Shall we store Meta Data?
For example, some IP's have no fDNS entry and we start resolving rDNS and use tlsx to get CN/SAN.
The rDNS may resolve to dsl.1.2.40.50.california.blah.dsl.verizon.net (a rather useless rDNS from a hackers perspective)
However, the CN/SAN-scan may show D-Link or Bitrix or VNC Server...all this is really useful for a hacker.
What shall we show to the user? The rDNS or the meta data? Or both?
(and shall the pattern/regex filter extend over the meta data and treat them all as 'strings'?).
Shall we store Meta Data?
For example, some IP's have no fDNS entry and we start resolving rDNS and use tlsx to get CN/SAN.
The rDNS may resolve to dsl.1.2.40.50.california.blah.dsl.verizon.net (a rather useless rDNS from a hackers perspective)
However, the CN/SAN-scan may show
D-LinkorBitrixorVNC Server...all this is really useful for a hacker.What shall we show to the user? The rDNS or the meta data? Or both?
(and shall the pattern/regex filter extend over the meta data and treat them all as 'strings'?).