recog 2.3.22 → 2.3.23

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (69) hide show
  1. checksums.yaml +4 -4
  2. data/.github/workflows/ci.yml +1 -1
  3. data/.github/workflows/verify.yml +1 -1
  4. data/.vscode/bin/monitor-recog-fingerprints.sh +54 -0
  5. data/.vscode/extensions.json +5 -0
  6. data/.vscode/settings.json +8 -0
  7. data/.vscode/tasks.json +77 -0
  8. data/CONTRIBUTING.md +2 -0
  9. data/bin/recog_verify +42 -7
  10. data/cpe-remap.yaml +20 -2
  11. data/features/data/schema_failure.xml +4 -0
  12. data/features/data/tests_with_failures.xml +6 -0
  13. data/features/support/hooks.rb +9 -0
  14. data/features/verify.feature +81 -17
  15. data/identifiers/hw_device.txt +2 -0
  16. data/identifiers/hw_product.txt +2 -0
  17. data/identifiers/os_device.txt +2 -0
  18. data/identifiers/os_family.txt +1 -0
  19. data/identifiers/os_product.txt +8 -1
  20. data/identifiers/service_product.txt +14 -0
  21. data/identifiers/vendor.txt +13 -1
  22. data/lib/recog/fingerprint.rb +21 -7
  23. data/lib/recog/fingerprint_parse_error.rb +10 -0
  24. data/lib/recog/verifier.rb +4 -4
  25. data/lib/recog/verify_reporter.rb +7 -6
  26. data/lib/recog/version.rb +1 -1
  27. data/requirements.txt +1 -1
  28. data/spec/data/external_example_fingerprint/hp_printer_ex_01.txt +1 -0
  29. data/spec/data/external_example_fingerprint/hp_printer_ex_02.txt +1 -0
  30. data/spec/data/external_example_fingerprint.xml +8 -0
  31. data/spec/data/external_example_illegal_path_fingerprint.xml +7 -0
  32. data/spec/lib/recog/db_spec.rb +84 -61
  33. data/spec/lib/recog/fingerprint_spec.rb +4 -4
  34. data/spec/lib/recog/verify_reporter_spec.rb +8 -8
  35. data/update_cpes.py +129 -36
  36. data/xml/apache_os.xml +61 -19
  37. data/xml/architecture.xml +15 -1
  38. data/xml/dhcp_vendor_class.xml +1 -1
  39. data/xml/dns_versionbind.xml +16 -13
  40. data/xml/favicons.xml +87 -5
  41. data/xml/fingerprints.xsd +9 -1
  42. data/xml/ftp_banners.xml +131 -141
  43. data/xml/h323_callresp.xml +2 -2
  44. data/xml/hp_pjl_id.xml +81 -81
  45. data/xml/html_title.xml +178 -9
  46. data/xml/http_cookies.xml +83 -27
  47. data/xml/http_servers.xml +409 -269
  48. data/xml/http_wwwauth.xml +70 -37
  49. data/xml/imap_banners.xml +2 -2
  50. data/xml/nntp_banners.xml +8 -5
  51. data/xml/ntp_banners.xml +33 -33
  52. data/xml/operating_system.xml +92 -77
  53. data/xml/pop_banners.xml +17 -17
  54. data/xml/sip_banners.xml +16 -5
  55. data/xml/sip_user_agents.xml +122 -27
  56. data/xml/smb_native_lm.xml +5 -5
  57. data/xml/smb_native_os.xml +25 -25
  58. data/xml/smtp_banners.xml +132 -131
  59. data/xml/smtp_help.xml +1 -1
  60. data/xml/snmp_sysdescr.xml +1227 -1227
  61. data/xml/snmp_sysobjid.xml +2 -2
  62. data/xml/ssh_banners.xml +9 -5
  63. data/xml/telnet_banners.xml +49 -0
  64. data/xml/tls_jarm.xml +22 -2
  65. data/xml/x11_banners.xml +3 -3
  66. data/xml/x509_issuers.xml +3 -2
  67. data/xml/x509_subjects.xml +3 -3
  68. metadata +19 -3
  69. data/lib/recog/verifier_factory.rb +0 -13
data/xml/pop_banners.xml CHANGED
@@ -52,7 +52,7 @@
52
52
 
53
53
  <fingerprint pattern="^Qpopper \(version (\d+\.\d+\.\d+), modified by Sphera Technologies\) at (.+) starting\.">
54
54
  <description>Qpopper with Sphera mods</description>
55
- <example>Qpopper (version 4.0.3, modified by Sphera Technologies) at domain starting. &lt;xxx@domain&gt;</example>
55
+ <example service.version="4.0.3" host.domain="domain">Qpopper (version 4.0.3, modified by Sphera Technologies) at domain starting. &lt;xxx@domain&gt;</example>
56
56
  <param pos="0" name="service.vendor" value="Sphera"/>
57
57
  <param pos="0" name="service.family" value="Qpopper"/>
58
58
  <param pos="0" name="service.product" value="Qpopper"/>
@@ -62,7 +62,7 @@
62
62
 
63
63
  <fingerprint pattern="^Qpopper \(version (\d+\.\d+\.\d+)-mysql-(.+)\) at (.+) starting\.">
64
64
  <description>Qpopper with MySQL auth module</description>
65
- <example>Qpopper (version 4.0.3-mysql-0.13) at domain starting. &lt;xxx@domain&gt;</example>
65
+ <example service.version="4.0.3" service.component.version="0.13" host.domain="domain">Qpopper (version 4.0.3-mysql-0.13) at domain starting. &lt;xxx@domain&gt;</example>
66
66
  <param pos="0" name="service.vendor" value="Qualcomm"/>
67
67
  <param pos="0" name="service.family" value="Qpopper"/>
68
68
  <param pos="0" name="service.product" value="Qpopper"/>
@@ -73,11 +73,11 @@
73
73
  <param pos="3" name="host.domain"/>
74
74
  </fingerprint>
75
75
 
76
- <fingerprint pattern="(?i)^Qpop(?:per)? \(version ([\d\.]+)\) at (.+)(?: starting\.)?">
76
+ <fingerprint pattern="(?i)^Qpop(?:per)? \(version ([\d\.]+)\) at (\S{1,512})(?: starting\.)?">
77
77
  <description>Qpopper missing version info</description>
78
- <example>Qpopper (version 4.0.16) at foo.example.com</example>
79
- <example>QPOP (version 2.53) at domain starting. &lt;xxx@domain&gt;</example>
80
- <example>Qpopper (version 4.0.3) at domain starting. &lt;xxx@domain&gt;</example>
78
+ <example service.version="4.0.16" host.domain="foo.example.com">Qpopper (version 4.0.16) at foo.example.com</example>
79
+ <example service.version="2.53" host.domain="domain">QPOP (version 2.53) at domain starting. &lt;xxx@domain&gt;</example>
80
+ <example service.version="4.0.3" host.domain="domain">Qpopper (version 4.0.3) at domain starting. &lt;xxx@domain&gt;</example>
81
81
  <param pos="0" name="service.vendor" value="Qualcomm"/>
82
82
  <param pos="0" name="service.family" value="Qpopper"/>
83
83
  <param pos="0" name="service.product" value="Qpopper"/>
@@ -87,7 +87,7 @@
87
87
 
88
88
  <fingerprint pattern="^QPOP \(version (.*)\) at (.+) starting\.">
89
89
  <description>Qpopper with missing version info</description>
90
- <example>QPOP (version ?) at domain starting. &lt;xxx@domain&gt;</example>
90
+ <example qpopper.version="?" host.domain="domain">QPOP (version ?) at domain starting. &lt;xxx@domain&gt;</example>
91
91
  <param pos="0" name="service.vendor" value="Qualcomm"/>
92
92
  <param pos="0" name="service.family" value="Qpopper"/>
93
93
  <param pos="0" name="service.product" value="Qpopper"/>
@@ -97,7 +97,7 @@
97
97
 
98
98
  <fingerprint pattern="^Microsoft Exchange Server 2003 POP3 server version (\d+\.\d+\.\d+\.\d+) (.+) ready.$">
99
99
  <description>Microsoft Exchange Server 2003</description>
100
- <example>Microsoft Exchange Server 2003 POP3 server version 6.5.6944.0 (host) ready.</example>
100
+ <example service.version="6.5.6944.0" host.name="(host)">Microsoft Exchange Server 2003 POP3 server version 6.5.6944.0 (host) ready.</example>
101
101
  <param pos="0" name="service.vendor" value="Microsoft"/>
102
102
  <param pos="0" name="service.family" value="Exchange Server"/>
103
103
  <param pos="0" name="service.product" value="Exchange 2003 Server"/>
@@ -110,9 +110,9 @@
110
110
  <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
111
111
  </fingerprint>
112
112
 
113
- <fingerprint pattern="^Microsoft Exchange 2000 POP3 server version (\d+\.\d+\.\d+\.\d+) (.+) ready.$">
113
+ <fingerprint pattern="^Microsoft Exchange 2000 POP3 server version (\d+\.\d+\.\d+\.\d+) \((\S{1,512})\) ready\.$">
114
114
  <description>Microsoft Exchange Server 2000</description>
115
- <example>Microsoft Exchange 2000 POP3 server version 6.0.6603.0 (host) ready.</example>
115
+ <example service.version="6.0.6603.0" host.name="host">Microsoft Exchange 2000 POP3 server version 6.0.6603.0 (host) ready.</example>
116
116
  <param pos="0" name="service.vendor" value="Microsoft"/>
117
117
  <param pos="0" name="service.family" value="Exchange Server"/>
118
118
  <param pos="0" name="service.product" value="Exchange 2000 Server"/>
@@ -127,7 +127,7 @@
127
127
 
128
128
  <fingerprint pattern="^Microsoft Exchange POP3 server version (\d+\.\d+\.\d+\.\d+) ready$">
129
129
  <description>Microsoft Exchange Server</description>
130
- <example>Microsoft Exchange POP3 server version 5.5.2654.50 ready</example>
130
+ <example service.version="5.5.2654.50">Microsoft Exchange POP3 server version 5.5.2654.50 ready</example>
131
131
  <param pos="0" name="service.vendor" value="Microsoft"/>
132
132
  <param pos="0" name="service.family" value="Exchange Server"/>
133
133
  <param pos="0" name="service.product" value="Exchange Server"/>
@@ -141,7 +141,7 @@
141
141
 
142
142
  <fingerprint pattern="^Microsoft Windows POP3 Service Version 1.0 &lt;.+@(.+)&gt; ready.$">
143
143
  <description>Microsoft POP3 Services on Windows 2003</description>
144
- <example>Microsoft Windows POP3 Service Version 1.0 &lt;xxx@host&gt; ready.</example>
144
+ <example host.name="host">Microsoft Windows POP3 Service Version 1.0 &lt;xxx@host&gt; ready.</example>
145
145
  <param pos="0" name="service.vendor" value="Microsoft"/>
146
146
  <param pos="0" name="service.family" value="E-mail Services"/>
147
147
  <param pos="0" name="service.product" value="E-mail Services"/>
@@ -240,7 +240,7 @@
240
240
 
241
241
  <fingerprint pattern="^(\S{1,512}) Zimbra (\S+) POP3 server ready\.?$">
242
242
  <description>VMware Zimbra POP with version</description>
243
- <example host.name="foo.bar">foo.bar Zimbra 7.0.0_GA_3079 POP3 server ready</example>
243
+ <example host.name="foo.bar" service.version="7.0.0_GA_3079">foo.bar Zimbra 7.0.0_GA_3079 POP3 server ready</example>
244
244
  <param pos="0" name="service.vendor" value="VMware"/>
245
245
  <param pos="0" name="service.product" value="Zimbra"/>
246
246
  <param pos="2" name="service.version"/>
@@ -250,15 +250,15 @@
250
250
 
251
251
  <fingerprint pattern="^(?:S?POP3? server ready |Hello there.? )?&lt;.*@([^&gt;]+)&gt;$">
252
252
  <description>Generic masked POP3 server</description>
253
- <example>POP3 server ready &lt;58c29ae4-7316-429e-8109-060444ab1a28@foo.example.com&gt;</example>
254
- <example>&lt;84427.1298535083@foo.example.com&gt;</example>
253
+ <example host.name="foo.example.com">POP3 server ready &lt;58c29ae4-7316-429e-8109-060444ab1a28@foo.example.com&gt;</example>
254
+ <example host.name="foo.example.com">&lt;84427.1298535083@foo.example.com&gt;</example>
255
255
  <param pos="1" name="host.name"/>
256
256
  </fingerprint>
257
257
 
258
258
  <fingerprint pattern="^ApplePasswordServer ([\d\.]+) password">
259
259
  <description>Apple Open Directory</description>
260
- <example>ApplePasswordServer 10.6.0.0 password server at 10.2.90.228 ready.</example>
261
- <example>ApplePasswordServer 10.5.0.1 password serv</example>
260
+ <example os.version="10.6.0.0">ApplePasswordServer 10.6.0.0 password server at 10.2.90.228 ready.</example>
261
+ <example os.version="10.5.0.1">ApplePasswordServer 10.5.0.1 password serv</example>
262
262
  <param pos="0" name="service.vendor" value="Apple"/>
263
263
  <param pos="0" name="service.product" value="Open Directory"/>
264
264
  <param pos="0" name="os.vendor" value="Apple"/>
data/xml/sip_banners.xml CHANGED
@@ -184,7 +184,7 @@
184
184
  <description>Cisco/Tandberg TelePresence</description>
185
185
  <example os.version="TC7.0.2.aecf2d9" tandberg.model="519" hw.product="TANDBERG/519">TANDBERG/519 (TC7.0.2.aecf2d9)</example>
186
186
  <example os.version="X12.5.2" tandberg.model="4137" hw.product="TANDBERG/4137">TANDBERG/4137 (X12.5.2 (TEST SW))</example>
187
- <example os.version="X8.2.1" hw.product="TANDBERG/4130">TANDBERG/4130 (X8.2.1)</example>
187
+ <example os.version="X8.2.1" hw.product="TANDBERG/4130" tandberg.model="4130">TANDBERG/4130 (X8.2.1)</example>
188
188
  <example os.version="XC2.2.1-b2bua-1.0" hw.product="TANDBERG/4353" tandberg.model="4353">TANDBERG/4353 (XC2.2.1-b2bua-1.0)</example>
189
189
  <example os.version="TC5.1.4.295090" hw.product="TANDBERG/516" tandberg.model="516">TANDBERG/516 (TC5.1.4.295090)</example>
190
190
  <example os.version="TCNC5.1.4.295090" hw.product="TANDBERG/517" tandberg.model="517">TANDBERG/517 (TCNC5.1.4.295090)</example>
@@ -312,9 +312,9 @@
312
312
 
313
313
  <fingerprint pattern="^Grandstream (UCM6\d\d\d)V(\d\.\d\w) ([\d.]+)$">
314
314
  <description>Grandstream UCM 6xxx series generic</description>
315
- <example hw.product="UCM6102" os.version="1.0.6.10">Grandstream UCM6102V1.5A 1.0.6.10</example>
316
- <example hw.product="UCM6302" hw.version="1.2B">Grandstream UCM6302V1.2B 1.0.3.10</example>
317
- <example hw.product="UCM6510">Grandstream UCM6510V1.4B 1.0.14.23</example>
315
+ <example hw.product="UCM6102" os.version="1.0.6.10" hw.version="1.5A">Grandstream UCM6102V1.5A 1.0.6.10</example>
316
+ <example hw.product="UCM6302" hw.version="1.2B" os.version="1.0.3.10">Grandstream UCM6302V1.2B 1.0.3.10</example>
317
+ <example hw.product="UCM6510" os.version="1.0.14.23" hw.version="1.4B">Grandstream UCM6510V1.4B 1.0.14.23</example>
318
318
  <param pos="0" name="os.vendor" value="Grandstream"/>
319
319
  <param pos="3" name="os.version"/>
320
320
  <param pos="0" name="os.device" value="SIP Gateway"/>
@@ -668,7 +668,7 @@
668
668
  <description>Fortinet FortiVoice</description>
669
669
  <example hw.product="200D">FortiVoice-200D</example>
670
670
  <example hw.product="VM-Azure">FortiVoice-VM-Azure</example>
671
- <example>FortiVoice-1000E</example>
671
+ <example hw.product="1000E">FortiVoice-1000E</example>
672
672
  <param pos="0" name="service.vendor" value="Fortinet"/>
673
673
  <param pos="0" name="service.product" value="FortiVoice"/>
674
674
  <param pos="0" name="service.device" value="SIP Gateway"/>
@@ -716,4 +716,15 @@
716
716
  <param pos="2" name="os.version"/>
717
717
  </fingerprint>
718
718
 
719
+ <fingerprint pattern="^Eltex (ESR-\d\w{1,4})$">
720
+ <description>Eltex ESR model service gateway</description>
721
+ <example hw.product="ESR-12V">Eltex ESR-12V</example>
722
+ <param pos="0" name="os.vendor" value="Eltex"/>
723
+ <param pos="0" name="os.device" value="Router"/>
724
+ <param pos="0" name="os.product" value="{hw.product} Firmware"/>
725
+ <param pos="0" name="hw.vendor" value="Eltex"/>
726
+ <param pos="1" name="hw.product"/>
727
+ <param pos="0" name="hw.device" value="Router"/>
728
+ </fingerprint>
729
+
719
730
  </fingerprints>
data/xml/sip_user_agents.xml CHANGED
@@ -28,7 +28,7 @@
28
28
 
29
29
  <fingerprint pattern="^Home&amp;Life HUB/([\d.]+)$">
30
30
  <description>Zyxel home routers</description>
31
- <example>Home&amp;Life HUB/1.1.26.00</example>
31
+ <example os.version="1.1.26.00">Home&amp;Life HUB/1.1.26.00</example>
32
32
  <param pos="0" name="os.vendor" value="Zyxel"/>
33
33
  <param pos="1" name="os.version"/>
34
34
  <param pos="0" name="os.device" value="Router"/>
@@ -65,11 +65,11 @@
65
65
  <description>Technicolor TGxxx Router with build info</description>
66
66
  <example hw.product="TG784n" os.version="10.2.1.O">Technicolor TG784n v3 Build 10.2.1.O</example>
67
67
  <example hw.product="TG789vn" os.version="10.5.2.Z.EC">Technicolor TG789vn v3 Build 10.5.2.Z.EC</example>
68
- <example>MediaAccess TG789vac v2 Build 10.5.8.Y.GX CP1916SAQHD</example>
68
+ <example os.version="10.5.8.Y.GX" hw.product="TG789vac">MediaAccess TG789vac v2 Build 10.5.8.Y.GX CP1916SAQHD</example>
69
69
  <example hw.product="TG799vn" os.version="10.5.2.T.JF">Technicolor TG799vn v2 Build 10.5.2.T.JF</example>
70
70
  <example hw.product="TG788vn" os.version="10.5.2.S.GD">MediaAccess TG788vn v2 Build 10.5.2.S.GD</example>
71
71
  <example hw.product="TG799vac" os.version="17.2.0405-1021">MediaAccess TG799vac Build 17.2.0405-1021</example>
72
- <example hw.product="TG389">MediaAccess TG389 Build 10.5.2.T.AQ</example>
72
+ <example hw.product="TG389" os.version="10.5.2.T.AQ">MediaAccess TG389 Build 10.5.2.T.AQ</example>
73
73
  <param pos="0" name="os.vendor" value="Technicolor"/>
74
74
  <param pos="0" name="os.device" value="Router"/>
75
75
  <param pos="2" name="os.version"/>
@@ -122,7 +122,7 @@
122
122
 
123
123
  <fingerprint pattern="^Cisco-SIPGateway/IOS-([\d\.x]+)$">
124
124
  <description>Cisco SIPGateway</description>
125
- <example>Cisco-SIPGateway/IOS-12.x</example>
125
+ <example os.version="12.x">Cisco-SIPGateway/IOS-12.x</example>
126
126
  <param pos="0" name="os.vendor" value="Cisco"/>
127
127
  <param pos="0" name="os.product" value="IOS"/>
128
128
  <param pos="1" name="os.version"/>
@@ -171,18 +171,18 @@
171
171
 
172
172
  <fingerprint pattern="^(?:AVM )?(FRITZ!Box .*) +(\d+\.\d+\.\d+)">
173
173
  <description>AVM FritzBox</description>
174
- <example>AVM FRITZ!Box Fon 06.03.13</example>
175
- <example>AVM FRITZ!Box Fon 06.03.65 (Jun 7 2005)</example>
176
- <example>AVM FRITZ!Box Fon 5010 Annex A (ITA) 48.04.46 (Sep 14 2007)</example>
177
- <example>AVM FRITZ!Box Fon 5012 (UI) 25.03.90 (3.01.03 tested by accredited T-Com test lab) (Oct 28 2005)</example>
178
- <example>AVM FRITZ!Box Fon 5113 Annex A 83.04.69 (Dec 2 2008)</example>
179
- <example>AVM FRITZ!Box Fon 5124 56.04.77 (Feb 14 2014)</example>
180
- <example>AVM FRITZ!Box Fon 7170 Annex A.B ML Speedport W701V 58.04.67 (Dec 18 2008)</example>
181
- <example>AVM FRITZ!Box 3272 126.05.50 (Feb 27 2013)</example>
182
- <example>AVM FRITZ!Box 7170 Annex A 58.04.85 (Apr 4 2011)</example>
183
- <example>AVM FRITZ!Box 7312 117.05.23 TAL (Jun 1 2012)</example>
184
- <example>AVM FRITZ!Box WLAN 3270 v3 Edition Italia 125.05.52 (Feb 7 2014)</example>
185
- <example>AVM FRITZ!Box Speedport W701V Annex A 58.04.82 (May 12 2010)</example>
174
+ <example os.product="FRITZ!Box Fon" os.version="06.03.13">AVM FRITZ!Box Fon 06.03.13</example>
175
+ <example os.product="FRITZ!Box Fon" os.version="06.03.65">AVM FRITZ!Box Fon 06.03.65 (Jun 7 2005)</example>
176
+ <example os.product="FRITZ!Box Fon 5010 Annex A (ITA)" os.version="48.04.46">AVM FRITZ!Box Fon 5010 Annex A (ITA) 48.04.46 (Sep 14 2007)</example>
177
+ <example os.product="FRITZ!Box Fon 5012 (UI)" os.version="25.03.90">AVM FRITZ!Box Fon 5012 (UI) 25.03.90 (3.01.03 tested by accredited T-Com test lab) (Oct 28 2005)</example>
178
+ <example os.product="FRITZ!Box Fon 5113 Annex A" os.version="83.04.69">AVM FRITZ!Box Fon 5113 Annex A 83.04.69 (Dec 2 2008)</example>
179
+ <example os.product="FRITZ!Box Fon 5124" os.version="56.04.77">AVM FRITZ!Box Fon 5124 56.04.77 (Feb 14 2014)</example>
180
+ <example os.product="FRITZ!Box Fon 7170 Annex A.B ML Speedport W701V" os.version="58.04.67">AVM FRITZ!Box Fon 7170 Annex A.B ML Speedport W701V 58.04.67 (Dec 18 2008)</example>
181
+ <example os.product="FRITZ!Box 3272" os.version="126.05.50">AVM FRITZ!Box 3272 126.05.50 (Feb 27 2013)</example>
182
+ <example os.product="FRITZ!Box 7170 Annex A" os.version="58.04.85">AVM FRITZ!Box 7170 Annex A 58.04.85 (Apr 4 2011)</example>
183
+ <example os.product="FRITZ!Box 7312" os.version="117.05.23">AVM FRITZ!Box 7312 117.05.23 TAL (Jun 1 2012)</example>
184
+ <example os.product="FRITZ!Box WLAN 3270 v3 Edition Italia" os.version="125.05.52">AVM FRITZ!Box WLAN 3270 v3 Edition Italia 125.05.52 (Feb 7 2014)</example>
185
+ <example os.product="FRITZ!Box Speedport W701V Annex A" os.version="58.04.82">AVM FRITZ!Box Speedport W701V Annex A 58.04.82 (May 12 2010)</example>
186
186
  <param pos="0" name="os.vendor" value="AVM"/>
187
187
  <param pos="0" name="os.family" value="FRITZ!Box"/>
188
188
  <param pos="1" name="os.product"/>
@@ -193,8 +193,8 @@
193
193
 
194
194
  <fingerprint pattern="^(?:AVM )?(FRITZ!Fon .*) +(\d+\.\d+\.\d+)">
195
195
  <description>AVM FritzFon</description>
196
- <example>AVM FRITZ!Fon 7150 (fs) 38.04.56 (Mar 31 2008)</example>
197
- <example>AVM FRITZ!Fon WLAN 7150 Annex A 58.04.84 (Apr 4 2011)</example>
196
+ <example os.product="FRITZ!Fon 7150 (fs)" os.version="38.04.56">AVM FRITZ!Fon 7150 (fs) 38.04.56 (Mar 31 2008)</example>
197
+ <example os.product="FRITZ!Fon WLAN 7150 Annex A" os.version="58.04.84">AVM FRITZ!Fon WLAN 7150 Annex A 58.04.84 (Apr 4 2011)</example>
198
198
  <param pos="0" name="os.vendor" value="AVM"/>
199
199
  <param pos="0" name="os.family" value="FRITZ!Fon"/>
200
200
  <param pos="1" name="os.product"/>
@@ -205,7 +205,7 @@
205
205
 
206
206
  <fingerprint pattern="^(?:AVM )?(Multibox .*) +(\d+\.\d+\.\d+)">
207
207
  <description>AVM Multibox - Generic</description>
208
- <example>AVM Multibox 7390 NGN 84.05.09 (Jan 13 2012)</example>
208
+ <example os.product="Multibox 7390 NGN" os.version="84.05.09" hw.product="Multibox 7390 NGN">AVM Multibox 7390 NGN 84.05.09 (Jan 13 2012)</example>
209
209
  <param pos="0" name="os.vendor" value="AVM"/>
210
210
  <param pos="0" name="os.family" value="Multibox"/>
211
211
  <param pos="1" name="os.product"/>
@@ -269,10 +269,10 @@
269
269
 
270
270
  <fingerprint pattern="^(?:Polycom/[\d\.]+ )?Polycom(SoundPoint|VVX|SoundStation)\S+_(\d+)-UA/([\d\.]+)(?:_(.{12}))?$">
271
271
  <description>Polycom SoundPoint, SountdStation, VVX VoIP phones</description>
272
- <example hw.version="5.8.0.13337" hw.family="VVX" hw.product="VVX 350">PolycomVVX-VVX_350-UA/5.8.0.13337</example>
273
- <example hw.version="4.1.4.7430" hw.family="VVX" hw.product="VVX 400" host.mac="010203040506">PolycomVVX-VVX_400-UA/4.1.4.7430_010203040506</example>
274
- <example hw.version="5.5.0.23866" hw.family="VVX" hw.product="VVX 501">Polycom/5.5.0.23866 PolycomVVX-VVX_501-UA/5.5.0.23866</example>
275
- <example hw.version="4.0.7.2514" hw.family="SoundPoint" hw.product="SoundPoint 670">PolycomSoundPointIP-SPIP_670-UA/4.0.7.2514</example>
272
+ <example hw.version="5.8.0.13337" hw.family="VVX" hw.product="VVX 350" hw.model="350">PolycomVVX-VVX_350-UA/5.8.0.13337</example>
273
+ <example hw.version="4.1.4.7430" hw.family="VVX" hw.product="VVX 400" host.mac="010203040506" hw.model="400">PolycomVVX-VVX_400-UA/4.1.4.7430_010203040506</example>
274
+ <example hw.version="5.5.0.23866" hw.family="VVX" hw.product="VVX 501" hw.model="501">Polycom/5.5.0.23866 PolycomVVX-VVX_501-UA/5.5.0.23866</example>
275
+ <example hw.version="4.0.7.2514" hw.family="SoundPoint" hw.product="SoundPoint 670" hw.model="670">PolycomSoundPointIP-SPIP_670-UA/4.0.7.2514</example>
276
276
  <example hw.version="4.0.8.1608" hw.model="7000" hw.family="SoundStation" hw.product="SoundStation 7000">PolycomSoundStationIP-SSIP_7000-UA/4.0.8.1608</example>
277
277
  <param pos="0" name="hw.vendor" value="Polycom"/>
278
278
  <param pos="0" name="hw.device" value="VoIP"/>
@@ -285,9 +285,10 @@
285
285
 
286
286
  <fingerprint pattern="^(?:Polycom/[\d\.]+ )?Polycom(?:RealPresenceTrio)-Trio_(\S+)-UA/([\d\.]+)(?:_(.{12}))?$">
287
287
  <description>Polycom RealPresence Trio Phones</description>
288
- <example hw.version="5.4.0.12197" hw.product="RealPresence Trio 8800">PolycomRealPresenceTrio-Trio_8800-UA/5.4.0.12197</example>
289
- <example hw.version="5.7.2.3123" hw.product="RealPresence Trio Visual+">PolycomRealPresenceTrio-Trio_Visual+-UA/5.7.2.3123</example>
290
- <example hw.version="5.4.3.2389" hw.product="RealPresence Trio 8800">Polycom/5.4.3.2389 PolycomRealPresenceTrio-Trio_8800-UA/5.4.3.2389</example>
288
+ <example hw.version="5.4.0.12197" hw.product="RealPresence Trio 8800" hw.model="8800">PolycomRealPresenceTrio-Trio_8800-UA/5.4.0.12197</example>
289
+ <example hw.version="5.7.2.3123" hw.product="RealPresence Trio Visual+" hw.model="Visual+">PolycomRealPresenceTrio-Trio_Visual+-UA/5.7.2.3123</example>
290
+ <example hw.version="5.4.3.2389" hw.product="RealPresence Trio 8800" hw.model="8800">Polycom/5.4.3.2389 PolycomRealPresenceTrio-Trio_8800-UA/5.4.3.2389</example>
291
+ <example hw.version="5.4.3.2389" hw.product="RealPresence Trio 8800" hw.model="8800" host.mac="DEADBEEF0000">Polycom/5.4.3.2389 PolycomRealPresenceTrio-Trio_8800-UA/5.4.3.2389_DEADBEEF0000</example>
291
292
  <param pos="0" name="hw.vendor" value="Polycom"/>
292
293
  <param pos="0" name="hw.device" value="VoIP"/>
293
294
  <param pos="0" name="hw.family" value="RealPresence"/>
@@ -596,7 +597,7 @@
596
597
 
597
598
  <fingerprint pattern="^Valcom (VIP-\w+) sw([\d.]+)">
598
599
  <description>Valcom SIP device with version</description>
599
- <example os.version="1.50.28">Valcom VIP-204 sw1.50.28</example>
600
+ <example os.version="1.50.28" hw.product="VIP-204">Valcom VIP-204 sw1.50.28</example>
600
601
  <param pos="0" name="os.vendor" value="Valcom"/>
601
602
  <param pos="0" name="os.product" value="{hw.product} Firmware"/>
602
603
  <param pos="2" name="os.version"/>
@@ -617,4 +618,98 @@
617
618
  <param pos="1" name="os.version"/>
618
619
  </fingerprint>
619
620
 
621
+ <fingerprint pattern="^(TAU-\d+[A-Z]*(?:\.IP)?)/([\d.]+) SN/(VI[0-9A-Z]+)$">
622
+ <description>Eltex TAU model VoIP gateway - with serial number</description>
623
+ <example hw.product="TAU-8.IP" os.version="2.6.3">TAU-8.IP/2.6.3 SN/VI12345678</example>
624
+ <example os.version="2.0.0.229" hw.serial_number="VI4D012345">TAU-4M.IP/2.0.0.229 SN/VI4D012345</example>
625
+ <example hw.product="TAU-2M.IP" os.version="2.3.1.11" hw.serial_number="VI12345678">TAU-2M.IP/2.3.1.11 SN/VI12345678</example>
626
+ <example hw.product="TAU-1M.IP" os.version="2.0.0.229" hw.serial_number="VI3A012345">TAU-1M.IP/2.0.0.229 SN/VI3A012345</example>
627
+ <param pos="0" name="os.vendor" value="Eltex"/>
628
+ <param pos="0" name="os.product" value="{hw.product} Firmware"/>
629
+ <param pos="2" name="os.version"/>
630
+ <param pos="0" name="os.device" value="VoIP Gateway"/>
631
+ <param pos="0" name="hw.vendor" value="Eltex"/>
632
+ <param pos="1" name="hw.product"/>
633
+ <param pos="3" name="hw.serial_number"/>
634
+ <param pos="0" name="hw.device" value="VoIP Gateway"/>
635
+ </fingerprint>
636
+
637
+ <fingerprint pattern="^(TAU-\d+[A-Z]*(?:\.IP)?)/([\d.]+) SN/(VI[0-9A-Z]+) (?:SHA/[0-9a-f]+ )?sofia-sip/([\d.]+)$">
638
+ <description>Eltex TAU model VoIP gateway - with serial number and sofia version</description>
639
+ <example hw.product="TAU-8.IP" hw.serial_number="VI12345678">TAU-8.IP/2.3.0 SN/VI12345678 sofia-sip/1.12.10</example>
640
+ <example os.version="1.9.1" service.component.version="1.12.10">TAU-8.IP/1.9.1 SN/VI12345678 SHA/7404bd4 sofia-sip/1.12.10</example>
641
+ <example hw.product="TAU-2M.IP" os.version="1.13.3.5" hw.serial_number="VI12345678" service.component.version="1.12.10">TAU-2M.IP/1.13.3.5 SN/VI12345678 sofia-sip/1.12.10</example>
642
+ <example hw.product="TAU-1M.IP" os.version="1.9.3" hw.serial_number="VI3A012345" service.component.version="1.12.10">TAU-1M.IP/1.9.3 SN/VI3A012345 sofia-sip/1.12.10</example>
643
+ <param pos="0" name="service.vendor" value="FreeSWITCH"/>
644
+ <param pos="0" name="service.product" value="FreeSWITCH"/>
645
+ <param pos="0" name="service.device" value="SIP Gateway"/>
646
+ <param pos="0" name="service.cpe23" value="cpe:/a:freeswitch:freeswitch:-"/>
647
+ <param pos="0" name="service.component.vendor" value="FreeSWITCH"/>
648
+ <param pos="0" name="service.component.product" value="sofia-sip"/>
649
+ <param pos="4" name="service.component.version"/>
650
+ <param pos="0" name="os.vendor" value="Eltex"/>
651
+ <param pos="0" name="os.product" value="{hw.product} Firmware"/>
652
+ <param pos="2" name="os.version"/>
653
+ <param pos="0" name="os.device" value="VoIP Gateway"/>
654
+ <param pos="0" name="hw.vendor" value="Eltex"/>
655
+ <param pos="1" name="hw.product"/>
656
+ <param pos="3" name="hw.serial_number"/>
657
+ <param pos="0" name="hw.device" value="VoIP Gateway"/>
658
+ </fingerprint>
659
+
660
+ <fingerprint pattern="^(TAU-\d{1,2}) (?:build |v)([\d.]+) (?:with )?sofia-sip/([\d.]+)$">
661
+ <description>Eltex TAU model VoIP gateway - build variant with sofia version</description>
662
+ <example hw.product="TAU-72" os.version="2.18.0.35">TAU-72 build 2.18.0.35 sofia-sip/1.12.10</example>
663
+ <example service.component.version="1.12.10">TAU-1 v1.2 with sofia-sip/1.12.10</example>
664
+ <param pos="0" name="service.vendor" value="FreeSWITCH"/>
665
+ <param pos="0" name="service.product" value="FreeSWITCH"/>
666
+ <param pos="0" name="service.device" value="SIP Gateway"/>
667
+ <param pos="0" name="service.cpe23" value="cpe:/a:freeswitch:freeswitch:-"/>
668
+ <param pos="0" name="service.component.vendor" value="FreeSWITCH"/>
669
+ <param pos="0" name="service.component.product" value="sofia-sip"/>
670
+ <param pos="3" name="service.component.version"/>
671
+ <param pos="0" name="os.vendor" value="Eltex"/>
672
+ <param pos="0" name="os.product" value="{hw.product} Firmware"/>
673
+ <param pos="2" name="os.version"/>
674
+ <param pos="0" name="os.device" value="VoIP Gateway"/>
675
+ <param pos="0" name="hw.vendor" value="Eltex"/>
676
+ <param pos="1" name="hw.product"/>
677
+ <param pos="0" name="hw.device" value="VoIP Gateway"/>
678
+ </fingerprint>
679
+
680
+ <fingerprint pattern="^(?:Eltex )?(?:smg_pa_sip[ -]){1,2}([\d.]+)$">
681
+ <description>Eltex SMG model VoIP gateway - no model number</description>
682
+ <example os.version="3.9.1.50">Eltex smg_pa_sip smg_pa_sip-3.9.1.50</example>
683
+ <example os.version="3.10.1.22">smg_pa_sip smg_pa_sip-3.10.1.22</example>
684
+ <example os.version="3.18.0.67">smg_pa_sip 3.18.0.67</example>
685
+ <param pos="0" name="os.vendor" value="Eltex"/>
686
+ <param pos="0" name="os.product" value="SMG Firmware"/>
687
+ <param pos="1" name="os.version"/>
688
+ <param pos="0" name="os.device" value="VoIP Gateway"/>
689
+ <param pos="0" name="hw.vendor" value="Eltex"/>
690
+ <param pos="0" name="hw.device" value="VoIP Gateway"/>
691
+ </fingerprint>
692
+
693
+ <fingerprint pattern="^(RG-\d[\w-]+)/([\d.]+) SN/(VI\w+) (?:SHA/[0-9a-f]+ )?sofia-sip/([\d.]+)$">
694
+ <description>Eltex - NTP / NTU model broadband router - with serial number and sofia version</description>
695
+ <example hw.product="RG-5421G-Wac" hw.serial_number="VI12E45678">RG-5421G-Wac/2.4.2.87 SN/VI12E45678 sofia-sip/1.12.10</example>
696
+ <example os.version="1.11.0">RG-1404GF/1.11.0 SN/VI12E45678 sofia-sip/1.12.10</example>
697
+ <example service.component.version="1.12.1">RG-1404GF/1.8.0 SN/VI12E45678 SHA/0270864 sofia-sip/1.12.1</example>
698
+ <param pos="0" name="service.vendor" value="FreeSWITCH"/>
699
+ <param pos="0" name="service.product" value="FreeSWITCH"/>
700
+ <param pos="0" name="service.device" value="SIP Gateway"/>
701
+ <param pos="0" name="service.cpe23" value="cpe:/a:freeswitch:freeswitch:-"/>
702
+ <param pos="0" name="service.component.vendor" value="FreeSWITCH"/>
703
+ <param pos="0" name="service.component.product" value="sofia-sip"/>
704
+ <param pos="4" name="service.component.version"/>
705
+ <param pos="0" name="os.vendor" value="Eltex"/>
706
+ <param pos="0" name="os.product" value="{hw.product} Firmware"/>
707
+ <param pos="2" name="os.version"/>
708
+ <param pos="0" name="os.device" value="Broadband Router"/>
709
+ <param pos="0" name="hw.vendor" value="Eltex"/>
710
+ <param pos="1" name="hw.product"/>
711
+ <param pos="3" name="hw.serial_number"/>
712
+ <param pos="0" name="hw.device" value="Broadband Router"/>
713
+ </fingerprint>
714
+
620
715
  </fingerprints>
data/xml/smb_native_lm.xml CHANGED
@@ -39,12 +39,12 @@
39
39
 
40
40
  <fingerprint pattern="^Samba (\d\.\d+.\d+\w*)">
41
41
  <description>Samba</description>
42
- <example>Samba 3.0.24</example>
42
+ <example service.version="3.0.24">Samba 3.0.24</example>
43
43
  <example service.version="3.0.28a">Samba 3.0.28a</example>
44
- <example>Samba 3.0.32-0.2-2210-SUSE-SL10.3</example>
45
- <example>Samba 3.6.3</example>
46
- <example>Samba 3.6.6</example>
47
- <example>Samba 3.6.9-151.el6_4.1</example>
44
+ <example service.version="3.0.32">Samba 3.0.32-0.2-2210-SUSE-SL10.3</example>
45
+ <example service.version="3.6.3">Samba 3.6.3</example>
46
+ <example service.version="3.6.6">Samba 3.6.6</example>
47
+ <example service.version="3.6.9">Samba 3.6.9-151.el6_4.1</example>
48
48
  <param pos="0" name="service.vendor" value="Samba"/>
49
49
  <param pos="0" name="service.product" value="Samba"/>
50
50
  <param pos="1" name="service.version"/>
data/xml/smb_native_os.xml CHANGED
@@ -156,8 +156,8 @@
156
156
 
157
157
  <fingerprint pattern="^Windows Server \(R\) 2008 (\w+|\w+ \w+|\w+ \w+ \w+)(?: (?:with|without) Hyper-V|) (\d+) (Service Pack \d+)(?:, v\.\d+)?$">
158
158
  <description>Windows Server 2008</description>
159
- <example os.edition="Enterprise" os.version="Service Pack 1">Windows Server (R) 2008 Enterprise without Hyper-V 6001 Service Pack 1</example>
160
- <example os.edition="Enterprise" os.version="Service Pack 2">Windows Server (R) 2008 Enterprise 6002 Service Pack 2, v.275</example>
159
+ <example os.edition="Enterprise" os.version="Service Pack 1" os.build="6001">Windows Server (R) 2008 Enterprise without Hyper-V 6001 Service Pack 1</example>
160
+ <example os.edition="Enterprise" os.version="Service Pack 2" os.build="6002">Windows Server (R) 2008 Enterprise 6002 Service Pack 2, v.275</example>
161
161
  <param pos="0" name="os.certainty" value="1.0"/>
162
162
  <param pos="0" name="os.vendor" value="Microsoft"/>
163
163
  <param pos="0" name="os.product" value="Windows Server 2008"/>
@@ -169,7 +169,7 @@
169
169
 
170
170
  <fingerprint pattern="^Windows \(R\) Web Server 2008 (\d+) (Service Pack \d+)$">
171
171
  <description>Windows Web Server 2008 (SP)</description>
172
- <example os.edition="Web" os.version="Service Pack 2">Windows (R) Web Server 2008 6002 Service Pack 2</example>
172
+ <example os.edition="Web" os.version="Service Pack 2" os.build="6002">Windows (R) Web Server 2008 6002 Service Pack 2</example>
173
173
  <param pos="0" name="os.certainty" value="1.0"/>
174
174
  <param pos="0" name="os.vendor" value="Microsoft"/>
175
175
  <param pos="0" name="os.product" value="Windows Server 2008"/>
@@ -181,7 +181,7 @@
181
181
 
182
182
  <fingerprint pattern="^Windows \(R\) Web Server 2008 (\d+)$">
183
183
  <description>Windows Web Server 2008</description>
184
- <example>Windows (R) Web Server 2008 6002</example>
184
+ <example os.build="6002">Windows (R) Web Server 2008 6002</example>
185
185
  <param pos="0" name="os.certainty" value="1.0"/>
186
186
  <param pos="0" name="os.vendor" value="Microsoft"/>
187
187
  <param pos="0" name="os.product" value="Windows Server 2008"/>
@@ -217,7 +217,7 @@
217
217
 
218
218
  <fingerprint pattern="^Windows Server 2008 HPC Edition (\d+) (Service Pack \d+)$">
219
219
  <description>Windows Server 2008 HPC</description>
220
- <example>Windows Server 2008 HPC Edition 7601 Service Pack 1</example>
220
+ <example os.build="7601" os.version="Service Pack 1">Windows Server 2008 HPC Edition 7601 Service Pack 1</example>
221
221
  <param pos="0" name="os.certainty" value="1.0"/>
222
222
  <param pos="0" name="os.vendor" value="Microsoft"/>
223
223
  <param pos="0" name="os.product" value="Windows Server 2008"/>
@@ -229,7 +229,7 @@
229
229
 
230
230
  <fingerprint pattern="^Windows Server 2008 HPC Edition (\d+)$">
231
231
  <description>Windows Web Server 2008 HPC</description>
232
- <example>Windows Server 2008 HPC Edition 7600</example>
232
+ <example os.build="7600">Windows Server 2008 HPC Edition 7600</example>
233
233
  <param pos="0" name="os.certainty" value="1.0"/>
234
234
  <param pos="0" name="os.vendor" value="Microsoft"/>
235
235
  <param pos="0" name="os.product" value="Windows Server 2008"/>
@@ -242,8 +242,8 @@
242
242
 
243
243
  <fingerprint pattern="^Windows Server 2008 R2 (\w+|\w+ \w+|\w+ \w+ \w+) (\d+) (Service Pack \d+)(?:, v\.\d+)?$">
244
244
  <description>Windows Server 2008 R2</description>
245
- <example>Windows Server 2008 R2 Enterprise 7601 Service Pack 1</example>
246
- <example>Windows Server 2008 R2 Standard 7601 Service Pack 1</example>
245
+ <example os.edition="Enterprise" os.build="7601" os.version="Service Pack 1">Windows Server 2008 R2 Enterprise 7601 Service Pack 1</example>
246
+ <example os.edition="Standard" os.build="7601" os.version="Service Pack 1">Windows Server 2008 R2 Standard 7601 Service Pack 1</example>
247
247
  <param pos="0" name="os.certainty" value="1.0"/>
248
248
  <param pos="0" name="os.vendor" value="Microsoft"/>
249
249
  <param pos="0" name="os.product" value="Windows Server 2008 R2"/>
@@ -255,9 +255,9 @@
255
255
 
256
256
  <fingerprint pattern="^Windows Server 2008 R2 (\w+|\w+ \w+|\w+ \w+ \w+) (\d+)$">
257
257
  <description>Windows Server 2008 R2 without Service Pack</description>
258
- <example os.edition="Enterprise">Windows Server 2008 R2 Enterprise 7600</example>
259
- <example os.edition="Standard">Windows Server 2008 R2 Standard 7600</example>
260
- <example os.edition="Datacenter">Windows Server 2008 R2 Datacenter 7600</example>
258
+ <example os.edition="Enterprise" os.build="7600">Windows Server 2008 R2 Enterprise 7600</example>
259
+ <example os.edition="Standard" os.build="7600">Windows Server 2008 R2 Standard 7600</example>
260
+ <example os.edition="Datacenter" os.build="7600">Windows Server 2008 R2 Datacenter 7600</example>
261
261
  <param pos="0" name="os.certainty" value="1.0"/>
262
262
  <param pos="0" name="os.vendor" value="Microsoft"/>
263
263
  <param pos="0" name="os.product" value="Windows Server 2008 R2"/>
@@ -268,7 +268,7 @@
268
268
 
269
269
  <fingerprint pattern="^Windows Web Server 2008 R2 (\d+) (Service Pack \d+)$">
270
270
  <description>Windows Server 2008 R2 Web</description>
271
- <example os.version="Service Pack 1">Windows Web Server 2008 R2 7601 Service Pack 1</example>
271
+ <example os.version="Service Pack 1" os.build="7601">Windows Web Server 2008 R2 7601 Service Pack 1</example>
272
272
  <param pos="0" name="os.certainty" value="1.0"/>
273
273
  <param pos="0" name="os.vendor" value="Microsoft"/>
274
274
  <param pos="0" name="os.product" value="Windows Server 2008 R2"/>
@@ -280,7 +280,7 @@
280
280
 
281
281
  <fingerprint pattern="^Windows Web Server 2008 R2 (\d+)$">
282
282
  <description>Windows Web Server 2008 R2 Web</description>
283
- <example>Windows Web Server 2008 R2 7600</example>
283
+ <example os.build="7600">Windows Web Server 2008 R2 7600</example>
284
284
  <param pos="0" name="os.certainty" value="1.0"/>
285
285
  <param pos="0" name="os.vendor" value="Microsoft"/>
286
286
  <param pos="0" name="os.product" value="Windows Server 2008 R2"/>
@@ -378,7 +378,7 @@
378
378
 
379
379
  <fingerprint pattern="^Windows Vista \(TM\) (\w+|\w+ \w+|\w+ \w+ \w+) (\d+) (Service Pack \d+)$">
380
380
  <description>Windows Vista (SP)</description>
381
- <example os.edition="Home Premium" os.version="Service Pack 2">Windows Vista (TM) Home Premium 6002 Service Pack 2</example>
381
+ <example os.edition="Home Premium" os.version="Service Pack 2" os.build="6002">Windows Vista (TM) Home Premium 6002 Service Pack 2</example>
382
382
  <param pos="0" name="os.certainty" value="1.0"/>
383
383
  <param pos="0" name="os.vendor" value="Microsoft"/>
384
384
  <param pos="0" name="os.product" value="Windows Vista"/>
@@ -390,7 +390,7 @@
390
390
 
391
391
  <fingerprint pattern="^Windows Vista \(TM\) (\w+|\w+ \w+|\w+ \w+ \w+) (\d+)$">
392
392
  <description>Windows Vista</description>
393
- <example os.edition="Home Premium">Windows Vista (TM) Home Premium 6000</example>
393
+ <example os.edition="Home Premium" os.build="6000">Windows Vista (TM) Home Premium 6000</example>
394
394
  <param pos="0" name="os.certainty" value="1.0"/>
395
395
  <param pos="0" name="os.vendor" value="Microsoft"/>
396
396
  <param pos="0" name="os.product" value="Windows Vista"/>
@@ -401,9 +401,9 @@
401
401
 
402
402
  <fingerprint pattern="^(Windows (?:7|8|8\.1)(?:| RT)) (\w+|\w+ \w+|\w+ \w+ \w+) (\d+) (Service Pack \d+)(?:, v\.\d+)?$">
403
403
  <description>Windows 7/8 (SP + Edition)</description>
404
- <example os.edition="Enterprise" os.version="Service Pack 1">Windows 7 Enterprise 7601 Service Pack 1</example>
405
- <example os.edition="Starter" os.version="Service Pack 1">Windows 7 Starter 7601 Service Pack 1</example>
406
- <example os.edition="Ultimate" os.build="7601" os.version="Service Pack 1">Windows 7 Ultimate 7601 Service Pack 1, v.178</example>
404
+ <example os.edition="Enterprise" os.version="Service Pack 1" os.product="Windows 7" os.build="7601">Windows 7 Enterprise 7601 Service Pack 1</example>
405
+ <example os.edition="Starter" os.version="Service Pack 1" os.product="Windows 7" os.build="7601">Windows 7 Starter 7601 Service Pack 1</example>
406
+ <example os.edition="Ultimate" os.build="7601" os.version="Service Pack 1" os.product="Windows 7">Windows 7 Ultimate 7601 Service Pack 1, v.178</example>
407
407
  <param pos="0" name="os.certainty" value="1.0"/>
408
408
  <param pos="0" name="os.vendor" value="Microsoft"/>
409
409
  <param pos="1" name="os.product"/>
@@ -414,7 +414,7 @@
414
414
 
415
415
  <fingerprint pattern="^(Windows (?:7|8|8\.1)(?:| RT)) (\d+) (Service Pack \d+)$">
416
416
  <description>Windows 7/8 (SP)</description>
417
- <example os.version="Service Pack 1">Windows 7 7601 Service Pack 1</example>
417
+ <example os.version="Service Pack 1" os.product="Windows 7" os.build="7601">Windows 7 7601 Service Pack 1</example>
418
418
  <param pos="0" name="os.certainty" value="1.0"/>
419
419
  <param pos="0" name="os.vendor" value="Microsoft"/>
420
420
  <param pos="1" name="os.product"/>
@@ -424,9 +424,9 @@
424
424
 
425
425
  <fingerprint pattern="^(Windows (?:7|8|8\.1)(?:| RT)) (\w+|\w+ \w+|\w+ \w+ \w+) (\d+)$">
426
426
  <description>Windows 7/8 (Edition)</description>
427
- <example os.edition="Enterprise">Windows 7 Enterprise 7600</example>
428
- <example os.edition="Enterprise">Windows 8.1 Enterprise 9600</example>
429
- <example os.edition="Enterprise">Windows 8 Enterprise 9200</example>
427
+ <example os.edition="Enterprise" os.product="Windows 7" os.build="7600">Windows 7 Enterprise 7600</example>
428
+ <example os.edition="Enterprise" os.product="Windows 8.1" os.build="9600">Windows 8.1 Enterprise 9600</example>
429
+ <example os.edition="Enterprise" os.product="Windows 8" os.build="9200">Windows 8 Enterprise 9200</example>
430
430
  <param pos="0" name="os.certainty" value="1.0"/>
431
431
  <param pos="0" name="os.vendor" value="Microsoft"/>
432
432
  <param pos="1" name="os.product"/>
@@ -436,7 +436,7 @@
436
436
 
437
437
  <fingerprint pattern="^(Windows (?:7|8|8\.1)(?:| RT)) (\d+)$">
438
438
  <description>Windows 7/8</description>
439
- <example>Windows 8 9200</example>
439
+ <example os.product="Windows 8" os.build="9200">Windows 8 9200</example>
440
440
  <param pos="0" name="os.certainty" value="1.0"/>
441
441
  <param pos="0" name="os.vendor" value="Microsoft"/>
442
442
  <param pos="1" name="os.product"/>
@@ -508,7 +508,7 @@
508
508
 
509
509
  <fingerprint pattern="^Windows Server 2012 (\w+|\w+ \w+|\w+ \w+ \w+) (\d+)$">
510
510
  <description>Windows Server 2012</description>
511
- <example>Windows Server 2012 Standard 9200</example>
511
+ <example os.edition="Standard" os.build="9200">Windows Server 2012 Standard 9200</example>
512
512
  <param pos="0" name="os.certainty" value="1.0"/>
513
513
  <param pos="0" name="os.vendor" value="Microsoft"/>
514
514
  <param pos="0" name="os.product" value="Windows Server 2012"/>
@@ -637,7 +637,7 @@
637
637
 
638
638
  <fingerprint pattern="^EMC-SNAS:T([\d\.]+)?$">
639
639
  <description>EMC Celerra</description>
640
- <example service.version="7.1.80.7">EMC-SNAS:T7.1.80.7</example>
640
+ <example service.version="7.1.80.7" os.version="7.1.80.7">EMC-SNAS:T7.1.80.7</example>
641
641
  <param pos="0" name="service.vendor" value="EMC"/>
642
642
  <param pos="0" name="service.product" value="Celerra"/>
643
643
  <param pos="1" name="service.version"/>