storage Server 2016 (?:\w+|\w+ \w+|\w+ \w+ \w+) (\d+)$">
     <description>Windows Server 2016 Storage</description>
     <example os.build="14393">Windows Storage Server 2016 Standard 14393</example>
@@ -250,6 +280,7 @@
     <param pos="1" name="os.build"/>
     <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2016:-"/>
   </fingerprint>
+
   <fingerprint pattern="^Windows Web Server 2008 R2 (\d+) (Service Pack \d+)$">
     <description>Windows Server 2008 R2 Web</description>
     <example os.version="Service Pack 1">Windows Web Server 2008 R2 7601 Service Pack 1</example>
@@ -261,6 +292,7 @@
     <param pos="2" name="os.version"/>
     <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2008:{os.version}"/>
   </fingerprint>
+
   <fingerprint pattern="^Windows Web Server 2008 R2 (\d+)$">
     <description>Windows Web Server 2008 R2 Web</description>
     <example>Windows Web Server 2008 R2 7600</example>
@@ -271,6 +303,7 @@
     <param pos="1" name="os.build"/>
     <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2008:-"/>
   </fingerprint>
+
   <fingerprint pattern="^Windows Storage Server 2008 R2 (?:\w+|\w+ \w+|\w+ \w+ \w+) (\d+) (Service Pack \d+)$">
     <description>Windows Server 2008 Storage R2 (SP)</description>
     <example os.version="Service Pack 1" os.build="7601">Windows Storage Server 2008 R2 Essentials 7601 Service Pack 1</example>
@@ -282,6 +315,7 @@
     <param pos="2" name="os.version"/>
     <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2008:{os.version}"/>
   </fingerprint>
+
   <fingerprint pattern="^Windows Vista \(TM\) (\w+|\w+ \w+|\w+ \w+ \w+) (\d+) (Service Pack \d+)$">
     <description>Windows Vista (SP)</description>
     <example os.edition="Home Premium" os.version="Service Pack 2">Windows Vista (TM) Home Premium 6002 Service Pack 2</example>
@@ -293,6 +327,7 @@
     <param pos="3" name="os.version"/>
     <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_vista:{os.version}"/>
   </fingerprint>
+
   <fingerprint pattern="^Windows Vista \(TM\) (\w+|\w+ \w+|\w+ \w+ \w+) (\d+)$">
     <description>Windows Vista</description>
     <example os.edition="Home Premium">Windows Vista (TM) Home Premium 6000</example>
@@ -303,6 +338,7 @@
     <param pos="2" name="os.build"/>
     <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_vista:-"/>
   </fingerprint>
+
   <fingerprint pattern="^(Windows (?:7|8|8\.1)(?:| RT)) (\w+|\w+ \w+|\w+ \w+ \w+) (\d+) (Service Pack \d+)(?:, v\.\d+)?$">
     <description>Windows 7/8 (SP + Edition)</description>
     <example os.edition="Enterprise" os.version="Service Pack 1">Windows 7 Enterprise 7601 Service Pack 1</example>
@@ -315,6 +351,7 @@
     <param pos="3" name="os.build"/>
     <param pos="4" name="os.version"/>
   </fingerprint>
+
   <fingerprint pattern="^(Windows (?:7|8|8\.1)(?:| RT)) (\d+) (Service Pack \d+)$">
     <description>Windows 7/8 (SP)</description>
     <example os.version="Service Pack 1">Windows 7 7601 Service Pack 1</example>
@@ -324,6 +361,7 @@
     <param pos="2" name="os.build"/>
     <param pos="3" name="os.version"/>
   </fingerprint>
+
   <fingerprint pattern="^(Windows (?:7|8|8\.1)(?:| RT)) (\w+|\w+ \w+|\w+ \w+ \w+) (\d+)$">
     <description>Windows 7/8 (Edition)</description>
     <example os.edition="Enterprise">Windows 7 Enterprise 7600</example>
@@ -335,6 +373,7 @@
     <param pos="2" name="os.edition"/>
     <param pos="3" name="os.build"/>
   </fingerprint>
+
   <fingerprint pattern="^(Windows (?:7|8|8\.1)(?:| RT)) (\d+)$">
     <description>Windows 7/8</description>
     <example>Windows 8 9200</example>
@@ -343,8 +382,11 @@
     <param pos="1" name="os.product"/>
     <param pos="2" name="os.build"/>
   </fingerprint>
+
   <!-- Windows 2012 R2 matches go first to simplify the regular expressions -->
+
   <!-- TODO: Need an example string -->
+
   <fingerprint pattern="^Windows Server 2012 R2 (\w+|\w+ \w+|\w+ \w+ \w+) (\d+) (Service Pack \d+)$">
     <description>Windows Server 2012 R2 (SP)</description>
     <param pos="0" name="os.certainty" value="1.0"/>
@@ -355,6 +397,7 @@
     <param pos="3" name="os.version"/>
     <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2012:{os.version}"/>
   </fingerprint>
+
   <fingerprint pattern="^Windows Server 2012 R2 (\w+|\w+ \w+|\w+ \w+ \w+) (\d+)$">
     <description>Windows Server 2012 R2</description>
     <example os.edition="Standard">Windows Server 2012 R2 Standard 9600</example>
@@ -365,7 +408,9 @@
     <param pos="2" name="os.build"/>
     <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2012:-"/>
   </fingerprint>
+
   <!-- TODO: Need an example string -->
+
   <fingerprint pattern="^Windows Server 2012 (\w+|\w+ \w+|\w+ \w+ \w+) (\d+) (Service Pack \d+)$">
     <description>Windows Server 2012 (SP)</description>
     <param pos="0" name="os.certainty" value="1.0"/>
@@ -376,6 +421,7 @@
     <param pos="3" name="os.version"/>
     <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2012:{os.version}"/>
   </fingerprint>
+
   <fingerprint pattern="^Windows Server 2012 (\w+|\w+ \w+|\w+ \w+ \w+) (\d+)$">
     <description>Windows Server 2012</description>
     <example>Windows Server 2012 Standard 9200</example>
@@ -386,6 +432,7 @@
     <param pos="2" name="os.build"/>
     <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2012:-"/>
   </fingerprint>
+
   <fingerprint pattern="^Windows MultiPoint Server 2012 (?:\w+|\w+ \w+|\w+ \w+ \w+) (\d+) (Service Pack \d+)$">
     <description>Windows MultiPoint Server 2012 (SP)</description>
     <example os.build="9201" os.version="Service Pack 1">Windows MultiPoint Server 2012 Premium 9201 Service Pack 1</example>
@@ -397,6 +444,7 @@
     <param pos="2" name="os.version"/>
     <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2012:{os.version}"/>
   </fingerprint>
+
   <fingerprint pattern="^Windows MultiPoint Server 2012 (?:\w+|\w+ \w+|\w+ \w+ \w+) (\d+)$">
     <description>Windows MultiPoint Server 2012</description>
     <example os.build="9200">Windows MultiPoint Server 2012 Premium 9200</example>
@@ -407,7 +455,9 @@
     <param pos="1" name="os.build"/>
     <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2012:-"/>
   </fingerprint>
+
   <!-- Windows 10 Preview -->
+
   <fingerprint pattern="^Windows 10 (\w+|\w+ \w+|\w+ \w+ \w+) Insider Preview (\d+)$">
     <description>Windows 10 Enterprise Insider Preview</description>
     <example os.build="10130" os.edition="Enterprise">Windows 10 Enterprise Insider Preview 10130</example>
@@ -418,6 +468,7 @@
     <param pos="2" name="os.build"/>
     <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_10:-"/>
   </fingerprint>
+
   <fingerprint pattern="^Windows 10 ((?:\w+|\w+ \w+|\w+ \w+ \w+)(?: LTSB(?: Evaluation)?)?) (\d+)$">
     <description>Windows 10</description>
     <example os.build="10130" os.edition="Enterprise">Windows 10 Enterprise 10130</example>
@@ -435,6 +486,7 @@
     <param pos="2" name="os.build"/>
     <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_10:-"/>
   </fingerprint>
+
   <fingerprint pattern="^VxWorks">
     <description>VxWorks</description>
     <example>VxWorks</example>
@@ -445,6 +497,7 @@
     <param pos="0" name="service.vendor" value="Wind River"/>
     <param pos="0" name="service.product" value="VxWorks CIFS"/>
   </fingerprint>
+
   <fingerprint pattern="^OS/400 \D(\d+)\D(\d+)\D(\d+)">
     <description>OS/400</description>
     <example os.version="4" os.version.version="5" os.version.version.version="0">OS/400 V4R5M0</example>
@@ -453,13 +506,16 @@
     <param pos="1" name="os.version"/>
     <param pos="2" name="os.version.version"/>
     <param pos="3" name="os.version.version.version"/>
+    <param pos="0" name="os.cpe23" value="cpe:/o:ibm:os_400:{os.version}"/>
   </fingerprint>
+
   <fingerprint pattern="^Apple Base Station$">
     <description>SMB exposed via SMB shared USB disks on Apple devices</description>
     <example>Apple Base Station</example>
     <param pos="0" name="os.vendor" value="Apple"/>
     <param pos="0" name="hw.vendor" value="Apple"/>
   </fingerprint>
+
   <fingerprint pattern="^EMC-SNAS:T([\d\.]+)?$">
     <description>EMC Celerra</description>
     <example service.version="7.1.80.7">EMC-SNAS:T7.1.80.7</example>
@@ -474,12 +530,15 @@
     <param pos="0" name="hw.device" value="Storage"/>
     <param pos="0" name="hw.product" value="Celerra"/>
   </fingerprint>
+
   <fingerprint pattern="^Netreon OS 1.0$">
     <description>Netreon SAN software</description>
     <example>Netreon OS 1.0</example>
     <param pos="0" name="service.vendor" value="Netreon"/>
   </fingerprint>
+
   <!-- VisionFS -->
+
   <fingerprint pattern="^(?:ax|i3|m8|mp|pa|pp|rs|sp)ai(\d{4})">
     <description>AIX</description>
     <example service.version="9876">axai9876</example>
@@ -490,6 +549,7 @@
     <param pos="0" name="service.product" value="VisionFS"/>
     <param pos="1" name="service.version"/>
   </fingerprint>
+
   <fingerprint pattern="^(?:ax|i3|m8|mp|pa|pp|rs|sp)dg(\d{4})">
     <description>DG/UX</description>
     <example service.version="9876">i3dg9876</example>
@@ -499,6 +559,7 @@
     <param pos="0" name="service.product" value="VisionFS"/>
     <param pos="1" name="service.version"/>
   </fingerprint>
+
   <fingerprint pattern="^(?:ax|i3|m8|mp|pa|pp|rs|sp)dw(\d{4})">
     <description>Darwin</description>
     <example service.version="9876">m8dw9876</example>
@@ -509,6 +570,7 @@
     <param pos="0" name="service.product" value="VisionFS"/>
     <param pos="1" name="service.version"/>
   </fingerprint>
+
   <fingerprint pattern="^(?:ax|i3|m8|mp|pa|pp|rs|sp)dy(\d{4})">
     <description>DYNIX</description>
     <example service.version="9876">m8dy9876</example>
@@ -518,6 +580,7 @@
     <param pos="0" name="service.product" value="VisionFS"/>
     <param pos="1" name="service.version"/>
   </fingerprint>
+
   <fingerprint pattern="^(?:ax|i3|m8|mp|pa|pp|rs|sp)fb(\d{4})">
     <description>FreeBSD</description>
     <example service.version="9876">m8fb9876</example>
@@ -528,6 +591,7 @@
     <param pos="0" name="service.product" value="VisionFS"/>
     <param pos="1" name="service.version"/>
   </fingerprint>
+
   <fingerprint pattern="^(?:ax|i3|m8|mp|pa|pp|rs|sp)hp(\d{4})">
     <description>HP-UX</description>
     <example service.version="9876">m8hp9876</example>
@@ -538,6 +602,7 @@
     <param pos="0" name="service.product" value="VisionFS"/>
     <param pos="1" name="service.version"/>
   </fingerprint>
+
   <fingerprint pattern="^(?:ax|i3|m8|mp|pa|pp|rs|sp)ir(\d{4})">
     <description>IRIX</description>
     <example service.version="9876">m8ir9876</example>
@@ -548,6 +613,7 @@
     <param pos="0" name="service.product" value="VisionFS"/>
     <param pos="1" name="service.version"/>
   </fingerprint>
+
   <fingerprint pattern="^(?:ax|i3|m8|mp|pa|pp|rs|sp)li(\d{4})">
     <description>Linux</description>
     <example service.version="9876">m8li9876</example>
@@ -558,6 +624,7 @@
     <param pos="0" name="service.product" value="VisionFS"/>
     <param pos="1" name="service.version"/>
   </fingerprint>
+
   <fingerprint pattern="^(?:ax|i3|m8|mp|pa|pp|rs|sp)mo(\d{4})">
     <description>SVR</description>
     <example service.version="9876">m8mo9876</example>
@@ -567,6 +634,7 @@
     <param pos="0" name="service.product" value="VisionFS"/>
     <param pos="1" name="service.version"/>
   </fingerprint>
+
   <fingerprint pattern="^(?:ax|i3|m8|mp|pa|pp|rs|sp)o1(\d{4})">
     <description>OSF/1</description>
     <example service.version="9876">m8o19876</example>
@@ -576,6 +644,7 @@
     <param pos="0" name="service.product" value="VisionFS"/>
     <param pos="1" name="service.version"/>
   </fingerprint>
+
   <fingerprint pattern="^(?:ax|i3|m8|mp|pa|pp|rs|sp)ro(\d{4})">
     <description>RISC OS</description>
     <example service.version="9876">m8ro9876</example>
@@ -584,6 +653,7 @@
     <param pos="0" name="service.product" value="VisionFS"/>
     <param pos="1" name="service.version"/>
   </fingerprint>
+
   <fingerprint pattern="^(?:ax|i3|m8|mp|pa|pp|rs|sp)sc(\d{4})">
     <description>OpenServer</description>
     <example service.version="9876">m8sc9876</example>
@@ -593,6 +663,7 @@
     <param pos="0" name="service.product" value="VisionFS"/>
     <param pos="1" name="service.version"/>
   </fingerprint>
+
   <fingerprint pattern="^(?:ax|i3|m8|mp|pa|pp|rs|sp)so(\d{4})">
     <description>SunOS</description>
     <example service.version="9876">m8so9876</example>
@@ -603,6 +674,7 @@
     <param pos="0" name="service.product" value="VisionFS"/>
     <param pos="1" name="service.version"/>
   </fingerprint>
+
   <fingerprint pattern="^(?:ax|i3|m8|mp|pa|pp|rs|sp)su(\d{4})">
     <description>Solaris</description>
     <example service.version="9876">m8su9876</example>
@@ -613,6 +685,7 @@
     <param pos="0" name="service.product" value="VisionFS"/>
     <param pos="1" name="service.version"/>
   </fingerprint>
+
   <fingerprint pattern="^(?:ax|i3|m8|mp|pa|pp|rs|sp)sx(\d{4})">
     <description>SINIX</description>
     <example service.version="9876">m8sx9876</example>
@@ -622,6 +695,7 @@
     <param pos="0" name="service.product" value="VisionFS"/>
     <param pos="1" name="service.version"/>
   </fingerprint>
+
   <fingerprint pattern="^(?:ax|i3|m8|mp|pa|pp|rs|sp)ul(\d{4})">
     <description>Ultrix/1</description>
     <example service.version="9876">m8ul9876</example>
@@ -631,6 +705,7 @@
     <param pos="0" name="service.product" value="VisionFS"/>
     <param pos="1" name="service.version"/>
   </fingerprint>
+
   <fingerprint pattern="^(?:ax|i3|m8|mp|pa|pp|rs|sp)un(\d{4})">
     <description>UnixWare</description>
     <example service.version="9876">m8un9876</example>
@@ -640,6 +715,7 @@
     <param pos="0" name="service.product" value="VisionFS"/>
     <param pos="1" name="service.version"/>
   </fingerprint>
+
   <fingerprint pattern="^(?:ax|i3|m8|mp|pa|pp|rs|sp)wi(\d{4})">
     <description>Windows</description>
     <example service.version="9876">m8wi9876</example>
@@ -650,6 +726,7 @@
     <param pos="0" name="service.product" value="VisionFS"/>
     <param pos="1" name="service.version"/>
   </fingerprint>
+
   <fingerprint pattern="^(?i:unix)$">
     <description>Generally some Samba variant, which reports Unix</description>
     <example>Unix</example>
@@ -659,4 +736,5 @@
     <param pos="0" name="service.vendor" value="Samba"/>
     <param pos="0" name="service.cpe23" value="cpe:/a:samba:samba:-"/>
   </fingerprint>
-</fingerprints>
+
+</fingerprints>