recog-intrigue 2.3.7

data/xml/x11_banners.xml

@@ -0,0 +1,232 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<fingerprints matches="x11.vendor" protocol="x11">
+  <!--
+  During X11 connection setup as specified in the X11 protocol
+  (page 111 https://www.x.org/archive/X11R7.5/doc/x11proto/proto.pdf) a
+  success message is sent when a clients request to connect is successful.
+  This success response contains a vendor field which can be used to
+  fingerprint systems with the following fingerprints.
+  -->
+  <fingerprint pattern="^AT&amp;T Laboratories Cambridge$">
+    <description>AT&amp;T Laboratories Cambridge</description>
+    <example>AT&amp;T Laboratories Cambridge</example>
+    <param pos="0" name="service.vendor" value="AT&amp;T Laboratories Cambridge"/>
+    <param pos="0" name="service.product" value="Xvnc"/>
+  </fingerprint>
+  <fingerprint pattern="^CentOS$">
+    <description>CentOS</description>
+    <example>CentOS</example>
+    <param pos="0" name="os.vendor" value="CentOS"/>
+    <param pos="0" name="service.vendor" value="X.Org"/>
+    <param pos="0" name="service.product" value="X.Org X11"/>
+    <param pos="0" name="service.cpe23" value="cpe:/a:x.org:x11:-"/>
+    <param pos="0" name="os.product" value="Linux"/>
+    <param pos="0" name="os.family" value="Linux"/>
+    <param pos="0" name="os.cpe23" value="cpe:/o:centos:centos:-"/>
+  </fingerprint>
+  <fingerprint pattern="^Colin Harrison$">
+    <description>Colin Harrison</description>
+    <example>Colin Harrison</example>
+    <param pos="0" name="os.vendor" value="Microsoft"/>
+    <param pos="0" name="service.vendor" value="Colin Harrison"/>
+    <param pos="0" name="service.product" value="Xming"/>
+    <param pos="0" name="os.product" value="Windows"/>
+    <param pos="0" name="os.family" value="Windows"/>
+    <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
+  </fingerprint>
+  <fingerprint pattern="^DECWINDOWS DigitalEquipmentCorporation, eXcursion$">
+    <description>DECWINDOWS DigitalEquipmentCorporation, eXcursion</description>
+    <example>DECWINDOWS DigitalEquipmentCorporation, eXcursion</example>
+    <param pos="0" name="os.vendor" value="Microsoft"/>
+    <param pos="0" name="service.vendor" value="DEC"/>
+    <param pos="0" name="service.product" value="DEC eXcursion X Server"/>
+    <param pos="0" name="os.product" value="Windows"/>
+    <param pos="0" name="os.family" value="Windows"/>
+    <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
+  </fingerprint>
+  <fingerprint pattern="^DECWINDOWS Hewlett-Packard Development Company OpenVMS$">
+    <description>DECWINDOWS Hewlett-Packard Development Company OpenVMS</description>
+    <example>DECWINDOWS Hewlett-Packard Development Company OpenVMS</example>
+    <param pos="0" name="os.vendor" value="DEC"/>
+    <param pos="0" name="service.vendor" value="DEC"/>
+    <param pos="0" name="service.product" value="OpenVMS"/>
+    <param pos="0" name="os.product" value="OpenVMS"/>
+    <param pos="0" name="os.family" value="OpenVMS"/>
+  </fingerprint>
+  <fingerprint pattern="^Fedora Project$">
+    <description>Fedora Project</description>
+    <example>Fedora Project</example>
+    <param pos="0" name="os.vendor" value="Red Hat"/>
+    <param pos="0" name="service.vendor" value="X.Org"/>
+    <param pos="0" name="service.product" value="X.Org X11"/>
+    <param pos="0" name="service.cpe23" value="cpe:/a:x.org:x11:-"/>
+    <param pos="0" name="os.product" value="Fedora Core Linux"/>
+    <param pos="0" name="os.family" value="Linux"/>
+    <param pos="0" name="os.cpe23" value="cpe:/o:redhat:fedora_core:-"/>
+  </fingerprint>
+  <fingerprint pattern="^freedesktop\.org$">
+    <description>freedesktop.org</description>
+    <example>freedesktop.org</example>
+    <param pos="0" name="os.vendor" value="Linux"/>
+    <param pos="0" name="service.vendor" value="X.Org"/>
+    <param pos="0" name="service.product" value="X.Org X11"/>
+    <param pos="0" name="service.cpe23" value="cpe:/a:x.org:x11:-"/>
+    <param pos="0" name="os.product" value="Linux"/>
+    <param pos="0" name="os.family" value="Linux"/>
+    <param pos="0" name="os.cpe23" value="cpe:/o:linux:linux_kernel:-"/>
+  </fingerprint>
+  <fingerprint pattern="^HC-Consult$">
+    <description>HC-Consult</description>
+    <example>HC-Consult</example>
+    <param pos="0" name="os.vendor" value="Microsoft"/>
+    <param pos="0" name="service.vendor" value="VcXsrv"/>
+    <param pos="0" name="service.product" value="VcXsrv"/>
+    <param pos="0" name="os.product" value="Windows"/>
+    <param pos="0" name="os.family" value="Windows"/>
+    <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
+  </fingerprint>
+  <fingerprint pattern="^Hummingbird Communications Ltd\.$|^Hummingbird Ltd\.$">
+    <description>Hummingbird Communications Ltd.</description>
+    <example>Hummingbird Communications Ltd.</example>
+    <example>Hummingbird Ltd.</example>
+    <param pos="0" name="os.vendor" value="Microsoft"/>
+    <param pos="0" name="service.vendor" value="Hummingbird Ltd."/>
+    <param pos="0" name="service.product" value="Hummingbird Exceed X server"/>
+    <param pos="0" name="os.product" value="Windows"/>
+    <param pos="0" name="os.family" value="Windows"/>
+    <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
+  </fingerprint>
+  <fingerprint pattern="^Labtam Inc$">
+    <description>Labtam Inc</description>
+    <example>Labtam Inc</example>
+    <param pos="0" name="os.vendor" value="Microsoft"/>
+    <param pos="0" name="service.vendor" value="Labtam Inc."/>
+    <param pos="0" name="service.product" value="XSecurePro"/>
+    <param pos="0" name="os.product" value="Windows"/>
+    <param pos="0" name="os.family" value="Windows"/>
+    <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
+  </fingerprint>
+  <fingerprint pattern="^Moba\/X$">
+    <description>Moba/X</description>
+    <example>Moba/X</example>
+    <param pos="0" name="os.vendor" value="Microsoft"/>
+    <param pos="0" name="service.vendor" value="Mobatek"/>
+    <param pos="0" name="service.product" value="MobaXterm"/>
+    <param pos="0" name="service.cpe23" value="cpe:/a:mobatek:mobaxterm:-"/>
+    <param pos="0" name="os.product" value="Windows"/>
+    <param pos="0" name="os.family" value="Windows"/>
+    <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
+  </fingerprint>
+  <fingerprint pattern="^MobaXterm$">
+    <description>MobaXterm</description>
+    <example>MobaXterm</example>
+    <param pos="0" name="os.vendor" value="Microsoft"/>
+    <param pos="0" name="service.vendor" value="Mobatek"/>
+    <param pos="0" name="service.product" value="MobaXterm"/>
+    <param pos="0" name="service.cpe23" value="cpe:/a:mobatek:mobaxterm:-"/>
+    <param pos="0" name="os.product" value="Windows"/>
+    <param pos="0" name="os.family" value="Windows"/>
+    <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
+  </fingerprint>
+  <fingerprint pattern="^NetSarang Computer, Inc\.$">
+    <description>NetSarang Computer, Inc.</description>
+    <example>NetSarang Computer, Inc.</example>
+    <param pos="0" name="os.vendor" value="Microsoft"/>
+    <param pos="0" name="service.vendor" value="NetSarang Computer, Inc."/>
+    <param pos="0" name="service.product" value="NetSarang XManager"/>
+    <param pos="0" name="os.product" value="Windows"/>
+    <param pos="0" name="os.family" value="Windows"/>
+    <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
+  </fingerprint>
+  <fingerprint pattern="^Open Text$">
+    <description>Open Text</description>
+    <example>Open Text</example>
+    <param pos="0" name="os.vendor" value="Microsoft"/>
+    <param pos="0" name="service.vendor" value="Open Text"/>
+    <param pos="0" name="service.product" value="OpenText Exceed"/>
+    <param pos="0" name="os.product" value="Windows"/>
+    <param pos="0" name="os.family" value="Windows"/>
+    <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
+  </fingerprint>
+  <fingerprint pattern="^Red Hat, Inc\.$">
+    <description>Red Hat, Inc.</description>
+    <example>Red Hat, Inc.</example>
+    <param pos="0" name="os.vendor" value="Red Hat"/>
+    <param pos="0" name="service.vendor" value="X.Org"/>
+    <param pos="0" name="service.product" value="X.Org X11"/>
+    <param pos="0" name="service.cpe23" value="cpe:/a:x.org:x11:-"/>
+    <param pos="0" name="os.product" value="Linux"/>
+    <param pos="0" name="os.family" value="Linux"/>
+    <param pos="0" name="os.cpe23" value="cpe:/o:redhat:linux:-"/>
+  </fingerprint>
+  <fingerprint pattern="^Santa Cruz Operation Inc\.$">
+    <description>Santa Cruz Operation Inc.</description>
+    <example>Santa Cruz Operation Inc.</example>
+    <param pos="0" name="os.vendor" value="SCO"/>
+    <param pos="0" name="service.vendor" value="SCO"/>
+    <param pos="0" name="service.product" value="SCO X server"/>
+    <param pos="0" name="os.product" value="SCO UNIX"/>
+    <param pos="0" name="os.family" value="SCO UNIX"/>
+  </fingerprint>
+  <fingerprint pattern="^StarNet Communications Corp\.$">
+    <description>StarNet Communications Corp.</description>
+    <example>StarNet Communications Corp.</example>
+    <param pos="0" name="os.vendor" value="Microsoft"/>
+    <param pos="0" name="service.vendor" value="StarNet Communications Corp."/>
+    <param pos="0" name="service.product" value="StarNet X-Win32"/>
+    <param pos="0" name="os.product" value="Windows"/>
+    <param pos="0" name="os.family" value="Windows"/>
+    <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
+  </fingerprint>
+  <fingerprint pattern="^Sun Microsystems, Inc\.$">
+    <description>Sun Microsystems, Inc.</description>
+    <example>Sun Microsystems, Inc.</example>
+    <param pos="0" name="os.vendor" value="Sun"/>
+    <param pos="0" name="service.vendor" value="Sun"/>
+    <param pos="0" name="service.product" value="XSun Solaris X11 server"/>
+    <param pos="0" name="os.product" value="Solaris"/>
+    <param pos="0" name="os.family" value="Solaris"/>
+    <param pos="0" name="os.cpe23" value="cpe:/o:sun:solaris:-"/>
+  </fingerprint>
+  <fingerprint pattern="^The Cygwin\/X Project$">
+    <description>The Cygwin/X Project</description>
+    <example>The Cygwin/X Project</example>
+    <param pos="0" name="os.vendor" value="Microsoft"/>
+    <param pos="0" name="service.vendor" value="Red Hat"/>
+    <param pos="0" name="service.product" value="Cygwin X Server Project"/>
+    <param pos="0" name="service.cpe23" value="cpe:/a:redhat:cygwin:-"/>
+    <param pos="0" name="os.product" value="Windows"/>
+    <param pos="0" name="os.family" value="Windows"/>
+    <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
+  </fingerprint>
+  <fingerprint pattern="^The X\.Org Foundation$">
+    <description>The X.Org Foundation</description>
+    <example>The X.Org Foundation</example>
+    <param pos="0" name="os.vendor" value="UNIX"/>
+    <param pos="0" name="service.vendor" value="X.Org"/>
+    <param pos="0" name="service.product" value="X.Org X11"/>
+    <param pos="0" name="service.cpe23" value="cpe:/a:x.org:x11:-"/>
+    <param pos="0" name="os.product" value="UNIX"/>
+    <param pos="0" name="os.family" value="UNIX"/>
+  </fingerprint>
+  <fingerprint pattern="^The XFree86 Project, Inc$">
+    <description>The XFree86 Project, Inc</description>
+    <example>The XFree86 Project, Inc</example>
+    <param pos="0" name="os.vendor" value="UNIX"/>
+    <param pos="0" name="service.vendor" value="XFree86"/>
+    <param pos="0" name="service.product" value="XFree86"/>
+    <param pos="0" name="service.cpe23" value="cpe:/a:xfree86:xfree86:-"/>
+    <param pos="0" name="os.product" value="UNIX"/>
+    <param pos="0" name="os.family" value="UNIX"/>
+  </fingerprint>
+  <fingerprint pattern="^WRQ, Inc\.$">
+    <description>WRQ, Inc.</description>
+    <example>WRQ, Inc.</example>
+    <param pos="0" name="os.vendor" value="Microsoft"/>
+    <param pos="0" name="service.vendor" value="WRQ, Inc."/>
+    <param pos="0" name="service.product" value="ReflectionX"/>
+    <param pos="0" name="os.product" value="Windows"/>
+    <param pos="0" name="os.family" value="Windows"/>
+    <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
+  </fingerprint>
+</fingerprints>

data/xml/x509_issuers.xml

@@ -0,0 +1,134 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<fingerprints matches="x509.issuer" protocol="x509">
+  <!--
+  This fingerprint set matches the Issuer field of x509 certificates. These x509
+  certificates may be sourced from any SSL or TLS service. If a particular system
+  has identical subject and issuer fields, the subject field should be preferred.
+
+  The format of the Issuer field is built from the x509 distinguished names using
+  a specific order. Please see the comments in x509_subjects.xml for details.
+
+  -->
+  <!-- Chromecast and various devices that support the Cast protocol -->
+  <fingerprint pattern="^CN=Chromecast ICA (\d+)\s*\(?([^,\)]*)\)?,OU=Cast,O=Google Inc,L=Mountain View,ST=California,C=US$">
+    <description>Google Chromecast</description>
+    <example chromecast.generation="3">CN=Chromecast ICA 3,OU=Cast,O=Google Inc,L=Mountain View,ST=California,C=US</example>
+    <example chromecast.generation="4" chromecast.capabilities="Audio">CN=Chromecast ICA 4 (Audio),OU=Cast,O=Google Inc,L=Mountain View,ST=California,C=US</example>
+    <example chromecast.generation="5" chromecast.capabilities="4K">CN=Chromecast ICA 5 (4K),OU=Cast,O=Google Inc,L=Mountain View,ST=California,C=US</example>
+    <example chromecast.generation="6" chromecast.capabilities="Audio Assist">CN=Chromecast ICA 6 (Audio Assist),OU=Cast,O=Google Inc,L=Mountain View,ST=California,C=US</example>
+    <example chromecast.generation="7" chromecast.capabilities="Audio Assist 2">CN=Chromecast ICA 7 (Audio Assist 2),OU=Cast,O=Google Inc,L=Mountain View,ST=California,C=US</example>
+    <example chromecast.generation="9" chromecast.capabilities="Audio Assist">CN=Chromecast ICA 9 (Audio Assist),OU=Cast,O=Google Inc,L=Mountain View,ST=California,C=US</example>
+    <example chromecast.generation="11" chromecast.capabilities="Video Assist">CN=Chromecast ICA 11 (Video Assist),OU=Cast,O=Google Inc,L=Mountain View,ST=California,C=US</example>
+    <example chromecast.generation="12">CN=Chromecast ICA 12,OU=Cast,O=Google Inc,L=Mountain View,ST=California,C=US</example>
+    <param pos="0" name="os.vendor" value="Google"/>
+    <param pos="0" name="os.product" value="ChromeOS"/>
+    <param pos="0" name="hw.device" value="Media Server"/>
+    <param pos="0" name="hw.vendor" value="Google"/>
+    <param pos="0" name="hw.product" value="Chromecast"/>
+    <param pos="1" name="chromecast.generation"/>
+    <param pos="2" name="chromecast.capabilities"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=Asus fugu Cast ICA,OU=Widevine,O=Google Inc,L=Kirkland,ST=Washington,C=US$">
+    <description>ASUS Nexus Player (Android) with Google Cast</description>
+    <example>CN=Asus fugu Cast ICA,OU=Widevine,O=Google Inc,L=Kirkland,ST=Washington,C=US</example>
+    <param pos="0" name="os.vendor" value="Google"/>
+    <param pos="0" name="os.cpe23" value="cpe:/o:google:android:-"/>
+    <param pos="0" name="os.family" value="Linux"/>
+    <param pos="0" name="os.product" value="Android"/>
+    <param pos="0" name="hw.device" value="Media Server"/>
+    <param pos="0" name="hw.vendor" value="ASUS"/>
+    <param pos="0" name="hw.product" value="Nexus Player"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=Sony amai Cast ICA,OU=Widevine,O=Google Inc,L=Kirkland,ST=Washington,C=US$">
+    <description>Sony SmartTV (Android) with Google Cast</description>
+    <example>CN=Sony amai Cast ICA,OU=Widevine,O=Google Inc,L=Kirkland,ST=Washington,C=US</example>
+    <param pos="0" name="os.vendor" value="Google"/>
+    <param pos="0" name="os.cpe23" value="cpe:/o:google:android:-"/>
+    <param pos="0" name="os.family" value="Linux"/>
+    <param pos="0" name="os.product" value="Android"/>
+    <param pos="0" name="hw.device" value="Smart TV"/>
+    <param pos="0" name="hw.vendor" value="Sony"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=Cast TV ICA \(Vizio\),OU=Cast,O=Google Inc,L=Mountain View,ST=California,C=US$">
+    <description>Vizio SmartTV (Android) with Google Cast</description>
+    <example>CN=Cast TV ICA (Vizio),OU=Cast,O=Google Inc,L=Mountain View,ST=California,C=US</example>
+    <param pos="0" name="os.vendor" value="Google"/>
+    <param pos="0" name="os.cpe23" value="cpe:/o:google:android:-"/>
+    <param pos="0" name="os.family" value="Linux"/>
+    <param pos="0" name="os.product" value="Android"/>
+    <param pos="0" name="hw.device" value="Smart TV"/>
+    <param pos="0" name="hw.vendor" value="Vizio"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=NVidia Shield Cast ICA,OU=Widevine,O=Google Inc,L=Kirkland,ST=Washington,C=US$">
+    <description>NVIDIA SHIELD (Android) with Google Cast</description>
+    <example>CN=NVidia Shield Cast ICA,OU=Widevine,O=Google Inc,L=Kirkland,ST=Washington,C=US</example>
+    <param pos="0" name="os.vendor" value="Google"/>
+    <param pos="0" name="os.cpe23" value="cpe:/o:google:android:-"/>
+    <param pos="0" name="os.family" value="Linux"/>
+    <param pos="0" name="os.product" value="Android"/>
+    <param pos="0" name="hw.device" value="Tablet"/>
+    <param pos="0" name="hw.vendor" value="NVIDIA"/>
+    <param pos="0" name="hw.product" value="SHIELD"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=NVidia Darcy NVidia Tegra K1-Denver Cast ICA,OU=Widevine,O=Google Inc,L=Kirkland,ST=Washington,C=US$">
+    <description>NVIDIA SHIELD (Android) with Google Cast (Darcy)</description>
+    <example>CN=NVidia Darcy NVidia Tegra K1-Denver Cast ICA,OU=Widevine,O=Google Inc,L=Kirkland,ST=Washington,C=US</example>
+    <param pos="0" name="os.vendor" value="Google"/>
+    <param pos="0" name="os.cpe23" value="cpe:/o:google:android:-"/>
+    <param pos="0" name="os.family" value="Linux"/>
+    <param pos="0" name="os.product" value="Android"/>
+    <param pos="0" name="hw.device" value="Tablet"/>
+    <param pos="0" name="hw.vendor" value="NVIDIA"/>
+    <param pos="0" name="hw.product" value="SHIELD"/>
+  </fingerprint>
+  <!-- End of Chromecast -->
+  <fingerprint pattern="^CN=Yealink Equipment Issuing CA,OU=yealink\.com,O=Yealink Network Technology Co\.\\,Ltd.,L=Xiamen,ST=Fujian,C=CN$">
+    <description>Yealink VoIP Phone</description>
+    <example>CN=Yealink Equipment Issuing CA,OU=yealink.com,O=Yealink Network Technology Co.\,Ltd.,L=Xiamen,ST=Fujian,C=CN</example>
+    <param pos="0" name="os.vendor" value="Yealink"/>
+    <param pos="0" name="os.family" value="Linux"/>
+    <param pos="0" name="os.product" value="Linux"/>
+    <param pos="0" name="hw.device" value="VoIP"/>
+    <param pos="0" name="hw.vendor" value="Yealink"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=[a-zA-Z0-9]+,OU=Internally Generated Certificate,O=American Power Conversion Corp,L=Default Locality,ST=Default State,C=US$">
+    <description>APC UPS</description>
+    <example>CN=ZA1117619249,OU=Internally Generated Certificate,O=American Power Conversion Corp,L=Default Locality,ST=Default State,C=US</example>
+    <param pos="0" name="hw.device" value="Power device"/>
+    <param pos="0" name="hw.vendor" value="APC"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=Temporary CA [a-fA-F0-9]{8}\-[a-fA-F0-9]{4}\-[a-fA-F0-9]{4}\-[a-fA-F0-9]{4}\-[a-fA-F0-9]{12},OU=Temporary CA">
+    <description>Cisco Video Communication Server</description>
+    <example>CN=Temporary CA 218131fe-8af4-11e7-aa6e-9950d6bbaf74,OU=Temporary CA 218131fe-8af4-11e7-aa6e-9950d6bbaf74,O=Temporary CA 218131fe-8af4-11e7-aa6e-9950d6bbaf74</example>
+    <param pos="0" name="hw.device" value="Video Conference"/>
+    <param pos="0" name="hw.vendor" value="Cisco"/>
+    <param pos="0" name="hw.product" value="TelePresence"/>
+  </fingerprint>
+  <fingerprint pattern="^O=VMware Installer$">
+    <description>VMWare ESXi w/Installer</description>
+    <example>O=VMware Installer</example>
+    <param pos="0" name="os.vendor" value="VMWare"/>
+    <param pos="0" name="os.cpe23" value="cpe:/o:vmware:esxi:-"/>
+    <param pos="0" name="os.product" value="ESXi"/>
+    <param pos="0" name="os.device" value="Hypervisor"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=CA,OU=VMware Engineering,O=vCenter,ST=California,C=US$">
+    <description>VMWare vCenter</description>
+    <example>CN=CA,OU=VMware Engineering,O=vCenter,ST=California,C=US</example>
+    <param pos="0" name="service.vendor" value="VMWare"/>
+    <param pos="0" name="service.product" value="vCenter"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=Default Issuer \(Do not trust\),OU=ISS,O=Hewlett Packard Enterprise,L=Houston,ST=Texas,C=US$">
+    <description>HP iLO</description>
+    <example>CN=Default Issuer (Do not trust),OU=ISS,O=Hewlett Packard Enterprise,L=Houston,ST=Texas,C=US</example>
+    <param pos="0" name="hw.device" value="Lights Out Management"/>
+    <param pos="0" name="hw.vendor" value="HP"/>
+    <param pos="0" name="hw.family" value="iLO"/>
+    <param pos="0" name="hw.cpe23" value="cpe:/h:hp:integrated_lights_out:-"/>
+    <param pos="0" name="hw.product" value="iLO"/>
+    <param pos="0" name="os.device" value="Lights Out Management"/>
+    <param pos="0" name="os.vendor" value="HP"/>
+    <param pos="0" name="os.family" value="iLO"/>
+    <param pos="0" name="os.product" value="iLO"/>
+  </fingerprint>
+</fingerprints>

data/xml/x509_subjects.xml

@@ -0,0 +1,1268 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<fingerprints matches="x509.subject" protocol="x509">
+  <!--
+  This fingerprint set matches the Subject field of x509 certificates. These x509
+  certificates may be sourced from any SSL or TLS service. If a particular system
+  has identical subject and issuer fields, the subject field should be preferred.
+
+  The format of the Subject field is built from the x509 distinguished names using
+  a specific order. This order matches the Go implementation at the URL:
+    https://golang.org/src/crypto/x509/pkix/pkix.go#203
+
+  The ToRDNSequence() function builds the string in reverse order:
+
+        func (n Name) ToRDNSequence() (ret RDNSequence) {
+            ret = n.appendRDNs(ret, n.Country, oidCountry)
+            ret = n.appendRDNs(ret, n.Province, oidProvince)
+            ret = n.appendRDNs(ret, n.Locality, oidLocality)
+            ret = n.appendRDNs(ret, n.StreetAddress, oidStreetAddress)
+            ret = n.appendRDNs(ret, n.PostalCode, oidPostalCode)
+            ret = n.appendRDNs(ret, n.Organization, oidOrganization)
+            ret = n.appendRDNs(ret, n.OrganizationalUnit, oidOrganizationalUnit)
+            if len(n.CommonName) > 0 {
+                ret = n.appendRDNs(ret, []string{n.CommonName}, oidCommonName)
+            }
+            if len(n.SerialNumber) > 0 {
+                ret = n.appendRDNs(ret, []string{n.SerialNumber}, oidSerialNumber)
+            }
+            for _, atv := range n.ExtraNames {
+                ret = append(ret, []AttributeTypeAndValue{atv})
+            }
+
+            return ret
+        }
+
+    All names are separated by commas and any commas inside a name are escaped with a
+    single backslash character. See RFC 2253 for additional details on formatting.
+
+    Practically, most Subjects start with the Common Name (CN=) and then step through
+    Organization Unit (OU), Organization (O), and then some level of location, but
+    typically Locality (L) and Country (C). Names are guaranteed to be listed in
+    the order described above, but may start at any point in the list. For example,
+    Subjects may start with a Serial Number (SERIALNUMBER=) or even Extra Names, but
+    these are somewhat rare. Keep this name order in mind when working on these
+    fingerprints.
+
+    The same constraints also apply to the x509 Issuers (x509_issuers.xml).
+
+  -->
+  <fingerprint pattern="^CN=([0-9a-fA-F]{2}:[0-9a-fA-F]{2}:[0-9a-fA-F]{2}:[0-9a-fA-F]{2}:[0-9a-fA-F]{2}:[0-9a-fA-F]{2}),OU=([^,]+),O=Araknis Networks \(TM\),L=Charlotte,C=US$">
+    <description>Araknis Networks Router</description>
+    <example host.mac="d4:6a:91:7a:a3:c4" hw.product="AN-300-RT-4L2W">CN=d4:6a:91:7a:a3:c4,OU=AN-300-RT-4L2W,O=Araknis Networks (TM),L=Charlotte,C=US</example>
+    <param pos="0" name="hw.device" value="Router"/>
+    <param pos="0" name="hw.vendor" value="Araknis Networks"/>
+    <param pos="2" name="hw.product"/>
+    <param pos="1" name="host.mac"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=([a-fA-F0-9:]+),OU=([^,]+),O=Cisco-Linksys\\, LLC">
+    <description>Cisco / Linksys Router</description>
+    <example host.mac="00:22:6b:ef:1e:d0" hw.product="RV042">CN=00:22:6b:ef:1e:d0,OU=RV042,O=Cisco-Linksys\, LLC,L=Irvine,C=US</example>
+    <param pos="0" name="hw.device" value="Broadband Router"/>
+    <param pos="0" name="hw.vendor" value="Cisco"/>
+    <param pos="2" name="hw.product"/>
+    <param pos="1" name="host.mac"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=([a-fA-F0-9\:]+),OU=([^,]+),O=Cisco Systems\\, Inc\.">
+    <description>Cisco Post-Linksys Router</description>
+    <example host.mac="74:a2:e6:5c:99:21" hw.product="RV042G">CN=74:a2:e6:5c:99:21,OU=RV042G,O=Cisco Systems\, Inc.,L=Irvine,C=US</example>
+    <example host.mac="4C4E315901D0" hw.product="RV180">CN=4C4E315901D0,OU=RV180,O=Cisco Systems\, Inc.,C=US</example>
+    <param pos="0" name="hw.device" value="Broadband Router"/>
+    <param pos="0" name="hw.vendor" value="Cisco"/>
+    <param pos="2" name="hw.product"/>
+    <param pos="1" name="host.mac"/>
+  </fingerprint>
+  <fingerprint pattern="^SERIALNUMBER=PID:([^ ]+) SN:([^,]+),CN=(?:[a-zA-Z0-9\-]+)-SEP([a-fA-F0-9]{12}),OU=[CV]TG,O=Cisco Systems Inc\.$">
+    <description>Cisco IP phone with serial number</description>
+    <example host.mac="B07D47D33A1C" hw.product="CP-8851" cisco.serial_number="FCH1924AHCA">SERIALNUMBER=PID:CP-8851 SN:FCH1924AHCA,CN=CP-8851-SEPB07D47D33A1C,OU=CTG,O=Cisco Systems Inc.</example>
+    <example host.mac="64D989000000" hw.product="CP-9951" cisco.serial_number="FCH15200000">SERIALNUMBER=PID:CP-9951 SN:FCH15200000,CN=CP-9951-SEP64D989000000,OU=VTG,O=Cisco Systems Inc.</example>
+    <param pos="0" name="hw.device" value="VoIP"/>
+    <param pos="0" name="hw.vendor" value="Cisco"/>
+    <param pos="1" name="hw.product"/>
+    <param pos="2" name="cisco.serial_number"/>
+    <param pos="3" name="host.mac"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=SEP([a-fA-F0-9]{12}),O=TemporaryDefaultCertificate$">
+    <description>Cisco IP Phone without serial number</description>
+    <example host.mac="1C6A7AE57121">CN=SEP1C6A7AE57121,O=TemporaryDefaultCertificate</example>
+    <param pos="0" name="hw.device" value="VoIP"/>
+    <param pos="0" name="hw.vendor" value="Cisco"/>
+    <param pos="1" name="host.mac"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=Cambium WLAN AP,OU=Products,O=Cambium Networks Inc,L=San Jose,ST=CA,C=US$">
+    <description>Cambium Networks WAP</description>
+    <example>CN=Cambium WLAN AP,OU=Products,O=Cambium Networks Inc,L=San Jose,ST=CA,C=US</example>
+    <param pos="0" name="hw.device" value="WAP"/>
+    <param pos="0" name="hw.vendor" value="Cambium Networks"/>
+    <param pos="0" name="hw.product" value="WLAN AP"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=([^,]+),OU=Products,O=Cambium Networks Inc,L=San Jose,ST=CA,C=US$">
+    <description>Cambium Networks Router</description>
+    <example hw.product="R190V">CN=R190V,OU=Products,O=Cambium Networks Inc,L=San Jose,ST=CA,C=US</example>
+    <example hw.product="R200">CN=R200,OU=Products,O=Cambium Networks Inc,L=San Jose,ST=CA,C=US</example>
+    <param pos="0" name="hw.device" value="Router"/>
+    <param pos="0" name="hw.vendor" value="Cambium Networks"/>
+    <param pos="1" name="hw.product"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=Nepenthes Development Team,OU=anv,O=dionaea\.carnivore\.it,C=DE$">
+    <description>Nepenthes honeypot</description>
+    <example>CN=Nepenthes Development Team,OU=anv,O=dionaea.carnivore.it,C=DE</example>
+    <param pos="0" name="service.family" value="Nepenthes"/>
+    <param pos="0" name="service.product" value="Nepenthes"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=IPMI,OU=Software,O=Super Micro Computer,ST=California,C=US$">
+    <description>Super Micro IPMI Controller</description>
+    <example>CN=IPMI,OU=Software,O=Super Micro Computer,ST=California,C=US</example>
+    <param pos="0" name="hw.device" value="Lights Out Management"/>
+    <param pos="0" name="hw.vendor" value="Super Micro"/>
+    <param pos="0" name="hw.product" value="IPMI"/>
+    <param pos="0" name="os.vendor" value="Super Micro"/>
+    <param pos="0" name="os.product" value="ATEN Linux"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=iDRACdefault([a-fA-F0-9]{12}),OU=iDRAC Group,O=Dell Inc.,L=Round Rock,C=US$">
+    <description>Dell iDRAC Remote Access Controller w/MAC</description>
+    <example host.mac="0023AEF89AD1">CN=iDRACdefault0023AEF89AD1,OU=iDRAC Group,O=Dell Inc.,L=Round Rock,C=US</example>
+    <param pos="0" name="hw.device" value="Lights Out Management"/>
+    <param pos="0" name="hw.vendor" value="Dell"/>
+    <param pos="0" name="hw.product" value="iDRAC"/>
+    <param pos="0" name="os.vendor" value="Dell"/>
+    <param pos="0" name="os.product" value="iDRAC Linux"/>
+    <param pos="1" name="host.mac"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=idrac-([A-Z0-9]{7}),OU=Remote Access Group,O=Dell Inc\.,L=Round Rock,ST=Texas,C=US$">
+    <description>Dell iDRAC Remote Access Controller w/Service Tag</description>
+    <example dell.service_tag="JXJJC02">CN=idrac-JXJJC02,OU=Remote Access Group,O=Dell Inc.,L=Round Rock,ST=Texas,C=US</example>
+    <example dell.service_tag="FMDSJH3">CN=idrac-FMDSJH3,OU=Remote Access Group,O=Dell Inc.,L=Round Rock,ST=Texas,C=US</example>
+    <param pos="0" name="hw.device" value="Lights Out Management"/>
+    <param pos="0" name="hw.vendor" value="Dell"/>
+    <param pos="0" name="hw.product" value="iDRAC"/>
+    <param pos="0" name="os.vendor" value="Dell"/>
+    <param pos="0" name="os.product" value="iDRAC Linux"/>
+    <param pos="1" name="dell.service_tag"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=idrac.*,OU=Remote Access Group,O=Dell Inc\.,L=Round Rock,ST=Texas,C=US$">
+    <description>Dell iDRAC Remote Access Controller w/o Service Tag</description>
+    <example>CN=idrac-SVCTAG,OU=Remote Access Group,O=Dell Inc.,L=Round Rock,ST=Texas,C=US</example>
+    <example>CN=idrac-prosit-laks,OU=Remote Access Group,O=Dell Inc.,L=Round Rock,ST=Texas,C=US</example>
+    <example>CN=idrac-,OU=Remote Access Group,O=Dell Inc.,L=Round Rock,ST=Texas,C=US</example>
+    <example>CN=idrac,OU=Remote Access Group,O=Dell Inc.,L=Round Rock,ST=Texas,C=US</example>
+    <param pos="0" name="hw.device" value="Lights Out Management"/>
+    <param pos="0" name="hw.vendor" value="Dell"/>
+    <param pos="0" name="hw.product" value="iDRAC"/>
+    <param pos="0" name="os.vendor" value="Dell"/>
+    <param pos="0" name="os.product" value="iDRAC Linux"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=(i?DRAC\d+) default certificate,OU=Remote Access Group,O=Dell Inc\.,L=Round Rock,ST=Texas,C=US$">
+    <description>Dell iDRAC Remote Access Controller w/Version</description>
+    <example>CN=iDRAC7 default certificate,OU=Remote Access Group,O=Dell Inc.,L=Round Rock,ST=Texas,C=US</example>
+    <example>CN=iDRAC6 default certificate,OU=Remote Access Group,O=Dell Inc.,L=Round Rock,ST=Texas,C=US</example>
+    <example>CN=DRAC5 default certificate,OU=Remote Access Group,O=Dell Inc.,L=Round Rock,ST=Texas,C=US</example>
+    <param pos="0" name="hw.device" value="Lights Out Management"/>
+    <param pos="0" name="hw.vendor" value="Dell"/>
+    <param pos="1" name="hw.product"/>
+    <param pos="0" name="os.vendor" value="Dell"/>
+    <param pos="0" name="os.product" value="iDRAC Linux"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=iDRAC default certificate,OU=Server Firmware Group,O=Dell Inc\.,L=Round Rock,ST=Texas,C=US$">
+    <description>Dell iDRAC Remote Access Controller Default Certificate</description>
+    <example>CN=iDRAC default certificate,OU=Server Firmware Group,O=Dell Inc.,L=Round Rock,ST=Texas,C=US</example>
+    <param pos="0" name="hw.device" value="Lights Out Management"/>
+    <param pos="0" name="hw.vendor" value="Dell"/>
+    <param pos="0" name="hw.product" value="iDRAC"/>
+    <param pos="0" name="os.vendor" value="Dell"/>
+    <param pos="0" name="os.product" value="iDRAC Linux"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=XCC-([a-zA-Z0-9]+)-([a-zA-Z0-9]+),O=System X,L=RTP,ST=NC,C=US$">
+    <description>Lenovo XCC</description>
+    <example lenovo.machine_type="7X06" lenovo.machine_model="J1005NEX">CN=XCC-7X06-J1005NEX,O=System X,L=RTP,ST=NC,C=US</example>
+    <param pos="0" name="hw.device" value="Lights Out Management"/>
+    <param pos="0" name="hw.vendor" value="Lenovo"/>
+    <param pos="0" name="hw.family" value="System X"/>
+    <param pos="0" name="hw.product" value="XCC"/>
+    <param pos="0" name="os.vendor" value="Lenovo"/>
+    <param pos="0" name="os.product" value="XCC Linux"/>
+    <param pos="1" name="lenovo.machine_type"/>
+    <param pos="2" name="lenovo.machine_model"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=([A-Za-z0-9\_\-\.]+),OU=ISS,O=Hewlett-Packard Company,L=Houston,ST=Texas,C=US$">
+    <description>HP iLO</description>
+    <example>CN=SERVER-1231,OU=ISS,O=Hewlett-Packard Company,L=Houston,ST=Texas,C=US</example>
+    <param pos="0" name="hw.device" value="Lights Out Management"/>
+    <param pos="0" name="hw.vendor" value="HP"/>
+    <param pos="0" name="hw.family" value="iLO"/>
+    <param pos="0" name="hw.cpe23" value="cpe:/h:hp:integrated_lights_out:-"/>
+    <param pos="0" name="hw.product" value="iLO"/>
+    <param pos="0" name="os.device" value="Lights Out Management"/>
+    <param pos="0" name="os.vendor" value="HP"/>
+    <param pos="0" name="os.family" value="iLO"/>
+    <param pos="0" name="os.product" value="iLO"/>
+    <param pos="1" name="host.name"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=HP Service Processor,OU=UDU Service Tools,O=Hewlett-Packard Development Company\\, L\.P\.\\ ,L=Fremont,ST=California,C=US$">
+    <description>HP iLO - HP Service Processor</description>
+    <example>CN=HP Service Processor,OU=UDU Service Tools,O=Hewlett-Packard Development Company\, L.P.\ ,L=Fremont,ST=California,C=US</example>
+    <param pos="0" name="hw.device" value="Lights Out Management"/>
+    <param pos="0" name="hw.vendor" value="HP"/>
+    <param pos="0" name="hw.family" value="iLO"/>
+    <param pos="0" name="hw.cpe23" value="cpe:/h:hp:integrated_lights_out:-"/>
+    <param pos="0" name="hw.product" value="iLO"/>
+    <param pos="0" name="os.device" value="Lights Out Management"/>
+    <param pos="0" name="os.vendor" value="HP"/>
+    <param pos="0" name="os.family" value="iLO"/>
+    <param pos="0" name="os.product" value="iLO"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=OA\-([a-fA-F0-9]+),OU=Onboard Administrator,">
+    <description>HP iLO (Onboard Administrator)</description>
+    <example>CN=OA-001F296E21A3,OU=Onboard Administrator,O=Corp.,L=Location,ST=N/A,C=US</example>
+    <example>CN=OA-80C16E999999,OU=Onboard Administrator,O=Hewlett-Packard</example>
+    <param pos="0" name="hw.device" value="Lights Out Management"/>
+    <param pos="0" name="hw.vendor" value="HP"/>
+    <param pos="0" name="hw.family" value="iLO"/>
+    <param pos="0" name="hw.cpe23" value="cpe:/h:hp:integrated_lights_out:-"/>
+    <param pos="0" name="hw.product" value="iLO"/>
+    <param pos="0" name="os.device" value="Lights Out Management"/>
+    <param pos="0" name="os.vendor" value="HP"/>
+    <param pos="0" name="os.family" value="iLO"/>
+    <param pos="0" name="os.product" value="iLO"/>
+    <param pos="1" name="host.mac"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=([A-Za-z0-9\_\-\.]+),OU=Hewlett Packard Enterprise Network Management Software \(SMH\),O=Hewlett Packard Enterprise,L=Houston,ST=Texas,C=US$">
+    <description>HP iLO - Enterprise Mgmt variant</description>
+    <example>CN=bigsrv99,OU=Hewlett Packard Enterprise Network Management Software (SMH),O=Hewlett Packard Enterprise,L=Houston,ST=Texas,C=US</example>
+    <param pos="0" name="hw.device" value="Lights Out Management"/>
+    <param pos="0" name="hw.vendor" value="HP"/>
+    <param pos="0" name="hw.family" value="iLO"/>
+    <param pos="0" name="hw.cpe23" value="cpe:/h:hp:integrated_lights_out:-"/>
+    <param pos="0" name="hw.product" value="iLO"/>
+    <param pos="0" name="os.device" value="Lights Out Management"/>
+    <param pos="0" name="os.vendor" value="HP"/>
+    <param pos="0" name="os.family" value="iLO"/>
+    <param pos="0" name="os.product" value="iLO"/>
+    <param pos="1" name="host.name"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=Oracle Integrated Lights Out Manager,O=Oracle America\\, Inc\.,L=Redwood Shores,ST=California,C=US$">
+    <description>Oracle iLO</description>
+    <example>CN=Oracle Integrated Lights Out Manager,O=Oracle America\, Inc.,L=Redwood Shores,ST=California,C=US</example>
+    <param pos="0" name="hw.device" value="Lights Out Management"/>
+    <param pos="0" name="hw.vendor" value="Oracle"/>
+    <param pos="0" name="hw.family" value="ILOM"/>
+    <param pos="0" name="hw.product" value="ILOM"/>
+    <param pos="0" name="os.device" value="Lights Out Management"/>
+    <param pos="0" name="os.vendor" value="Oracle"/>
+    <param pos="0" name="os.family" value="ILOM"/>
+    <param pos="0" name="os.product" value="ILOM"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=AMI,OU=Service Processors,O=American Megatrends Inc">
+    <description>AMI MegaRAC LOM</description>
+    <example>CN=AMI,OU=Service Processors,O=American Megatrends Inc.,L=Norcross,ST=Georgia,C=US</example>
+    <example>CN=AMI,OU=Service Processors,O=American Megatrends Inc,L=Atlanta,ST=Georgia,C=US</example>
+    <param pos="0" name="hw.device" value="Lights Out Management"/>
+    <param pos="0" name="hw.vendor" value="AMI"/>
+    <param pos="0" name="hw.family" value="MegaRAC"/>
+    <param pos="0" name="hw.product" value="MegaRAC"/>
+    <param pos="0" name="os.device" value="Lights Out Management"/>
+    <param pos="0" name="os.vendor" value="AMI"/>
+    <param pos="0" name="os.family" value="MegaRAC"/>
+    <param pos="0" name="os.product" value="MegaRAC"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=C-series CIMC,OU=PID:([^ ]+) SERIAL:([^,]+),O=Cisco">
+    <description>Cisco Integrated Management Controller</description>
+    <example cisco.serial_number="FCH18999AAA" cisco.imc_model="UCSC-C220-M3S">CN=C-series CIMC,OU=PID:UCSC-C220-M3S SERIAL:FCH18999AAA,O=Cisco Self Signed,L=San Jose,ST=California,C=US</example>
+    <param pos="0" name="hw.device" value="Lights Out Management"/>
+    <param pos="0" name="hw.vendor" value="Cisco"/>
+    <param pos="0" name="hw.product" value="IMC"/>
+    <param pos="0" name="os.vendor" value="Cisco"/>
+    <param pos="0" name="os.family" value="Linux"/>
+    <param pos="0" name="os.product" value="IMC"/>
+    <param pos="2" name="cisco.serial_number"/>
+    <param pos="1" name="cisco.imc_model"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=C220-(FCH[^,]+),OU=null,O=Cisco Systems Inc">
+    <description>Cisco Integrated Management Controller C220</description>
+    <example cisco.serial_number="FCH17999AAA">CN=C220-FCH17999AAA,OU=null,O=Cisco Systems Inc.,L=San Jose,ST=California,C=US</example>
+    <param pos="0" name="hw.device" value="Lights Out Management"/>
+    <param pos="0" name="hw.vendor" value="Cisco"/>
+    <param pos="0" name="hw.product" value="IMC"/>
+    <param pos="0" name="os.vendor" value="Cisco"/>
+    <param pos="0" name="os.family" value="Linux"/>
+    <param pos="0" name="os.product" value="IMC"/>
+    <param pos="1" name="cisco.serial_number"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=avocent.com,OU=AESS,O=Avocent,L=Sunrise,ST=FL,C=US$">
+    <description>Avocent KVM</description>
+    <example>CN=avocent.com,OU=AESS,O=Avocent,L=Sunrise,ST=FL,C=US</example>
+    <param pos="0" name="hw.device" value="KVM"/>
+    <param pos="0" name="hw.vendor" value="Avocent"/>
+    <param pos="0" name="os.device" value="KVM"/>
+    <param pos="0" name="os.vendor" value="Avocent"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=Avocent Mergepoint Unity,O=Avocent Mergepoint Unity,L=Huntsville,ST=Alabama,C=US$">
+    <description>Avocent Mergepoint KVM</description>
+    <example>CN=Avocent Mergepoint Unity,O=Avocent Mergepoint Unity,L=Huntsville,ST=Alabama,C=US</example>
+    <param pos="0" name="hw.device" value="KVM"/>
+    <param pos="0" name="hw.vendor" value="Avocent"/>
+    <param pos="0" name="hw.product" value="Mergepoint"/>
+    <param pos="0" name="os.device" value="KVM"/>
+    <param pos="0" name="os.vendor" value="Avocent"/>
+    <param pos="0" name="os.product" value="Mergepoint"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=HP Jetdirect [a-zA-Z0-9]+,OU=([a-fA-F0-9]{12})\+OU=([a-zA-Z0-9]+),O=Hewlett-Packard Co\.$">
+    <description>HP Jet Direct - with host MAC and product</description>
+    <example host.mac="2C413883186A" hw.product="J8028E">CN=HP Jetdirect 38831831,OU=2C413883186A+OU=J8028E,O=Hewlett-Packard Co.</example>
+    <example os.product="J8016E">CN=HP Jetdirect FBFA31E7,OU=8851FBE33ABB+OU=J8016E,O=Hewlett-Packard Co.</example>
+    <param pos="0" name="hw.device" value="Printer"/>
+    <param pos="0" name="hw.vendor" value="HP"/>
+    <param pos="0" name="hw.family" value="JetDirect"/>
+    <param pos="0" name="os.device" value="Printer"/>
+    <param pos="0" name="os.vendor" value="HP"/>
+    <param pos="0" name="os.family" value="JetDirect"/>
+    <param pos="1" name="host.mac"/>
+    <param pos="2" name="hw.product"/>
+    <param pos="2" name="os.product"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=([a-zA-Z0-9\.\-\_]+),OU=HP-IPG,O=HP,L=Vancouver,ST=Washington,C=US$">
+    <description>HP Jet Direct</description>
+    <example host.name="HPD49F21">CN=HPD49F21,OU=HP-IPG,O=HP,L=Vancouver,ST=Washington,C=US</example>
+    <param pos="0" name="hw.device" value="Printer"/>
+    <param pos="0" name="hw.vendor" value="HP"/>
+    <param pos="0" name="hw.family" value="JetDirect"/>
+    <param pos="0" name="os.device" value="Printer"/>
+    <param pos="0" name="os.vendor" value="HP"/>
+    <param pos="0" name="os.family" value="JetDirect"/>
+    <param pos="1" name="host.name"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=(?:Sourcefire3D|firepower|ciscoasa),OU=Intrusion Management System,O=(?:Sourcefire\\, Inc.|Cisco Systems\\, Inc),C=US$">
+    <description>Cisco Firepower</description>
+    <example>CN=firepower,OU=Intrusion Management System,O=Cisco Systems\, Inc,C=US</example>
+    <example>CN=ciscoasa,OU=Intrusion Management System,O=Cisco Systems\, Inc,C=US</example>
+    <example>CN=Sourcefire3D,OU=Intrusion Management System,O=Sourcefire\, Inc.,C=US</example>
+    <param pos="0" name="hw.device" value="IPS"/>
+    <param pos="0" name="hw.vendor" value="Cisco"/>
+    <param pos="0" name="hw.product" value="Firepower"/>
+    <param pos="0" name="os.device" value="IPS"/>
+    <param pos="0" name="os.vendor" value="Cisco"/>
+    <param pos="0" name="os.product" value="Firepower"/>
+    <param pos="0" name="os.family" value="Linux"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=ASA Temporary Self Signed Certificate$">
+    <description>Cisco ASA Temp Cert</description>
+    <example>CN=ASA Temporary Self Signed Certificate</example>
+    <param pos="0" name="os.vendor" value="Cisco"/>
+    <param pos="0" name="os.family" value="Adaptive Security Appliance"/>
+    <param pos="0" name="os.product" value="Adaptive Security Appliance"/>
+    <param pos="0" name="os.cpe23" value="cpe:/o:cisco:adaptive_security_appliance"/>
+    <param pos="0" name="hw.vendor" value="Cisco"/>
+    <param pos="0" name="hw.family" value="Adaptive Security Appliance"/>
+    <param pos="0" name="hw.product" value="Adaptive Security Appliance"/>
+    <param pos="0" name="hw.device" value="Firewall"/>
+    <param pos="0" name="hw.cpe23" value="cpe:/h:cisco:adaptive_security_appliance:-"/>
+  </fingerprint>
+
+  <fingerprint pattern="^SERIALNUMBER=([a-zA-Z0-9]+),CN=DEVICE-vWLC,O=Cisco Virtual WLC$">
+    <description>Cisco vWLC</description>
+    <example cisco.serial_number="9C89M2088D1">SERIALNUMBER=9C89M2088D1,CN=DEVICE-vWLC,O=Cisco Virtual WLC</example>
+    <param pos="0" name="os.vendor" value="Cisco"/>
+    <param pos="0" name="os.device" value="Wireless Controller"/>
+    <param pos="0" name="os.product" value="Virtual WLC"/>
+    <param pos="0" name="os.cpe23" value="cpe:/o:cisco:wireless_lan_controller:-"/>
+    <param pos="0" name="hw.vendor" value="Cisco"/>
+    <param pos="0" name="hw.device" value="Wireless Controller"/>
+    <param pos="0" name="hw.product" value="Virtual WLC"/>
+    <param pos="1" name="cisco.serial_number"/>
+  </fingerprint>
+
+  <fingerprint pattern="^CN=[a-zA-Z0-9\.\-\_]+,OU=DeviceSSL \(WebAdmin\),O=Cisco Systems Inc\.,C=US$">
+    <description>Cisco WLC</description>
+    <example>CN=169.254.1.1,OU=DeviceSSL (WebAdmin),O=Cisco Systems Inc.,C=US</example>
+    <param pos="0" name="os.vendor" value="Cisco"/>
+    <param pos="0" name="os.device" value="Wireless Controller"/>
+    <param pos="0" name="os.product" value="Wireless Controller"/>
+    <param pos="0" name="os.cpe23" value="cpe:/o:cisco:wireless_lan_controller:-"/>
+    <param pos="0" name="hw.vendor" value="Cisco"/>
+    <param pos="0" name="hw.device" value="Wireless Controller"/>
+    <param pos="0" name="hw.product" value="Wireless Controller"/>
+  </fingerprint>
+
+  <fingerprint pattern="^CN=pca,OU=Cisco Prime Collaboration Manager,O=Cisco,L=San Jose,ST=California,C=US$">
+    <description>Cisco Primary Collaboration Manager</description>
+    <example>CN=pca,OU=Cisco Prime Collaboration Manager,O=Cisco,L=San Jose,ST=California,C=US</example>
+    <param pos="0" name="os.vendor" value="Cisco"/>
+    <param pos="0" name="os.device" value="Network Management Device"/>
+    <param pos="0" name="os.product" value="Prime Collaboration Manager"/>
+    <param pos="0" name="hw.vendor" value="Cisco"/>
+    <param pos="0" name="hw.device" value="Network Management Device"/>
+    <param pos="0" name="hw.product" value="Prime Collaboration Manager"/>
+  </fingerprint>
+
+  <fingerprint pattern="^CN=synology\.com.*,O=Synology Inc\.,L=Taipei.*,C=TW$">
+    <description>Synology NAS</description>
+    <example>CN=synology.com,OU=FTP Team,O=Synology Inc.,L=Taipei,ST=Taiwan,C=TW</example>
+    <example>CN=synology.com,O=Synology Inc.,L=Taipei,C=TW</example>
+    <param pos="0" name="hw.vendor" value="Synology"/>
+    <param pos="0" name="hw.family" value="DiskStation"/>
+    <param pos="0" name="hw.device" value="Storage"/>
+    <param pos="0" name="os.device" value="Storage"/>
+    <param pos="0" name="os.family" value="Linux"/>
+    <param pos="0" name="os.product" value="DSM"/>
+    <param pos="0" name="os.vendor" value="Synology"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=(?:\*\.)?([a-zA-Z0-9\.\_\-]+)\.wd2go\.com">
+    <description>Western Digital WD2GO Devices</description>
+    <example wd2go.device_id="device1133796-01b3e3fa">CN=device1133796-01b3e3fa.wd2go.com,OU=Domain Control Validated+OU=Hosted by Western Digital Corporation+OU=COMODO SSL Unified Communications</example>
+    <example wd2go.device_id="device4113440">CN=*.device4113440.wd2go.com,OU=Branded Products,O=Western Digital,L=Mountain View,ST=California,C=US</example>
+    <param pos="0" name="hw.vendor" value="Western Digital"/>
+    <param pos="0" name="hw.family" value="WD2GO"/>
+    <param pos="0" name="hw.device" value="Storage"/>
+    <param pos="0" name="os.family" value="Linux"/>
+    <param pos="0" name="os.vendor" value="Western Digital"/>
+    <param pos="0" name="os.device" value="Storage"/>
+    <param pos="1" name="wd2go.device_id"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=Seagate Technology LLC,O=Seagate Technology LLC,L=Cupertino,ST=California,C=US$">
+    <description>Seagate NAS</description>
+    <example>CN=Seagate Technology LLC,O=Seagate Technology LLC,L=Cupertino,ST=California,C=US</example>
+    <param pos="0" name="hw.vendor" value="Seagate"/>
+    <param pos="0" name="hw.device" value="Storage"/>
+    <param pos="0" name="os.vendor" value="Seagate"/>
+    <param pos="0" name="os.family" value="Linux"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=[\d\.]+,OU=Q-Series,O=Quantum,ST=CO,C=US$">
+    <description>Seagate Q-Series NAS (previously Quantum)</description>
+    <example>CN=1.1.1.1,OU=Q-Series,O=Quantum,ST=CO,C=US</example>
+    <param pos="0" name="hw.vendor" value="Seagate"/>
+    <param pos="0" name="hw.device" value="Storage"/>
+    <param pos="0" name="os.vendor" value="Seagate"/>
+    <param pos="0" name="os.family" value="Linux"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=QNAP NAS,OU=QTS,O=QNAP Systems\\, Inc\.,L=Taipei,ST=Taipei,C=TW$">
+    <description>QNAP NAS</description>
+    <example>CN=QNAP NAS,OU=QTS,O=QNAP Systems\, Inc.,L=Taipei,ST=Taipei,C=TW</example>
+    <param pos="0" name="hw.vendor" value="QNAP Systems"/>
+    <param pos="0" name="hw.family" value="Storage"/>
+    <param pos="0" name="hw.device" value="Storage"/>
+    <param pos="0" name="os.family" value="Linux"/>
+    <param pos="0" name="os.vendor" value="QNAP Systems"/>
+    <param pos="0" name="os.device" value="Storage"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=VMware,OU=VMware,L=Palo Alto,C=US$">
+    <description>VMWare Authentication Daemon</description>
+    <example>CN=VMware,OU=VMware,L=Palo Alto,C=US</example>
+    <param pos="0" name="service.vendor" value="VMWare"/>
+    <param pos="0" name="service.product" value="vmauthd"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=([a-zA-Z0-9\.\-\_]+),OU=VMware ESX Server Default Certificate,O=VMware\\, Inc,L=Palo Alto,ST=California,C=US$">
+    <description>VMWare ESX</description>
+    <example>CN=server99.,OU=VMware ESX Server Default Certificate,O=VMware\, Inc,L=Palo Alto,ST=California,C=US</example>
+    <param pos="0" name="os.vendor" value="VMWare"/>
+    <param pos="0" name="os.cpe23" value="cpe:/o:vmware:esx:-"/>
+    <param pos="0" name="os.product" value="ESX"/>
+    <param pos="0" name="os.device" value="Hypervisor"/>
+    <param pos="1" name="host.name"/>
+  </fingerprint>
+  <fingerprint pattern="^CN.*,OU=SRM,O=VMware\\, Inc\.,L=Palo Alto,ST=California,C=US$">
+    <description>VMWare SRM</description>
+    <example>CN=SRM01,OU=SRM,O=VMware\, Inc.,L=Palo Alto,ST=California,C=US</example>
+    <param pos="0" name="os.vendor" value="VMWare"/>
+    <param pos="0" name="os.product" value="Linux"/>
+    <param pos="0" name="hw.vendor" value="VMWare"/>
+    <param pos="0" name="hw.device" value="Appliance"/>
+    <param pos="0" name="hw.product" value="Site Recovery Manager"/>
+    <param pos="0" name="service.vendor" value="VMWare"/>
+    <param pos="0" name="service.product" value="Site Recovery Manager"/>
+    <param pos="0" name="service.cpe23" value="cpe:/a:vmware:site_recovery_manager:-"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=IOS-Self-Signed-Certificate-">
+    <description>Cisco IOS Default Certificate</description>
+    <example>CN=IOS-Self-Signed-Certificate-4163115936</example>
+    <param pos="0" name="os.vendor" value="Cisco"/>
+    <param pos="0" name="os.cpe23" value="cpe:/o:cisco:ios:-"/>
+    <param pos="0" name="os.family" value="IOS"/>
+    <param pos="0" name="os.product" value="IOS"/>
+    <param pos="0" name="hw.vendor" value="Cisco"/>
+    <param pos="0" name="hw.device" value="Router"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=([a-zA-Z0-9]{5,12}) ([a-zA-Z0-9]{12}),OU=Cast,O=Google Inc,L=Mountain View,ST=California,C=US$">
+    <description>Google Chromecast</description>
+    <example chromecast.serial_number="LVDZG5" host.mac_local="FA8FCA67413D">CN=LVDZG5 FA8FCA67413D,OU=Cast,O=Google Inc,L=Mountain View,ST=California,C=US</example>
+    <param pos="0" name="os.vendor" value="Google"/>
+    <param pos="0" name="os.product" value="ChromeOS"/>
+    <param pos="0" name="hw.device" value="Media Server"/>
+    <param pos="0" name="hw.vendor" value="Google"/>
+    <param pos="0" name="hw.product" value="Chromecast"/>
+    <param pos="1" name="chromecast.serial_number"/>
+    <!-- local administered mac address (clear bit 2 of first byte) -->
+    <param pos="2" name="host.mac_local"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=([a-zA-Z0-9]{5,12}) ([a-zA-Z0-9]{12}),OU=Cast TV \(Vizio\),O=Google Inc,L=Mountain View,ST=California,C=US$">
+    <description>Vizio SmartTV (Android) with Google Cast</description>
+    <example chromecast.serial_number="9V039WC9" host.mac_local="FA8FCA697898">CN=9V039WC9 FA8FCA697898,OU=Cast TV (Vizio),O=Google Inc,L=Mountain View,ST=California,C=US</example>
+    <param pos="0" name="os.vendor" value="Google"/>
+    <param pos="0" name="os.cpe23" value="cpe:/o:google:android:-"/>
+    <param pos="0" name="os.family" value="Linux"/>
+    <param pos="0" name="os.product" value="Android"/>
+    <param pos="0" name="hw.device" value="Smart TV"/>
+    <param pos="0" name="hw.vendor" value="Vizio"/>
+    <param pos="1" name="chromecast.serial_number"/>
+    <!-- local administered mac address (clear bit 2 of first byte) -->
+    <param pos="2" name="host.mac_local"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=TANDBERG,OU=R&amp;D,O=TANDBERG ASA,L=Lysaker,ST=Askerhus,C=NO$">
+    <description>Cisco (TANDBERG) TelePresence</description>
+    <example>CN=TANDBERG,OU=R&amp;D,O=TANDBERG ASA,L=Lysaker,ST=Askerhus,C=NO</example>
+    <param pos="0" name="hw.vendor" value="Cisco"/>
+    <param pos="0" name="hw.device" value="Video Conferencing"/>
+    <param pos="0" name="hw.product" value="TelePresence"/>
+    <param pos="0" name="os.vendor" value="Cisco"/>
+    <param pos="0" name="os.family" value="Linux"/>
+    <param pos="0" name="os.product" value="TelePresence"/>
+    <param pos="0" name="os.device" value="Video Conferencing"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=lifesize.com,C=US$">
+    <description>Lifesize TelePresence</description>
+    <example>CN=lifesize.com,C=US</example>
+    <param pos="0" name="hw.vendor" value="Lifesize"/>
+    <param pos="0" name="hw.device" value="Video Conferencing"/>
+    <param pos="0" name="hw.product" value="TelePresence"/>
+    <param pos="0" name="os.vendor" value="Lifesize"/>
+    <param pos="0" name="os.family" value="Linux"/>
+    <param pos="0" name="os.product" value="TelePresence"/>
+    <param pos="0" name="os.device" value="Video Conferencing"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=MERCURY-([a-fA-F0-9]{12}),OU=Engineering,O=Crestron">
+    <description>Crestron Mercury</description>
+    <example host.mac="00107F1ABAA0">CN=MERCURY-00107F1ABAA0,OU=Engineering,O=Crestron Electronics\, Inc.,L=Rockleigh,ST=NJ,C=US</example>
+    <param pos="0" name="hw.vendor" value="Crestron"/>
+    <param pos="0" name="hw.device" value="Video Conferencing"/>
+    <param pos="0" name="hw.product" value="Mercury"/>
+    <param pos="0" name="os.vendor" value="Crestron"/>
+    <param pos="0" name="os.family" value="Linux"/>
+    <param pos="0" name="os.device" value="Video Conferencing"/>
+    <param pos="1" name="host.mac"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=(AM-\d+)-([a-fA-F0-9]{12}),OU=Engineering,O=Crestron">
+    <description>Crestron AirMedia</description>
+    <example hw.product="AM-200" host.mac="00107FB7B1E2">CN=AM-200-00107FB7B1E2,OU=Engineering,O=Crestron Electronics\, Inc.,L=Rockleigh,ST=NJ,C=US</example>
+    <param pos="0" name="hw.vendor" value="Crestron"/>
+    <param pos="0" name="hw.device" value="Video Conferencing"/>
+    <param pos="1" name="hw.product"/>
+    <param pos="0" name="os.vendor" value="Crestron"/>
+    <param pos="0" name="os.family" value="Linux"/>
+    <param pos="0" name="os.device" value="Video Conferencing"/>
+    <param pos="2" name="host.mac"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=Crestron,OU=Engineering,O=Crestron Electronics\\, Inc\.,L=Rockleigh,ST=NJ,C=US$">
+    <description>Crestron Video Conferencing</description>
+    <example>CN=Crestron,OU=Engineering,O=Crestron Electronics\, Inc.,L=Rockleigh,ST=NJ,C=US</example>
+    <param pos="0" name="hw.vendor" value="Crestron"/>
+    <param pos="0" name="hw.device" value="Video Conferencing"/>
+    <param pos="0" name="os.vendor" value="Crestron"/>
+    <param pos="0" name="os.family" value="Linux"/>
+    <param pos="0" name="os.device" value="Video Conferencing"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=ClickShare-\d+$">
+    <description>ClickShare Wireless Presenter</description>
+    <example>CN=ClickShare-4234234324</example>
+    <param pos="0" name="hw.vendor" value="Barco"/>
+    <param pos="0" name="hw.device" value="Wireless Presenter"/>
+    <param pos="0" name="hw.product" value="ClickShare"/>
+    <param pos="0" name="os.vendor" value="Barco"/>
+    <param pos="0" name="os.family" value="ClickShareOS"/>
+    <param pos="0" name="os.device" value="Wireless Presenter"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=Solstice,OU=Solstice,O=Mersive Technologies Inc,L=Denver,ST=CO,C=US$">
+    <description>SolsticePod</description>
+    <example>CN=Solstice,OU=Solstice,O=Mersive Technologies Inc,L=Denver,ST=CO,C=US</example>
+    <param pos="0" name="hw.vendor" value="Mersive"/>
+    <param pos="0" name="hw.device" value="Wireless Presenter"/>
+    <param pos="0" name="hw.product" value="SolsticePod"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=Controller,OU=FW,O=ExtronElectronics,ST=CA,C=US$">
+    <description>Extron MediaLink Controller</description>
+    <example>CN=Controller,OU=FW,O=ExtronElectronics,ST=CA,C=US</example>
+    <param pos="0" name="hw.vendor" value="Extron"/>
+    <param pos="0" name="hw.device" value="Display Controller"/>
+    <param pos="0" name="hw.product" value="MediaLink Controller"/>
+    <param pos="0" name="os.vendor" value="Extron"/>
+    <param pos="0" name="os.family" value="Linux"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=IPLP,OU=ControlSystems,O=ExtronElectronics,L=Anaheim,ST=CA,C=US$">
+    <description>Extron IPLP </description>
+    <example>CN=IPLP,OU=ControlSystems,O=ExtronElectronics,L=Anaheim,ST=CA,C=US</example>
+    <param pos="0" name="hw.vendor" value="Extron"/>
+    <param pos="0" name="hw.device" value="Display Controller"/>
+    <param pos="0" name="hw.product" value="IP Link Control Processor"/>
+    <param pos="0" name="os.vendor" value="Extron"/>
+    <param pos="0" name="os.family" value="Linux"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=TLP,OU=ControlSystems,O=ExtronElectronics,L=Anaheim,ST=CA,C=US$">
+    <description>Extron TLP </description>
+    <example>CN=TLP,OU=ControlSystems,O=ExtronElectronics,L=Anaheim,ST=CA,C=US</example>
+    <param pos="0" name="hw.vendor" value="Extron"/>
+    <param pos="0" name="hw.device" value="Display Controller"/>
+    <param pos="0" name="hw.product" value="TouchLink Control Panel"/>
+    <param pos="0" name="os.vendor" value="Extron"/>
+    <param pos="0" name="os.family" value="Linux"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=ShareLink-Pro-.*,OU=AVSystems,O=ExtronElectronics">
+    <description>Extron ShareLink Pro </description>
+    <example>CN=ShareLink-Pro-18-99-99.local.com,OU=AVSystems,O=ExtronElectronics,L=Anaheim,ST=CA,C=US</example>
+    <param pos="0" name="hw.vendor" value="Extron"/>
+    <param pos="0" name="hw.device" value="Display Controller"/>
+    <param pos="0" name="hw.product" value="ShareLink Pro"/>
+    <param pos="0" name="os.vendor" value="Extron"/>
+    <param pos="0" name="os.family" value="Linux"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=VMM APIC,OU=VMM\d+,O=Cisco,L=San Jose,ST=CA,C=US$">
+    <description>Cisco APIC</description>
+    <example>CN=VMM APIC,OU=VMM15,O=Cisco,L=San Jose,ST=CA,C=US</example>
+    <param pos="0" name="hw.vendor" value="Cisco"/>
+    <param pos="0" name="hw.product" value="APIC"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=APIC$">
+    <description>Cisco APIC - bare CN</description>
+    <example>CN=APIC</example>
+    <param pos="0" name="hw.vendor" value="Cisco"/>
+    <param pos="0" name="hw.product" value="APIC"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=(iPX\d+),OU=I Project,O=Samsung Electronics,L=Suwon,ST=Gyeonggi-do,C=KR$">
+    <description>Samsung Communication Manager</description>
+    <example hw.product="iPX3010">CN=iPX3010,OU=I Project,O=Samsung Electronics,L=Suwon,ST=Gyeonggi-do,C=KR</example>
+    <param pos="0" name="hw.vendor" value="Samsung"/>
+    <param pos="0" name="hw.device" value="VoIP Server"/>
+    <param pos="0" name="hw.family" value="Communication Manager"/>
+    <param pos="1" name="hw.product"/>
+    <param pos="0" name="os.vendor" value="Samsung"/>
+    <param pos="0" name="os.family" value="Linux"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=www.hikvision.com,OU=DVRNVR,O=HIKVISION,L=HangZhou,ST=ZheJiang,C=CN$">
+    <description>HIKVISION DVR</description>
+    <example>CN=www.hikvision.com,OU=DVRNVR,O=HIKVISION,L=HangZhou,ST=ZheJiang,C=CN</example>
+    <param pos="0" name="os.vendor" value="Hikvision"/>
+    <param pos="0" name="os.device" value="DVR"/>
+    <param pos="0" name="hw.vendor" value="Hikvision"/>
+    <param pos="0" name="hw.device" value="DVR"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=([a-zA-Z0-9\.\-\_]+),OU=Polatis Switch ([a-zA-Z0-9]+),O=Polatis Inc\.,ST=N/A,C=UK$">
+    <description>Polatis Switch</description>
+    <example host.name="192.168.0.1" hw.product="1591">CN=192.168.0.1,OU=Polatis Switch 1591,O=Polatis Inc.,ST=N/A,C=UK</example>
+    <example host.name="central-01" hw.product="1590">CN=central-01,OU=Polatis Switch 1590,O=Polatis Inc.,ST=N/A,C=UK</example>
+    <param pos="0" name="os.vendor" value="Polatis"/>
+    <param pos="0" name="os.device" value="Switch"/>
+    <param pos="0" name="hw.vendor" value="Polatis"/>
+    <param pos="0" name="hw.device" value="Switch"/>
+    <param pos="1" name="host.name"/>
+    <param pos="2" name="hw.product"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=([a-zA-Z0-9\.\-\_]+),O=Fidelis Cybersecurity$">
+    <description>Fidelis CommandPost</description>
+    <example host.name="localhost.localdomain">CN=localhost.localdomain,O=Fidelis Cybersecurity</example>
+    <param pos="0" name="hw.vendor" value="Fidelis"/>
+    <param pos="0" name="hw.product" value="CommandPost"/>
+    <param pos="0" name="hw.device" value="Appliance"/>
+    <param pos="0" name="os.vendor" value="Fidelis"/>
+    <param pos="0" name="os.product" value="CommandPost"/>
+    <param pos="1" name="host.name"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=([a-zA-Z0-9]+\-[a-zA-Z0-9]+)\-([a-zA-Z0-9]+),O=IBM,L=Endicott,ST=New York,C=IN$">
+    <description>IBM POWER System</description>
+    <example hw.product="8284-22A" hw.model="211BAFW">CN=8284-22A-211BAFW,O=IBM,L=Endicott,ST=New York,C=IN</example>
+    <param pos="0" name="hw.vendor" value="IBM"/>
+    <param pos="0" name="hw.family" value="POWER System"/>
+    <param pos="1" name="hw.product" value=""/>
+    <param pos="2" name="hw.model"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=EagleEyeDirectorII.polycom.com,OU=Video Division,O=Polycom Inc.,L=San Jose,ST=California,C=US$">
+    <description>Polycom Eagle Eye Director</description>
+    <example>CN=EagleEyeDirectorII.polycom.com,OU=Video Division,O=Polycom Inc.,L=San Jose,ST=California,C=US</example>
+    <param pos="0" name="hw.vendor" value="Polycom"/>
+    <param pos="0" name="hw.device" value="Video Conferencing"/>
+    <param pos="0" name="hw.product" value="Eagle Eye Director II"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=([a-zA-Z0-9]+),OU=RD,O=QSC\\, LLC,ST=Colorado,C=US$">
+    <description>Q-SYS Licensing Manager</description>
+    <example host.name="SVRTIP44">CN=SVRTIP44,OU=RD,O=QSC\, LLC,ST=Colorado,C=US</example>
+    <param pos="0" name="service.vendor" value="Q-SYS"/>
+    <param pos="0" name="service.product" value="Licensing Manager"/>
+    <param pos="1" name="host.name"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=([A-Za-z0-9]+),OU=FortiGate,O=Fortinet,L=Sunnyvale,ST=California,C=US$">
+    <description>Fortinet Gateway</description>
+    <example fortinet.serial_number="FG100ETK1800118">CN=FG100ETK1800118,OU=FortiGate,O=Fortinet,L=Sunnyvale,ST=California,C=US</example>
+    <example fortinet.serial_number="FGT30D3X15038375">CN=FGT30D3X15038375,OU=FortiGate,O=Fortinet,L=Sunnyvale,ST=California,C=US</example>
+    <param pos="0" name="hw.vendor" value="Fortinet"/>
+    <param pos="0" name="hw.device" value="Firewall"/>
+    <param pos="0" name="os.vendor" value="Fortinet"/>
+    <param pos="0" name="os.cpe23" value="cpe:/o:fortinet:fortios:-"/>
+    <param pos="0" name="os.family" value="Linux"/>
+    <param pos="0" name="os.device" value="Firewall"/>
+    <param pos="0" name="os.product" value="FortiOS"/>
+    <param pos="1" name="fortinet.serial_number"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=([A-Za-z0-9]+),O=Fortinet Ltd\.$">
+    <description>Fortinet Gateway (Older)</description>
+    <example fortinet.serial_number="FG100D3G13803999">CN=FG100D3G13803999,O=Fortinet Ltd.</example>
+    <param pos="0" name="hw.vendor" value="Fortinet"/>
+    <param pos="0" name="hw.device" value="Firewall"/>
+    <param pos="0" name="os.vendor" value="Fortinet"/>
+    <param pos="0" name="os.cpe23" value="cpe:/o:fortinet:fortios:-"/>
+    <param pos="0" name="os.family" value="Linux"/>
+    <param pos="0" name="os.device" value="Firewall"/>
+    <param pos="0" name="os.product" value="FortiOS"/>
+    <param pos="1" name="fortinet.serial_number"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=FortiMail,OU=FortiMail,O=Fortinet,L=Sunnyvale,ST=California,C=US$">
+    <description>Fortinet FortiMail Appliance</description>
+    <example>CN=FortiMail,OU=FortiMail,O=Fortinet,L=Sunnyvale,ST=California,C=US</example>
+    <param pos="0" name="hw.vendor" value="Fortinet"/>
+    <param pos="0" name="hw.device" value="Appliance"/>
+    <param pos="0" name="hw.product" value="FortiMail"/>
+    <param pos="0" name="os.vendor" value="Fortinet"/>
+    <param pos="0" name="os.cpe23" value="cpe:/o:fortinet:fortios:-"/>
+    <param pos="0" name="os.family" value="Linux"/>
+    <param pos="0" name="os.product" value="FortiOS"/>
+    <param pos="0" name="os.device" value="Appliance"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=.*,OU=FortiManager,O=Fortinet,L=Sunnyvale,ST=California,C=US$">
+    <description>Fortinet FortiManager Appliance</description>
+    <example>CN=FMG-VM0000000000,OU=FortiManager,O=Fortinet,L=Sunnyvale,ST=California,C=US</example>
+    <param pos="0" name="hw.vendor" value="Fortinet"/>
+    <param pos="0" name="hw.device" value="Appliance"/>
+    <param pos="0" name="hw.product" value="FortiManager"/>
+    <param pos="0" name="os.vendor" value="Fortinet"/>
+    <param pos="0" name="os.cpe23" value="cpe:/o:fortinet:fortios:-"/>
+    <param pos="0" name="os.family" value="Linux"/>
+    <param pos="0" name="os.product" value="FortiOS"/>
+    <param pos="0" name="os.device" value="Appliance"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=CyberoamApplianceCertificate">
+    <description>Cyberoam SSL VPN</description>
+    <example>CN=CyberoamApplianceCertificate_C35316263111,OU=Cyberoam Appliance,O=Cyberoam,L=Ahmedabad,ST=Gujarat,C=IN</example>
+    <example>CN=CyberoamApplianceCertificate,OU=Cyberoam Appliance,O=Cyberoam,L=Ahmedabad,ST=Gujarat,C=IN</example>
+    <param pos="0" name="hw.vendor" value="Cyberoam"/>
+    <param pos="0" name="hw.device" value="VPN"/>
+    <param pos="0" name="hw.product" value="Appliance"/>
+    <param pos="0" name="os.vendor" value="Cyberoam"/>
+    <param pos="0" name="os.device" value="VPN"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=UBNT\-([0-9a-fA-F]{2}:[0-9a-fA-F]{2}:[0-9a-fA-F]{2}:[0-9a-fA-F]{2}:[0-9a-fA-F]{2}:[0-9a-fA-F]{2}),OU=Technical Support,O=Ubiquiti Networks Inc.,L=San Jose,ST=CA,C=US$">
+    <description>Ubiquiti Wireless AP</description>
+    <example host.mac="68:72:51:4B:90:16">CN=UBNT-68:72:51:4B:90:16,OU=Technical Support,O=Ubiquiti Networks Inc.,L=San Jose,ST=CA,C=US</example>
+    <param pos="0" name="hw.vendor" value="Ubiquiti"/>
+    <param pos="0" name="hw.device" value="WAP"/>
+    <param pos="0" name="os.vendor" value="Ubiquiti"/>
+    <param pos="0" name="os.family" value="Linux"/>
+    <param pos="0" name="os.device" value="WAP"/>
+    <param pos="1" name="host.mac"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=unifi$">
+    <description>Ubiquiti Controller - unifi bare</description>
+    <example>CN=unifi</example>
+    <param pos="0" name="hw.vendor" value="Ubiquiti"/>
+    <param pos="0" name="hw.device" value="Wireless Controller"/>
+    <param pos="0" name="os.vendor" value="Ubiquiti"/>
+    <param pos="0" name="os.family" value="Linux"/>
+    <param pos="0" name="os.device" value="Wireless Controller"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=UniFi,OU=UniFi,O=ubnt\.com,L=San Jose,ST=CA,C=US$">
+    <description>Ubiquiti Controller - unifi</description>
+    <example>CN=UniFi,OU=UniFi,O=ubnt.com,L=San Jose,ST=CA,C=US</example>
+    <param pos="0" name="hw.vendor" value="Ubiquiti"/>
+    <param pos="0" name="hw.device" value="Wireless Controller"/>
+    <param pos="0" name="os.vendor" value="Ubiquiti"/>
+    <param pos="0" name="os.family" value="Linux"/>
+    <param pos="0" name="os.device" value="Wireless Controller"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=unifivideo-app$">
+    <description>UniFi Video App</description>
+    <example>CN=unifivideo-app</example>
+    <param pos="0" name="os.vendor" value="Ubiquiti"/>
+    <param pos="0" name="os.family" value="Linux"/>
+    <param pos="0" name="hw.vendor" value="Ubiquiti"/>
+    <param pos="0" name="hw.family" value="UniFi"/>
+    <param pos="0" name="hw.device" value="Web cam"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=camera\.ubnt\.dev,">
+    <description>UniFi Video Camera</description>
+    <example>CN=camera.ubnt.dev,OU=devint,O=Ubiquiti Networks Inc.,L=Taipei,C=TW</example>
+    <param pos="0" name="hw.vendor" value="Ubiquiti"/>
+    <param pos="0" name="hw.device" value="Web cam"/>
+    <param pos="0" name="hw.product" value="Camera"/>
+    <param pos="0" name="os.vendor" value="Ubiquiti"/>
+    <param pos="0" name="os.family" value="Linux"/>
+    <param pos="0" name="os.device" value="Web cam"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=UBNT,OU=Technical Support,O=Ubiquiti Networks Inc\.,L=San Jose,ST=CA,C=US$">
+    <description>Ubiquiti Controller</description>
+    <example>CN=UBNT,OU=Technical Support,O=Ubiquiti Networks Inc.,L=San Jose,ST=CA,C=US</example>
+    <param pos="0" name="hw.vendor" value="Ubiquiti"/>
+    <param pos="0" name="hw.device" value="Wireless Controller"/>
+    <param pos="0" name="os.vendor" value="Ubiquiti"/>
+    <param pos="0" name="os.family" value="Linux"/>
+    <param pos="0" name="os.device" value="Wireless Controller"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=CloudKey,O=Ubiquiti Networks,L=San Jose,ST=CA,C=US$">
+    <description>Ubiquiti CloudKey Controller</description>
+    <example>CN=CloudKey,O=Ubiquiti Networks,L=San Jose,ST=CA,C=US</example>
+    <param pos="0" name="hw.vendor" value="Ubiquiti"/>
+    <param pos="0" name="hw.device" value="Wireless Controller"/>
+    <param pos="0" name="hw.product" value="CloudKey"/>
+    <param pos="0" name="os.vendor" value="Ubiquiti"/>
+    <param pos="0" name="os.family" value="Linux"/>
+    <param pos="0" name="os.device" value="Wireless Controller"/>
+    <param pos="0" name="os.product" value="CloudKey"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=UBNT Router UI,O=Ubiquiti Networks,L=San Jose,ST=CA,C=US$">
+    <description>Ubiquiti Router</description>
+    <example>CN=UBNT Router UI,O=Ubiquiti Networks,L=San Jose,ST=CA,C=US</example>
+    <param pos="0" name="hw.vendor" value="Ubiquiti"/>
+    <param pos="0" name="hw.device" value="Router"/>
+    <param pos="0" name="os.vendor" value="Ubiquiti"/>
+    <param pos="0" name="os.family" value="Linux"/>
+    <param pos="0" name="os.device" value="Router"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=UniFi-Video Controller,OU=R&amp;D,O=Ubiquiti Networks,L=New York,ST=NY,C=US$">
+    <description>Ubiquiti Video Controller</description>
+    <example>CN=UniFi-Video Controller,OU=R&amp;D,O=Ubiquiti Networks,L=New York,ST=NY,C=US</example>
+    <param pos="0" name="hw.vendor" value="Ubiquiti"/>
+    <param pos="0" name="hw.device" value="DVR"/>
+    <param pos="0" name="hw.product" value="Video Controller"/>
+    <param pos="0" name="os.vendor" value="Ubiquiti"/>
+    <param pos="0" name="os.family" value="Linux"/>
+    <param pos="0" name="os.device" value="DVR"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=GreenWave Systems,OU=PKI,O=GreenWave Systems,L=Irvine,ST=California,C=US$">
+    <description>Verizon / Greenwave FIOS Router</description>
+    <example>CN=GreenWave Systems,OU=PKI,O=GreenWave Systems,L=Irvine,ST=California,C=US</example>
+    <param pos="0" name="hw.vendor" value="Greenwave Systems"/>
+    <param pos="0" name="hw.device" value="Broadband Router"/>
+    <param pos="0" name="hw.product" value="Verizon FiOS Router"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=PoliWall,OU=Bandura Labs,O=Bandura\\, LLC\.,L=Lake Saint Louis,ST=Missouri,C=US$">
+    <description>PoliWall Firewall Original</description>
+    <example>CN=PoliWall,OU=Bandura Labs,O=Bandura\, LLC.,L=Lake Saint Louis,ST=Missouri,C=US</example>
+    <param pos="0" name="hw.vendor" value="Bandura Labs"/>
+    <param pos="0" name="hw.device" value="Firewall"/>
+    <param pos="0" name="hw.product" value="PoliWall"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=poliwall,OU=IT,O=Bandura,L=St\. Louis,ST=Missouri,C=US$">
+    <description>PoliWall Firewall Newer Cert</description>
+    <example>CN=poliwall,OU=IT,O=Bandura,L=St. Louis,ST=Missouri,C=US</example>
+    <param pos="0" name="hw.vendor" value="Bandura Labs"/>
+    <param pos="0" name="hw.device" value="Firewall"/>
+    <param pos="0" name="hw.product" value="PoliWall"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=pfSense-[a-zA-Z0-9]+,O=pfSense webConfigurator Self-Signed Certificate">
+    <description>pfSense Firewall</description>
+    <example>CN=pfSense-58fb5b0b06777,O=pfSense webConfigurator Self-Signed Certificate,L=Locality,ST=State,C=US</example>
+    <example>CN=pfSense-5c76251e4d3e4,O=pfSense webConfigurator Self-Signed Certificate</example>
+    <param pos="0" name="hw.vendor" value="pfSense"/>
+    <param pos="0" name="hw.device" value="Firewall"/>
+    <param pos="0" name="hw.product" value="Firewall"/>
+    <param pos="0" name="os.vendor" value="pfSense"/>
+    <param pos="0" name="os.product" value="FreeBSD"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=Common Name \(eg\\, YOUR name\),OU=Organizational Unit Name \(eg\\, section\),O=CompanyName,L=Somecity,ST=Somewhere,C=US$">
+    <description>pfSense Firewall Default Certificate</description>
+    <example>CN=Common Name (eg\, YOUR name),OU=Organizational Unit Name (eg\, section),O=CompanyName,L=Somecity,ST=Somewhere,C=US</example>
+    <param pos="0" name="hw.vendor" value="pfSense"/>
+    <param pos="0" name="hw.device" value="Firewall"/>
+    <param pos="0" name="hw.product" value="Firewall"/>
+    <param pos="0" name="os.vendor" value="pfSense"/>
+    <param pos="0" name="os.product" value="FreeBSD"/>
+  </fingerprint>
+  <fingerprint pattern="^O=OPNsense,L=Middelharnis,ST=Zuid-Holland,C=NL$">
+    <description>OPNsense Firewall</description>
+    <example>O=OPNsense,L=Middelharnis,ST=Zuid-Holland,C=NL</example>
+    <param pos="0" name="hw.vendor" value="OPNsense"/>
+    <param pos="0" name="hw.device" value="Firewall"/>
+    <param pos="0" name="hw.product" value="Firewall"/>
+    <param pos="0" name="os.vendor" value="OPNsense"/>
+    <param pos="0" name="os.product" value="FreeBSD"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=NetVanta,O=ADTRAN\\, Inc\.,L=Huntsville,ST=AL,C=US$" certainty="0.9">
+    <description>ADTRAN Netvanta Router</description>
+    <example>CN=NetVanta,O=ADTRAN\, Inc.,L=Huntsville,ST=AL,C=US</example>
+    <param pos="0" name="os.device" value="Router"/>
+    <param pos="0" name="os.vendor" value="ADTRAN"/>
+    <param pos="0" name="os.family" value="NetVanta"/>
+    <param pos="0" name="hw.device" value="Router"/>
+    <param pos="0" name="hw.vendor" value="ADTRAN"/>
+    <param pos="0" name="hw.family" value="NetVanta"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=SophosApplianceCertificate">
+    <description>Sophos Appliance</description>
+    <example>CN=SophosApplianceCertificate_C330AC22W713PAF,OU=OU,O=Green House Data,L=Cheyenne,ST=WY,C=US</example>
+    <example>CN=SophosApplianceCertificate_C22315405928-UU5JKO,OU=OU,O=(null),L=NA,ST=NA,C=PK</example>
+    <example>CN=SophosApplianceCertificate,OU=OU,O=Sophos,L=Abingdon,ST=Oxfordshire,C=GB</example>
+    <param pos="0" name="hw.vendor" value="Sophos"/>
+    <param pos="0" name="hw.device" value="Appliance"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=Hubitat Elevation,OU=Hub,O=Hubitat\\, Inc\.,L=Scottsdale,ST=Arizona,C=US$">
+    <description>Hubitat Device Hub</description>
+    <example>CN=Hubitat Elevation,OU=Hub,O=Hubitat\, Inc.,L=Scottsdale,ST=Arizona,C=US</example>
+    <param pos="0" name="hw.vendor" value="Hubitat"/>
+    <param pos="0" name="hw.device" value="Device Hub"/>
+    <param pos="0" name="hw.product" value="Elevation"/>
+    <param pos="0" name="os.vendor" value="Hubitat"/>
+    <param pos="0" name="os.product" value="Linux"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=MAC([a-fA-F0-9]{12}),OU=([^,]+),O=Mercury Security Products\\, LLC,L=Long Beach,ST=CA,C=US$">
+    <description>Mercurity Security (now HID Global)</description>
+    <example hw.product="M5IC" host.mac="000FE507A1F1">CN=MAC000FE507A1F1,OU=M5IC,O=Mercury Security Products\, LLC,L=Long Beach,ST=CA,C=US</example>
+    <example hw.product="EP-1502" host.mac="000FE508BC71">CN=MAC000FE508BC71,OU=EP-1502,O=Mercury Security Products\, LLC,L=Long Beach,ST=CA,C=US</example>
+    <param pos="0" name="hw.vendor" value="Mercury Security"/>
+    <param pos="0" name="hw.device" value="Access Controller"/>
+    <param pos="1" name="host.mac"/>
+    <param pos="2" name="hw.product"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=Mercury Security EP-series,O=Mercury Security Corp\.,L=Long Beach,ST=CA,C=US$">
+    <description>Mercurity Security (now HID Global) No MAC</description>
+    <example>CN=Mercury Security EP-series,O=Mercury Security Corp.,L=Long Beach,ST=CA,C=US</example>
+    <param pos="0" name="hw.vendor" value="Mercury Security"/>
+    <param pos="0" name="hw.device" value="Access Controller"/>
+    <param pos="0" name="hw.product" value="EP-series"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=securelogin.arubanetworks.com,">
+    <description>Aruba Wireless Controller</description>
+    <example>CN=securelogin.arubanetworks.com,O=Aruba Networks,C=US</example>
+    <example>CN=securelogin.arubanetworks.com,OU=Instant,O=Aruba Networks,L=Sunnyvale,ST=California,C=US</example>
+    <param pos="0" name="hw.vendor" value="Aruba Networks"/>
+    <param pos="0" name="hw.device" value="Wireless Controller"/>
+    <param pos="0" name="hw.product" value="Captive Portal"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=Fireware web CA,OU=Fireware,O=WatchGuard$">
+    <description>WatchGuard Firewall</description>
+    <example>CN=Fireware web CA,OU=Fireware,O=WatchGuard</example>
+    <param pos="0" name="hw.vendor" value="WatchGuard"/>
+    <param pos="0" name="hw.device" value="Firewall"/>
+    <param pos="0" name="os.vendor" value="WatchGuard"/>
+    <param pos="0" name="os.cpe23" value="cpe:/o:watchguard:fireware:-"/>
+    <param pos="0" name="os.product" value="Fireware"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=[0-9\.]+,OU=SSL-VPN,O=SonicWALL\\, Inc\.,L=Sunnyvale,ST=CA,C=US$">
+    <description>SonicWALL Firewall</description>
+    <example>CN=192.168.200.1,OU=SSL-VPN,O=SonicWALL\, Inc.,L=Sunnyvale,ST=CA,C=US</example>
+    <param pos="0" name="hw.vendor" value="SonicWALL"/>
+    <param pos="0" name="hw.device" value="VPN"/>
+    <param pos="0" name="os.vendor" value="SonicWALL"/>
+    <param pos="0" name="os.product" value="VPN"/>
+    <param pos="0" name="os.family" value="VPN"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=.*\.akamai\.net,O=Akamai Technologies\\, Inc\.,L=Cambridge,ST=Massachusetts,C=US$">
+    <description>Akamai Global Host</description>
+    <example>CN=a248.e.akamai.net,O=Akamai Technologies\, Inc.,L=Cambridge,ST=Massachusetts,C=US</example>
+    <param pos="0" name="service.vendor" value="Akamai"/>
+    <param pos="0" name="service.product" value="GHost"/>
+    <param pos="0" name="os.vendor" value="Akamai"/>
+    <param pos="0" name="os.device" value="Web proxy"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=HP_3PAR_">
+    <description>HP 3PAR</description>
+    <example>CN=HP_3PAR_1626615</example>
+    <example>CN=HP_3PAR_CZ3601VYFJ</example>
+    <param pos="0" name="hw.vendor" value="HP"/>
+    <param pos="0" name="hw.device" value="Storage"/>
+    <param pos="0" name="hw.product" value="3PAR"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=(?:alienvault|VirtualUSMAllInOne)$">
+    <description>Alienvault OSSIM</description>
+    <example>CN=alienvault</example>
+    <example>CN=VirtualUSMAllInOne</example>
+    <param pos="0" name="os.vendor" value="AlienVault"/>
+    <param pos="0" name="os.device" value="Appliance"/>
+    <param pos="0" name="os.product" value="OSSIM"/>
+    <param pos="0" name="os.family" value="Linux"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=Canon (iR-[a-zA-Z0-9\.\-\_]+)$">
+    <description>Canon iR-ADV Printer with product info</description>
+    <example os.product="iR-ADV">CN=Canon iR-ADV</example>
+    <param pos="0" name="hw.device" value="Printer"/>
+    <param pos="0" name="hw.vendor" value="Canon"/>
+    <param pos="0" name="os.device" value="Printer"/>
+    <param pos="0" name="os.vendor" value="Canon"/>
+    <param pos="1" name="hw.product"/>
+    <param pos="1" name="os.product"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=Canon Imaging Product$">
+    <description>Canon iR-ADV Printer</description>
+    <example>CN=Canon Imaging Product</example>
+    <param pos="0" name="hw.device" value="Printer"/>
+    <param pos="0" name="hw.vendor" value="Canon"/>
+    <param pos="0" name="os.device" value="Printer"/>
+    <param pos="0" name="os.vendor" value="Canon"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=ScanFront$">
+    <description>Canon ScanFront Simple</description>
+    <example>CN=ScanFront</example>
+    <param pos="0" name="hw.device" value="Scanner"/>
+    <param pos="0" name="hw.vendor" value="Canon"/>
+    <param pos="0" name="hw.product" value="ScanFront"/>
+    <param pos="0" name="os.device" value="Scanner"/>
+    <param pos="0" name="os.vendor" value="Canon"/>
+    <param pos="0" name="os.product" value="ScanFront"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=ScanFront,OU=IMS,O=CANON ELECTRONICS INC\.,L=Minato-ku,ST=Tokyo,C=JP$">
+    <description>Canon ScanFront Full</description>
+    <example>CN=ScanFront,OU=IMS,O=CANON ELECTRONICS INC.,L=Minato-ku,ST=Tokyo,C=JP</example>
+    <param pos="0" name="hw.device" value="Scanner"/>
+    <param pos="0" name="hw.vendor" value="Canon"/>
+    <param pos="0" name="hw.product" value="ScanFront"/>
+    <param pos="0" name="os.device" value="Scanner"/>
+    <param pos="0" name="os.vendor" value="Canon"/>
+    <param pos="0" name="os.product" value="ScanFront"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=tnsappliance.*,O=Tenable Network Security\\, Inc\.,L=Columbia,ST=Maryland,C=US$">
+    <description>Tenable Appliance</description>
+    <example>CN=tnsappliance-b088a321,OU=--,O=Tenable Network Security\, Inc.,L=Columbia,ST=Maryland,C=US</example>
+    <example>CN=tnsappliance,OU=--,O=Tenable Network Security\, Inc.,L=Columbia,ST=Maryland,C=US</example>
+    <param pos="0" name="hw.device" value="Appliance"/>
+    <param pos="0" name="hw.vendor" value="Tenable"/>
+    <param pos="0" name="hw.product" value="Tenable Core"/>
+    <param pos="0" name="os.device" value="Appliance"/>
+    <param pos="0" name="os.vendor" value="Tenable"/>
+    <param pos="0" name="os.product" value="Tenable Core"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=extrahop,OU=extrahop\.com,O=ExtraHop,C=US$">
+    <description>ExtraHop Appliance</description>
+    <example>CN=extrahop,OU=extrahop.com,O=ExtraHop,C=US</example>
+    <param pos="0" name="hw.device" value="Appliance"/>
+    <param pos="0" name="hw.vendor" value="ExtraHop"/>
+    <param pos="0" name="hw.product" value="Discover"/>
+    <param pos="0" name="os.device" value="Appliance"/>
+    <param pos="0" name="os.vendor" value="ExtraHop"/>
+    <param pos="0" name="os.product" value="Discover"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=Ruckus Wireless ZoneDirector SN-(\d+),O=Ruckus Wireless\\, Inc\.,ST=CA,C=US$">
+    <description>Ruckus Zone Director</description>
+    <example ruckus.serial_number="221301007591">CN=Ruckus Wireless ZoneDirector SN-221301007591,O=Ruckus Wireless\, Inc.,ST=CA,C=US</example>
+    <param pos="0" name="hw.device" value="Wireless Controller"/>
+    <param pos="0" name="hw.vendor" value="Ruckus"/>
+    <param pos="0" name="hw.product" value="Zone Director"/>
+    <param pos="0" name="os.device" value="Wireless Controller"/>
+    <param pos="0" name="os.vendor" value="Ruckus"/>
+    <param pos="0" name="os.product" value="Zone Director"/>
+    <param pos="1" name="ruckus.serial_number"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=DT([^\s]+) Series,O=NEC Corporation,ST=Tokyo,C=JP$">
+    <description>NEC DT Series IP Phone</description>
+    <example>CN=DT800 Series,O=NEC Corporation,ST=Tokyo,C=JP</example>
+    <param pos="0" name="os.vendor" value="NEC"/>
+    <param pos="0" name="os.device" value="VoIP"/>
+    <param pos="0" name="hw.vendor" value="NEC"/>
+    <param pos="0" name="hw.device" value="VoIP"/>
+    <param pos="1" name="hw.product"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=([a-fA-F0-9]{12}),O=Polycom Inc\.$">
+    <description>Polycom SoundPoint IP Phone</description>
+    <example host.mac="64167F169981">CN=64167F169981,O=Polycom Inc.</example>
+    <param pos="0" name="os.vendor" value="Polycom"/>
+    <param pos="0" name="os.device" value="VoIP"/>
+    <param pos="0" name="hw.vendor" value="Polycom"/>
+    <param pos="0" name="hw.device" value="VoIP"/>
+    <param pos="0" name="hw.product" value="SoundPoint"/>
+    <param pos="1" name="host.mac"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=EN Software Production &amp; Release,OU=Enterprise Networks,O=Siemens AG,L=Munich,ST=Germany,C=DE$">
+    <description>Siemens EN Software</description>
+    <example>CN=EN Software Production &amp; Release,OU=Enterprise Networks,O=Siemens AG,L=Munich,ST=Germany,C=DE</example>
+    <param pos="0" name="os.vendor" value="Siemens"/>
+    <param pos="0" name="os.device" value="VoIP"/>
+    <param pos="0" name="hw.vendor" value="Siemens"/>
+    <param pos="0" name="hw.device" value="VoIP"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=SecureConnect server,O=Quest,ST=CA,C=US$">
+    <description>SecureConnect SSL VPN</description>
+    <example>CN=SecureConnect server,O=Quest,ST=CA,C=US</example>
+    <param pos="0" name="hw.vendor" value="SecureConnect"/>
+    <param pos="0" name="hw.device" value="VPN"/>
+    <param pos="0" name="os.vendor" value="SecureConnect"/>
+    <param pos="0" name="os.device" value="VPN"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=RecoverPoint,OU=Data Protection and Availability Division,O=EMC Corporation,L=Hopkinton,ST=Massachusetts,C=US$">
+    <description>RecoverPoint Appliance</description>
+    <example>CN=RecoverPoint,OU=Data Protection and Availability Division,O=EMC Corporation,L=Hopkinton,ST=Massachusetts,C=US</example>
+    <param pos="0" name="hw.device" value="Appliance"/>
+    <param pos="0" name="hw.vendor" value="EMC"/>
+    <param pos="0" name="hw.product" value="RecoverPoint"/>
+    <param pos="0" name="os.device" value="Appliance"/>
+    <param pos="0" name="os.vendor" value="EMC"/>
+    <param pos="0" name="os.product" value="RecoverPoint"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=[a-fA-F0-9]+,O=Palo Alto Networks,L=Santa Clara,ST=CA,C=US$">
+    <description>Palo Alto Firewall</description>
+    <example>CN=d9fc2294968367a3a8ad1acd4c816c78444e6ea4d69869b40cc9751951fd3693,O=Palo Alto Networks,L=Santa Clara,ST=CA,C=US</example>
+    <param pos="0" name="hw.vendor" value="Palo Alto Networks"/>
+    <param pos="0" name="hw.device" value="Firewall"/>
+    <param pos="0" name="os.vendor" value="Palo Alto Networks"/>
+    <param pos="0" name="os.product" value="PANOS"/>
+    <param pos="0" name="os.device" value="Firewall"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=VMware default certificate,OU=vCenterServer.*,O=VMware\\, Inc\.$">
+    <description>VMWare vCenter</description>
+    <example>CN=VMware default certificate,OU=vCenterServer_2013.09.26_220623,O=VMware\, Inc.</example>
+    <param pos="0" name="service.vendor" value="VMWare"/>
+    <param pos="0" name="service.product" value="vCenter"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=selfappliance,OU=Engineering,O=Symplified,L=Boulder,ST=Colorado,C=US$">
+    <description>Symplified IAM Appliance (now RSA)</description>
+    <example>CN=selfappliance,OU=Engineering,O=Symplified,L=Boulder,ST=Colorado,C=US</example>
+    <param pos="0" name="hw.vendor" value="Symplified"/>
+    <param pos="0" name="hw.device" value="Appliance"/>
+    <param pos="0" name="hw.product" value="IAM"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=OpenWrt,L=Leipzig,ST=Saxony,C=DE$">
+    <description>OpenWRT WAP</description>
+    <example>CN=OpenWrt,L=Leipzig,ST=Saxony,C=DE</example>
+    <param pos="0" name="os.vendor" value="OpenWRT"/>
+    <param pos="0" name="os.device" value="WAP"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=axis-([a-fA-F0-9]{12}),O=Axis Communications AB$">
+    <description>Axis Communications Web Cam</description>
+    <example host.mac="accc8ea31abf">CN=axis-accc8ea31abf,O=Axis Communications AB</example>
+    <param pos="0" name="hw.vendor" value="AXIS"/>
+    <param pos="0" name="hw.device" value="Web cam"/>
+    <param pos="0" name="os.vendor" value="AXIS"/>
+    <param pos="0" name="os.device" value="Web cam"/>
+    <param pos="0" name="os.family" value="Linux"/>
+    <param pos="1" name="host.mac"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=([^,]+),OU=Nortek,O=ELAN,L=StuddardMD,ST=[^,]+,C=US$">
+    <description>ELAN Web Cam</description>
+    <example host.name="ServerRoom">CN=ServerRoom,OU=Nortek,O=ELAN,L=StuddardMD,ST=10000,C=US</example>
+    <param pos="0" name="hw.vendor" value="ELAN"/>
+    <param pos="0" name="hw.device" value="Web cam"/>
+    <param pos="0" name="hw.product" value="HDIPCam"/>
+    <param pos="0" name="os.vendor" value="ELAN"/>
+    <param pos="0" name="os.device" value="Web cam"/>
+    <param pos="0" name="os.family" value="Linux"/>
+    <param pos="1" name="host.name"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=Dell_OpenManage.*,OU=PG,O=Dell Inc\.,ST=Texas,C=US$">
+    <description>Dell OpenManage</description>
+    <example>CN=Dell_OpenManage01,OU=PG,O=Dell Inc.,ST=Texas,C=US</example>
+    <param pos="0" name="hw.vendor" value="Dell"/>
+    <param pos="0" name="hw.device" value="Appliance"/>
+    <param pos="0" name="hw.product" value="OpenManage"/>
+    <param pos="0" name="os.vendor" value="Dell"/>
+    <param pos="0" name="os.device" value="Appliance"/>
+    <param pos="0" name="os.family" value="Linux"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=Equallogic PS Array,OU=Dell Equallogic,O=Dell Inc\.,L=Nashua,ST=New Hampshire,C=US$">
+    <description>Dell EqualLogic PS Array</description>
+    <example>CN=Equallogic PS Array,OU=Dell Equallogic,O=Dell Inc.,L=Nashua,ST=New Hampshire,C=US</example>
+    <param pos="0" name="hw.vendor" value="Dell"/>
+    <param pos="0" name="hw.device" value="Storage"/>
+    <param pos="0" name="hw.product" value="EqualLogic"/>
+    <param pos="0" name="os.vendor" value="Dell"/>
+    <param pos="0" name="os.device" value="Storage"/>
+    <param pos="0" name="os.product" value="EqualLogic"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=opennac\.test,L=Madrid,ST=Madrid,C=ES$">
+    <description>OpenNAC Appliance</description>
+    <example>CN=opennac.test,L=Madrid,ST=Madrid,C=ES</example>
+    <param pos="0" name="hw.vendor" value="OpenNAC"/>
+    <param pos="0" name="hw.device" value="Appliance"/>
+    <param pos="0" name="hw.product" value="OpenNAC"/>
+    <param pos="0" name="os.vendor" value="OpenNAC"/>
+    <param pos="0" name="os.family" value="Linux"/>
+    <param pos="0" name="os.product" value="Linux"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=SmartEdge Sensor,O=AirMagnet,L=Sunnyvale,ST=California,C=US$">
+    <description>AirMagnet SmartEdge Sensor</description>
+    <example>CN=SmartEdge Sensor,O=AirMagnet,L=Sunnyvale,ST=California,C=US</example>
+    <param pos="0" name="hw.vendor" value="AirMagnet"/>
+    <param pos="0" name="hw.device" value="Wireless Controller"/>
+    <param pos="0" name="hw.product" value="SmartEdge Sensor"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=Sensor WebUI,O=AirDefense Inc.,L=Alpharetta,ST=GA,C=US$">
+    <description>AirDefense Inc Sensor</description>
+    <example>CN=Sensor WebUI,O=AirDefense Inc.,L=Alpharetta,ST=GA,C=US</example>
+    <param pos="0" name="hw.vendor" value="AirDefense"/>
+    <param pos="0" name="hw.device" value="Wireless Controller"/>
+    <param pos="0" name="hw.product" value="Sensor"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=HiveAP,OU=Default,O=Aerohive,ST=California,C=US$">
+    <description>Aerohive Access Point</description>
+    <example>CN=HiveAP,OU=Default,O=Aerohive,ST=California,C=US</example>
+    <param pos="0" name="hw.vendor" value="Aerohive"/>
+    <param pos="0" name="hw.device" value="WAP"/>
+    <param pos="0" name="hw.product" value="Access Point"/>
+    <param pos="0" name="os.vendor" value="Aerohive"/>
+    <param pos="0" name="os.family" value="Linux"/>
+    <param pos="0" name="os.product" value="Linux"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=(usg[^_]+)_([a-fA-F0-9]{12})$">
+    <description>ZyWall Router</description>
+    <example hw.product="usg20w" host.mac="5CF4AB615FAC">CN=usg20w_5CF4AB615FAC</example>
+    <example hw.product="usg20w" host.mac="5067F0BC1D3C">CN=usg20w_5067F0BC1D3C</example>
+    <example hw.product="usg20" host.mac="107BEF0AD201">CN=usg20_107BEF0AD201</example>
+    <param pos="0" name="hw.vendor" value="ZyWall"/>
+    <param pos="0" name="hw.device" value="Broadband Router"/>
+    <param pos="1" name="hw.product"/>
+    <param pos="2" name="host.mac"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=([a-fA-F0-9]{16}),O=Philips Hue,C=NL$">
+    <description>Philips Hue Personal Wireless Lighting</description>
+    <example host.mac_eui64="001788fffe4f1999">CN=001788fffe4f1999,O=Philips Hue,C=NL</example>
+    <param pos="0" name="hw.vendor" value="Philips"/>
+    <param pos="0" name="hw.product" value="Hue"/>
+    <param pos="0" name="hw.device" value="Light Bulb"/>
+    <param pos="1" name="host.mac_eui64"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=www\.ibm\.com,OU=IBM i Service,L=Rochester,ST=Minnesota,C=US$">
+    <description>IBM iSeries Service Console</description>
+    <example>CN=www.ibm.com,OU=IBM i Service,L=Rochester,ST=Minnesota,C=US</example>
+    <param pos="0" name="os.vendor" value="IBM"/>
+    <param pos="0" name="os.family" value="OS/400"/>
+    <param pos="0" name="os.product" value="OS/400"/>
+    <param pos="0" name="os.cpe23" value="cpe:/o:ibm:os_400:-"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=.*\.ip\.kaptivo\.live,">
+    <description>Kaptivo Whiteboard</description>
+    <example>CN=*.ip.kaptivo.live,OU=Domain Control Validated+OU=PositiveSSL Wildcard</example>
+    <param pos="0" name="hw.vendor" value="Kaptivo"/>
+    <param pos="0" name="hw.product" value="Whiteboard"/>
+    <param pos="0" name="hw.device" value="Whiteboard"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=.*,OU=Network Security Management,O=FireEye\\, Inc\.,L=Milpitas,ST=California,C=US$">
+    <description>FireEye Appliance</description>
+    <example>CN=noc-feye-ex2,OU=Network Security Management,O=FireEye\, Inc.,L=Milpitas,ST=California,C=US</example>
+    <param pos="0" name="hw.vendor" value="FireEye"/>
+    <param pos="0" name="hw.product" value="Appliance"/>
+    <param pos="0" name="hw.device" value="Security Appliance"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=.*,OU=IA,O=FireEye,L=Charlottesville,ST=Virginia,C=US$">
+    <description>FireEye Investigation Analysis System Appliance</description>
+    <example>CN=noc-feye-ia2,OU=IA,O=FireEye,L=Charlottesville,ST=Virginia,C=US</example>
+    <param pos="0" name="hw.vendor" value="FireEye"/>
+    <param pos="0" name="hw.product" value="IA Appliance"/>
+    <param pos="0" name="hw.device" value="Security Appliance"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=.*,OU=Gigamon Network Visibility Systems,O=Gigamon Inc\.,L=Santa Clara,ST=California,C=US$">
+    <description>Gigamon GigaVUE Appliance</description>
+    <example>CN=gvue01,OU=Gigamon Network Visibility Systems,O=Gigamon Inc.,L=Santa Clara,ST=California,C=US</example>
+    <param pos="0" name="hw.vendor" value="Gigamon"/>
+    <param pos="0" name="hw.device" value="Monitoring"/>
+    <param pos="0" name="hw.product" value="GigaVUE"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=.*,OU=Telliris,O=DAC Systems,L=Shelton,ST=Connecticut,C=US$">
+    <description>Telliris IVR</description>
+    <example>CN=Telliris-IVR,OU=Telliris,O=DAC Systems,L=Shelton,ST=Connecticut,C=US</example>
+    <param pos="0" name="hw.vendor" value="Telliris"/>
+    <param pos="0" name="hw.device" value="Voice Appliance"/>
+    <param pos="0" name="hw.product" value="IVR"/>
+  </fingerprint>
+ <fingerprint pattern="^CN=SLS,O=Lantronix,L=Irvine,ST=California,C=US$">
+    <description>Lantronix SLS terminal server</description>
+    <example>CN=SLS,O=Lantronix,L=Irvine,ST=California,C=US</example>
+    <param pos="0" name="hw.vendor" value="Lantronix"/>
+    <param pos="0" name="hw.device" value="Device Server"/>
+    <param pos="0" name="hw.product" value="SLS"/>
+  </fingerprint>
+  <fingerprint pattern="^CN=Tintri Default Certificate,OU=Tintri Server Certificate,O=Tintri\\, Inc\.,L=Mountain View,ST=CA,C=US$">
+    <description>Tintri Storage Appliance</description>
+    <example>CN=Tintri Default Certificate,OU=Tintri Server Certificate,O=Tintri\, Inc.,L=Mountain View,ST=CA,C=US</example>
+    <param pos="0" name="hw.vendor" value="Tintro"/>
+    <param pos="0" name="hw.device" value="NAS"/>
+    <param pos="0" name="hw.product" value="Storage Appliance"/>
+  </fingerprint>
+</fingerprints>