threat

This feed is no longer available and the default config should be changed to disable it until it is fully removed from rita-bl.

• https://github.com/activecm/rita/blob/master/etc/rita.yaml#L121
• https://github.com/activecm/rita/blob/master/config/static.go#L78

activecm/rita-bl#10

https://intelmq.readthedocs.io/en/latest/user/bots.html#filter

Currently the docs say:

filter_regex - attribute determines if the filter_value shall be treated as regular expression or not.
If this attribute is not empty, the bot uses python’s “search” function to evaluate the filter.

It is not clear from this text, that the "search" function is re.search and what it implies (as

"AA03": { "description": "Weakness in SSO Authorization", "source": (Process, Element), "target": (Process, Server), "condition": "target.implementsAuthenticationScheme is False", },

What if the Process implements BasicAuth or uses mutual TLS (neither of which is SSO)?
If the Process uses SAML or OAuth, then maybe.
Maybe authenticationScheme as a string var is neces