From e3b0828005f13a54eb1eb6ebd5b6145c0b8403a9 Mon Sep 17 00:00:00 2001 From: Admin MPCZ Date: Sat, 25 Apr 2026 14:01:04 +0200 Subject: [PATCH] feat(qql): overlaps POS-INF/PEA/TRA - exclusions vpexpat/bt/ar + vpsimaapi, POS-PEA vpsim->vpsimas (Diagnostic Khalid #22) --- docs/SANEF_Qualys_Tags_V3_RuleTypes_v2.xlsx | Bin 10698 -> 10823 bytes docs/exceptions_v3.md | 1 + gen_xlsx.py | 8 ++++---- .../Diagnostic_overlaps_requetes_Qualys.xlsx | Bin 0 -> 10613 bytes inputs/dom_inf_rule_v2.txt | 2 +- inputs/pos-inf-v3-ready.txt | 1 + 6 files changed, 7 insertions(+), 5 deletions(-) create mode 100644 inputs/Diagnostic_overlaps_requetes_Qualys.xlsx create mode 100644 inputs/pos-inf-v3-ready.txt diff --git a/docs/SANEF_Qualys_Tags_V3_RuleTypes_v2.xlsx b/docs/SANEF_Qualys_Tags_V3_RuleTypes_v2.xlsx index 6e32291544357fbc7b9acca4088f0c9f400d8d97..d62aa9125892df17e8588e0ef57ee6d5d12f6ded 100644 GIT binary patch delta 4273 zcmZXYcQo8f8^_nOqO49V(R+&);fh!_dW2v_LPCh%y97V1MFg>y=ygSlzR^XA7B#x) z1RE`C^pZF3IrrT6J@5Q8=Q}gcch1c7oHOS$JqBHdP(5uzB6<)AL;})tLPJ|g^_-GT z$G6gJx6$M5fNq;OH2fK4Wv>2y7o~n8`G_tDrvz#HO|8b8IVafmg4yYjcO`To*A`%B ziC;5$YwnP-(!%qpCD0xIGPMIX*-K&R5jmhQr=hwl?mEX6ek9$3%$aK>`fF5PstZO{ z#NoM7ToAhQ2y%4yxNSC_5ZPLY%*)oUucQ6qSOPguU{z4XY`kSzN+Kh?6m`QqgoZD% zncVjJchd_xIiDc2IF)McqV2Ov7yL}E3Wdvqw_^MCsDtGAiN7v;5QDPc!_4@brKzSb zVlx7To0T@orC}TCX!8)P1Cq>djzt? zv{yG0?yV|!L;(V&s)0Z-5XM}90gw>&b#kmSjrN$jL;KrU%I}tsCR;lU9BMkv1UJ~? z4OUJ$?Dx#$E?1ViT`fGR>keF$II3tg#-+cN8KK3EZ)wfVmm-9dseGD_d0m*uyDz2= zmb*Spi$is9YKyu|ru1+tn6u5)?RKPu?HCn{Fp;RGhuZyoeDJvBMTy|iApj51ur=6S zL$aepkG>gFGnGsj-u;!dF&{94JCY7%dNvytX&!J&J;;!X+i?(Q*y*3rayw4(i#ubZ z*~BkBoq)5B-H7D0bL*c>pQ+=s7a*Vi{k|zG{q3vUW8C=47X_+%$88>1I zea%=Q%%@CdSiO6}LY!R41eo_}cH?insP(B-XYp3ymPtGD$uyD9%8RS{WtQw8*YL4~ zB03Qbz3}RU%0KcDyU^aoU90GIEw(7IfgadEo$jBhjW_L@2A8ULF}3a93Pap)8|;In ze1+Y)6Ncy<)M5)bEsnb;pT&9cOX=80wP2j%z8TNBR_)@6`vU?8Hh`?QH(2c4^PVw# zF*Q+P*|??;2ek(BO5>@wI-mA64l+_DN%Vp7I_)4f&4D_`SvqDM?^;9Pa_knFRh$@& z7dwwNKh89wDkN;?Nk6;QmvMD%=1PWNgYbTOKgyx1!c4wTw3^&SYQFSj_2-bAVvl?` z}qXp63j8ZS&P%pJfIYUE(YOY^|N--%rNFYt=qQZw-OYQCM~1k z`C^ri>&#cz3u+~^1#>j`ck$@X!sjv_BQ37iD8RuzZvH02H5pJ zvfGdTgtq`8CW>LG+h)3WF^OiAqPcTM&lBPg)sZDrLY3>Tm#jGZo{4djs*$pqSF7%S)UpQ3Sn;#l4nqVa2!Ohc9eS6IGj)adXTJJ2yYjYd+ zO&;KB;*cZq^W6bsTvE5RB9JPC^mjV+R_Rq1r(sCt9@~kJ4wbE0(jO&6l8o%j|Kutd z6%ve(x_`LBN|jingNWF{>T$kTcCIz|8TDG+YxGepiv5T(K?&gFThh|qe#`7BW|gbm z|L~Qw>B-2Kgl|0oR$EDd__+qF>>?9%H;_lFIh_=OtTd+KF}yK?t#2&VwITdy8|OY% zul1Q7yR@W+MP1kVlkEb51tEerU{ZrcIeq(ip*rW-i@(aP%lay!*RYpTe96TUR*sRJJNIrJ`C)m-7wY)njKNhE!azcUMSZo~WwtAb z(9IA)IIP!rEU!$Nd=sb&)GHU5(l+i^18~~Msb;G#IL`XL?!TN^H`uZIKXSvYyCGU$ zm)3ZpB^PVbTh&$;U!({4L`Z=FZc6W2hl%_aY(1ljZPG%PvNQr={Mw@ACEj~r5v}pU zMz?D#(V4zTL8S1Fmiz5yp`UN?`gdFXDKjOhoS>UxzasNR*EvM%X$zn;pj@3d*pg1pH`yEFeN>qhv{~T6t$Doeewjw7Hxjr0XuM5B4L<}UPU{QYH>ReXEw9FB&Wv3au&Ih^N4sdf<47s|CJpT9NG z(1XQAOu0ywkS8!@zb?LDbD8s}W4qT9JwC{lRhw5<-l!zwKkA`uI=F~pH1M; z%iT%?=wG8|l0^wR`yYBp3X^~9O1Mh|AF%Vaeed_Co&=#II{K`-@&2}>Xj=chz0hSm zm@T2+uv9>rvAZ7@mrHi(g8eLm?Xw)C-T zI;F%LJKZJ>Dw~=RSrA&%fFO+~p~o@HWFx`=zHDK4-ujhA5gRml&}uFnF}h9>m(%Kn z>dP}ba3f_xD-_2L6&Q2c;AH(-Kk)sKPY}x1%?^rx9-^A@FlYG0b6T!$cjjaAbW-?^ zRX9bV`3Hf_OwWMVI=L{3EZx9em>y%Y6)gw13AC3^|NbC-W@tsVqS~^Mds9@REUOmq z&abj1j1x@7&9#|~@-U&@V=>57cW*o&Z11OtV=5-fA$?T~1|-2ZKD2ZSl~<4%QTo0; zX>QN>?GoGX4ZPx1UWQ3fODX$Pa}rbbQW==5M(7B)qiDFgB4PH!k@TBKT~a8NeeSzpeQZbz(4BaihlVTD|HYu!dqxDB=b~K_osf! zK>4i#tj$ld`1PkR{r2@!z@(`iUJSV{Mle*Nfnodz$)lCe53?G+i#B|BKyVt5zA(>O z9P>j#$094^jtTwU!_h$vfyW_Qj!N?xB3$75p6q!B5;q($+TTDmEIs%Um0|fRU4uAM zlcClySnEFH?ka+4_>RfKZ;v^H@8&wQ{ypE_-Sy?!GrZ0KEM>fe!`IG_a{YLTdN=(n z;~$DH@EZnNp96_KzN=fk0=s66;qC&T5W=U5sHz8e5v_@k`G!9C%E%KRDgz8w)Shx&NJasnvV=YkM{?_rjU? zULj8c?2;!E=KBW@sAYQ-6$C;@)%L=7-C5l|(!EtINlTyNjr8{I&>yx;ynKV3NmAVG zsTQFrRZ}GL=K5KNKgL`DrjJoXc=YcRHg0i8hbeZz_}ac~tw?dyXzDfLmCl7y?W8T+ z`5`bBEs3!2M6>TNqsd>n8sb*b#-f8Shj%7$4&qz!HW<2UZZhZkE^X&}S+S!9i!;ru>lZ~i{P*KF1NX3WocG_d7hckC75=2; zql(d6ZC*8-9Qo9bJBD}QE4t21fYCOg>787_Q$_MaqN4+&l;aH-hpmAm75GRj)Iv!Z zEZ*1YnmmQy`1ZKWa>Ub}5WZv<-LqM$ws-vtewukQb(-11CGE3s4RStUU6psrwmzvY zV=a#u@ir!M{%aZ|#l-l)wr4@6Q(e~cj@H*^-h`zla`tTzs?4<`V%h9G3OW@#DkSSX z-77b-lypS|GtIjfuKV{cn7Kum;lY+_TI0!Qw<0~AVbnC#QnEb2Y5QzL=8&D8I zI%YwD`S0BYSO~%}OoD7zLROFk%*l&s;bEctUn@-TpBXwnOr{_&vCW?|gFycQ52ojV delta 4186 zcmZWt2T&7Aw+^BAUJOl2=p~_d=`A!V(vgHJ5Kt5WDWUfg2qK{ekRnZ_cj=(?F5nd@ zqM#H}s=$N$&%N(|^LA(F%(v(4*|TTQ?98`A=I_iXOknr~3;+Ot1kejeqv)aS1z_#m z+U;X@ujhn;001p!lAi%JmOkOp2cd|)?{bnq{78d}Z|tR086}ah*LPR1M(M;WM^E06 zbFg)eL=*Ai)bvDwO1KUCODfU=v$(8bL>H_5Uj6K&_ePp`fzBc7Wxn#@KeI|v8w`dM zPom0y#VT-hPnuU zV|(O>UxAv3U0%xc!oHeCG$? zZTKt%Au$8?&Gx)Pp)HG0Z(B#=s#AKaf*QEp!Lpkn<6 zk$fs0titqWq5}XvB$(mJ(-ZLO1~14`B;B0duXgyK_52EXWl5`z3k`< zrTuuv_s7H`=fTrnf-wyP>~7S)d)ei<72+QM-<#7Rs7VuL1c$ArK0)*yQdWrxv-CpF zJH9w##k_<^SI>k)(y2Iz9vg#MQAB?+?`rQH6T1=jyTCv}Q%V6R!$0vFpLb}jj{L$X zIU|wo9dRxUUcRnhdt%N%+&{~@6BiO=MyVm`=6=~bIoIH``NOtbX!7@0DL1)`Xxz*s zq~USQkvN4iy9U48*OF9~pnKmUIi})51Nb9|xy?P%rDCR@FIV=1TWiBMHBrD_-_=Bw zmFYP}VW8S}W#cfG$h8zs6C}d4@oUjBrSe%R^w@k;8@yf<^BY2lNmc~u;fN+&XE{%t1*AV zZAvH3hX-9&prBo?(yE0PRN?n-5p;d!LLcOB-*!B1%ezY-8D?F9A_BUWlF>lO7u8nD zk3X)erT>_zO(CoYDl;{Kt|r{&M0NTeFiHiVzVDetA2j*7yDxQ)mqg=ws>~yaB+Uq= zvIs|k0cUh?@PNkhxRvFeHQ9Z~dj~d36v{QT-E7o9e3csB??3#=iLe?zQBV+RFjidm z=Io2G#u1TUZ)}BvkPp|r#wAu9Dt?iL&E;HWi#fpOj9M)eUGA|f-iKDY2HWRZ1ogT4 zhZ&u^MuRG|u|igJBC9;kNbb)P$*2Ac)aDT2`WLh+k!l(_#3VV2A>!?wiZ@c3=0>9m zp>+qR;ieBAAr8$e0rtg%2W87=A2-?R9R>qR>m7=rEGZ}>=nhueqsq|hV6`mduug4^I*BagP@LTPTT?W-}x8M-P9%kEfLSWD|! z4KB`PH_q)Dn$%}YdyINqJG)mOW>3ddQ^0#gyI1wh-%wTJoc0in%z(!`rcbdn)>;pJ z&JXW&LeY`D(LoRCbi;qz&xDZb1$c$2*Rqjy`U(WM_7|d|OO!vdy`(&nkQC&u&p{$t zSRqH8b0MJ3xm{EPn1G^ z$=}rh#gTQ#WCI6;O`SVcO^flSB|k%=Ix`-f_WhnfvCm9Rygll;&!uB-5>5lP`6Vp+ z;Wj1XlqlVRheo7#c*kPPv5Y>FufM zwDyfR&FjXtzB?OoucuhB8ev`QcFfR zNmv%?J#nLlE9ooxKp5dp@jEK`{4WafXhBsb0X>t#@``m)h$+qhnd4bW#zP})lH{D* z)MTK{mK;;fk&wnbR{?8z<=8LsnQ63JOB(@B17mnd%7fsC`(=+c7B9X{wA18>r{}eQ zc;q67Rs2n1q=zRIEv3e^Y)*;N9gf(cRJFn>c;}F}kwq0l+jJ-7kx0KkUJ$RmBE~7Y zmkKmpZ7L3>FTkVZyTE(7vmTJ%m3Udy$TWHWefofa2*$ePfm+#o~pAaPIwuJ_8{1mZ{~G=G9aWevVz%y6`vQj zbkMS-IrS6pw6V}KFuGZW)5>cbK#CG+z@@qf39u0TBD2+0^<)dgZ za;*+c$N$VB`e{&nTnXdWT0%M%r1}=Vdk3vFdMzw3b)9lYANe9^ezIG{%MLQGo$ceQ z?zaBNiZXTP%=Jer=KLJFvW8jXq^}&ezkNq+(A@} zWdv)aIS7akO_vur*4c4m_VjP7*Nb&%C6&LnMdmbHStPaOtwXuj8yZ>X*YlNk3%C09 zGqw@^mCaQ!-WBzx5oQ`*$5v1I@6e(yY5TYQnh~5(Mx{(?UqSic@$-V}uERhF9%fW= z9U0B|CZXMZV^j@xZmHp!VdZFlQK^~)@kXO4c$7hNA=%-B z61pO(2a=%yq2=0VOk&ej593O#eQUTSMb2t;#w(OHr&*7+4S!`=$D4lK;iy&7H06f3 zH&jJ3v?QzvJWj~=1>pq-6Vx9k1bxr+u}WSsO%0D9Y_^n^aHy(iBhQR9-j$&96^{!o zCbFJxc54mQwIuu%1mxmF2`wQo%=0p{4bk~d?ZLX^$$E?}=HdF%Vt$GA^q4reF6^B0~PM*QNpZLuRz9f{-Bb@Il=)J}4KaimK=1qBJORDWxF5iUe08Ju6 zI72FqQDK8o;fL0c4&PACPr8!R+J`@4dl~R%J zx~$g4S+9R%l>gM}>3`zq>NmGX+b}z1eFpXE<+RP?8g;;-@=$E|)0*b$+N33-RKgnm zEN`7JrXmmpHcyA%OnAILY2BLTce_`sT^b>#l=&VI1A0_5NL7b?@7?RSdbbB$$BJIF z4+ZDZpGS>4UJ%sJr3Z!W|JcFBewz^0lu`^RK7+N?9^q#xDX8JDY<=SMIlT%77H-L; zUUU>3>nK;DUQtd6$?_h$4m3U0>#I3v`m&qby1|n?%)->bP0;5>`Jxipom71&A!Eqj zyej$ET>0pp2k%~(S66jfXJ>WY(Y#=if6&RtEhBSWa%p1g4%XYl@%PN#gY(wIqR&f9 z=h0-pBf$&iRdRB5Lz%1D$r!ODUFUGcb2>u!8HVDRUyVRbxzkQ^TLK4qd*MQ(xh%fz z4|&?%|MR-c{)^bw+cL!x0DA%T8=zSH8;RslxWSkT?yVb`&V$9ffui938_3CL{x|gF zS0eqF4`bT+WjJpT)-IQah6n)273_~R#mUM`RS|5A*qARFFojJ+V}?;x%LDJD~p=1McqP0TWiT6NUy$Nv)ukXCFcXXs=VN3tfe~J(0stVt?(eR@3%2=g G(Ek8w9gqS5 diff --git a/docs/exceptions_v3.md b/docs/exceptions_v3.md index 113b7e2..9ca132e 100644 --- a/docs/exceptions_v3.md +++ b/docs/exceptions_v3.md @@ -35,6 +35,7 @@ Suivi des cas où la règle V3 produit un résultat incorrect (faux positif/nég | 19 | 2026-04-24 | `POS-DMZ` vs `TAG-SED`/`TAG-SEI` | 7 assets en désaccord audit DMZ | 3 en POS-DMZ sans SED/SEI + 4 avec SED/SEI hors POS-DMZ | Tags STAT manuels non synchronisés à la création/modif d'assets DMZ | **Trou audit sécurité** : assets DMZ non classifiés en exposition directe/indirecte → mauvaise priorisation patch/scan | Rectification finale 2026-04-25 : 3 ajouts à SED/SEI (`vppintaweb1` SED, `vppintaweb2` SED, `vrameased1` SEI) + 1 retrait `vpdecasas4` (n'aurait pas dû être en SEI) + 3 confirmés légitimement hors DMZ (LAN exposé via NAT : `vpdsiawsus1` SED, `vppeaabst3` SEI, `vpvpnaems1` SED Ubuntu). Total cohérent : POS-DMZ=48, SED+SEI=48 | 🟢 | 2026-04-25 | | 20 | 2026-04-25 | `POS-INF` trop restrictif | 5 assets seulement | API Qualys live confirme 5 (vpbipamod1, vpsimasvp1, vraptbjup1, vraiiavid1/2) | **La rule active dans la console Qualys = `C:\Claude\sanef\inputs\pos-inf.txt`** (seulement 6 préfixes : vpsimas*, vpppear*, vpppeas*, vpbipa*, vraiia*, vraptb*) au lieu de la rule v3 cible **`C:\Claude\sanef\QL\inputs\dom_inf_rule_v2.txt`** (91 préfixes). Le brouillon initial des exclusions a été appliqué à la place de la vraie rule. | **Périmètre Infrastructure totalement faux** : 5 assets au lieu d'~80-100 attendus. DSI sous-estime largement la surface d'attaque infra. | Console Qualys : éditer POS-INF → coller la QQL complète de `dom_inf_rule_v2.txt` (91 préfixes + exclusions Gestion) → Re-evaluate. Vérifier aussi le rule_type (`Asset Inventory` = Asset Search). | 🔴 | À fixer (QQL console) | | 21 | 2026-04-25 | Asset doublon Qualys | `vpameatra1.sanef.groupe` (2 entrées Qualys avec même hostname) | Le zombie : IP `10.43.192.17`, last updated **Feb 24, 2023** (≈3 ans sans contact), Asset ID `155999641`. Le vivant a une autre IP et check-in régulier. | Asset jamais nettoyé après changement IP/réinstallation/migration → reste en doublon dans Qualys. Aucune purge auto. | **Risque de double-comptage dans toutes les rules** matchant `vpameatra1` (POS-TRA, ENV-PRD, OS-LIN-SRV, etc.) → KPI gonflés artificiellement, et stats vuln peuvent être fausses (le zombie a des vulns figées 2023). | Exclure le zombie via IP dans les rules concernées : `and not asset.interface:(address:10.43.192.17)`. **Note** : `asset.hostID:X`, `asset.id:X` et `asset.lastUpdated:[date..now]` ne marchent PAS en Tag rule (uniquement en Asset Search interactive). À long terme, demander purge à Qualys ou retirer le Cloud Agent zombie. | 🟡 | Workaround par IP (à appliquer sur toutes les rules touchées) | +| 22 | 2026-04-25 | Overlaps `POS-INF` ↔ `POS-PEA`/`POS-TRA` | 8 serveurs en double-tag : vpexpatex1/vpexpbtex1/vpexparep1 (POS-INF + POS-TRA), vpsimaexp1/vpsimaexp2 (POS-INF + POS-PEA), vpsimaxsr1 (POS-DMZ + POS-INF + POS-PEA), vpsimaapi1/2 (POS-INF + POS-PEA, obsolètes) | Diagnostic Khalid (`Diagnostic_overlaps_requetes_Qualys.xlsx`) : POS-INF inclut `vpexp*` sans exclure les sous-préfixes Trafic (vpexpat/bt/ar = TransExc + eReport) ; POS-PEA inclut `vpsim*` au lieu de `vpsimas*` (seul vrai Péage) | Pattern récurrent : préfixes courts (4-5 char) capturent trop large, sans discrimination 7-char fine. **8 serveurs mal classés → KPI POS-* faussés, mauvaise priorisation patch/audit** | **POS-INF** : ajouter exclusions `vpsimaapi*`, `vpexpat*`, `vpexpbt*`, `vpexpar*` (déjà appliqué dans `dom_inf_rule_v2.txt` et `gen_xlsx.py`). **POS-PEA** : remplacer `vpsim*` → `vpsimas*` (déjà appliqué dans `gen_xlsx.py`). **POS-DMZ** : retirer le doublon `not asset.interface:(address:10.43.192.17)` (cosmétique). À appliquer dans la console Qualys + Re-evaluate. Résultat attendu : POS-INF 437→432, overlaps INF+PEA 5→0, INF+TRA 3→0. | 🟡 | gen_xlsx fait, console Qualys à appliquer | --- diff --git a/gen_xlsx.py b/gen_xlsx.py index ae42036..d353dce 100644 --- a/gen_xlsx.py +++ b/gen_xlsx.py @@ -58,11 +58,11 @@ dyn_tags = [ "Flux Libre - Free Flow (BOT/BOO/BOC), AFL, Supervision, BOOST peage, restreint Serveurs", '(asset.name:vpbot* or asset.name:vrbot* or asset.name:vibot* or asset.name:vvbot* or asset.name:vdbot* or asset.name:vpboo* or asset.name:vrboo* or asset.name:viboo* or asset.name:vvboo* or asset.name:vdboo* or asset.name:spboo* or asset.name:siboo* or asset.name:svboo* or asset.name:vpboc* or asset.name:vrboc* or asset.name:viboc* or asset.name:vvboc* or asset.name:vdboc* or asset.name:spboc* or asset.name:siboc* or asset.name:vpafl* or asset.name:vrafl* or asset.name:viafl* or asset.name:vvafl* or asset.name:vdafl* or asset.name:vpsupa* or asset.name:vrsupa* or asset.name:visupa* or asset.name:vvsupa* or asset.name:vpsupb* or asset.name:vrsupb* or asset.name:vppeaab* or asset.name:vrpeaab* or asset.name:vipeaab* or asset.name:vvpeaab* or asset.name:vrpeaak* or asset.name:vppeab* or asset.name:vrpeab* or asset.name:vipeab* or asset.name:vvpeab* or asset.name:vppeah* or asset.name:vrpeah* or asset.name:vipeah* or asset.name:vvpeah* or asset.name:vpnit*) and operatingSystem.category2:"Server"'), ("POS-INF", "#3F51B5", "DYN", "Asset Inventory", - "Infrastructure DSI - 91 prefixes (DNS/AD/Sauvegarde/SCCM/Logs/etc.) avec exclusions Gestion (aiiat/dsiat) + restreint Serveurs", - "Voir fichier C:\\Claude\\sanef\\QL\\inputs\\dom_inf_rule_v2.txt (91 prefixes + exclusions). Forme : (BIG_OR) and not (asset.name:vpaiiat* or asset.name:vraiiat* or asset.name:vrdsiat*) and operatingSystem.category2:\"Server\""), + "Infrastructure DSI - 91 prefixes (DNS/AD/Sauvegarde/SCCM/Logs/etc.) avec 16 exclusions (Gestion + Trafic vpexpat/bt/ar + obsoletes vpsimaapi) + restreint Serveurs", + "Voir fichier C:\\Claude\\sanef\\QL\\inputs\\dom_inf_rule_v2.txt (91 prefixes + 16 exclusions). Forme : (BIG_OR) and operatingSystem.category2:\"Server\" and not (vpaiiat*/vrdsiat*/vpgesb*/vpechat*/vrechat*/vdechat*/vpsimas*/vpsimaapi*/vpppear*/vpppeas*/vpbipa*/vraiia*/vraptb*/vpexpat*/vpexpbt*/vpexpar*)"), ("POS-PEA", "#673AB7", "DYN", "Asset Inventory", - "Peage - sites geographiques (ls-*), OSAP, SVP sanef, ADV, RPA, RPN, restreint Serveurs", - '(asset.name:ls-* or asset.name:lrpea* or asset.name:vdosa* or asset.name:viosa* or asset.name:vposa* or asset.name:vrosa* or asset.name:vpadv* or asset.name:vradv* or asset.name:vpsvp* or asset.name:vrsvp* or asset.name:vprpa* or asset.name:vrrpa* or asset.name:vprpn* or asset.name:vrrpn* or asset.name:vprps* or asset.name:vrrps* or asset.name:vpppe* or asset.name:vppeaaa* or asset.name:vppeaae* or asset.name:vppeaar* or asset.name:vpsimas* or asset.name:vraiia* or asset.name:vrboe* or asset.name:vrffb* or asset.name:vrgrs* or asset.name:vrpeaar*) and operatingSystem.category2:"Server"'), + "Peage - sites geographiques (ls-*), OSAP, SVP, ADV, RPA, RPN, BoE, FFB, GRS, BIP, ALB, BO + restreint Serveurs (vpsimas* uniquement, pas vpsim*)", + '(asset.name:ls-* or asset.name:lrpea* or asset.name:vdosa* or asset.name:viosa* or asset.name:vpadv* or asset.name:vpalb* or asset.name:vpbipa* or asset.name:vpboe* or asset.name:vposa* or asset.name:vppbo* or asset.name:vppeaaa* or asset.name:vppeaae* or asset.name:vppeaar* or asset.name:vpppear* or asset.name:vpppeas* or asset.name:vprpa* or asset.name:vprpn* or asset.name:vprps* or asset.name:vpsimas* or asset.name:vradv* or asset.name:vraiia* or asset.name:vrboe* or asset.name:vrffb* or asset.name:vrgrs* or asset.name:vrosa* or asset.name:vrpeaar* or asset.name:vrrpa* or asset.name:vrrpn* or asset.name:vrrps* or asset.name:vrsvp*) and operatingSystem.category2:"Server"'), ("POS-TRA", "#E91E63", "DYN", "Asset Inventory", "Trafic - AME/Sextan/Octan, Aquarius, Isis, RAU/ASUR, GDEPA, SIG, GMO + legacy vmam*, restreint Serveurs", '(asset.name:vpame* or asset.name:vrame* or asset.name:viame* or asset.name:vvame* or asset.name:vdame* or asset.name:vmame* or asset.name:vmamp* or asset.name:vmamr* or asset.name:vmamd* or asset.name:vpdai* or asset.name:vrdai* or asset.name:vidai* or asset.name:vppat* or asset.name:vrpat* or asset.name:vipat* or asset.name:vprau* or asset.name:vrrau* or asset.name:vpdep* or asset.name:vrdep* or asset.name:vpsig* or asset.name:vrsig* or asset.name:visig* or asset.name:vpair* or asset.name:vrair* or asset.name:vpexpa* or asset.name:vpexpb* or asset.name:vpgmo* or asset.name:vrgmo*) and not (asset.name:vpexpaxfb* or asset.name:vpexpbdech*) and operatingSystem.category2:"Server"'), diff --git a/inputs/Diagnostic_overlaps_requetes_Qualys.xlsx b/inputs/Diagnostic_overlaps_requetes_Qualys.xlsx new file mode 100644 index 0000000000000000000000000000000000000000..b13fcecb36a9f5d2f81786d95fcc5d0d1228919e GIT binary patch literal 10613 zcmZ{K1ymeMxAovIgS)%CySw|~Fu~nJ@WCxO!CgXd3GNcyAvi%o@Bj%K;3xO4_wKv- zzi(!B_v$sh_f%C^?{oUp)=-9l#Q^{ShyaMuJ7c*KRfV*dv&okY^JTMkvC?pNarI!g zaCK$#b#hdlRz>OOK!xA#(enQIE{3cGT}Ct}uXCEsE4+o#337ja3M=mH=l6-Yh%K6m zt|e3Uf^E-CXx|C0YkS5*0jscHQJw18VIteo7!E0KvSZrm%3}(3JSnY9K?YysJF2AhddJx+2 zHU8BFgDZsC^OvSGLjwT7|JwyC7kBXQK1?R}sSR+TMwr3vZwgJCV`*lfL}4o^s6e~L zlDNd$t}<}i-&{9=k0IMo0>e*Nca3{Q#lvi~9!FHP*QvD;Gfjq8>rpTs3jjh497nbh z8DTyj6Xf&}n^oziTZPu%VQQ$X0WVrRR01xFI~fWDfZ@<(8T=8cNXX&M92&7 z5$``pWZGGZpsS+c_rh8!Q3m0EVjXO|r}sV!7NCth$IaMPM2O7jX`dKGIf_minFvru;PLoyJvqfN84j-muO%O1<iEdMxvkGd1C-<-EU*3Ei(IN=+H7P87!U{;#l{*~4~<1s_Qe@r zGTsIeu~RP{HLY#vLF^n03FNKK158MjL*folE7|jcI5Tv{&4Imkwj`Lwwtm3 ze7#zeRQ5hzTYdf}VCy*BHU~K#q(1N9voW6#JzPEGi`IRi9yw4GJzO>8d2B~V|5)Qt za)@UuCAWM08Vk31Ut*pDVBqS#G%*L0ZpwJ?l}fZi+OZ*N{N3P8FdFzYJOsOBH%FMx zBj=v`77iW2KRBzR@upU?C1$%ndCvIl(lleU1`%S`r;wlWp_D`GwU0kDIz~&lU*`r0 zO*y0n*;PT6pLS$Vr~LBxwwGU?vaBjK<=V-Dbn!q9vWTR27RGiLBC(NrGktxXR7%S= zeSU|0tR`YZu9seCGCjSQ7w1mhv2kq>aIG%yOuby$+eo#XDn}!m|B1DI4=B*Ah{lC2 zj+h&fX|F*7U4q1!UKnxPH2eX$jUDi@8}ZXteAG>qOO~j9p@HHms4=7SDTLmZ2rzwBC#A91&7%tjSaqc*%$i8ak{>!9Z07>?h{Z z)u)_!iSMcGH1|qLiFS?D<(_nt-?)kTCV5RQC7}b8 zP5EE0or--6>>-N~P|7+jax;K^%rhNO?E4lv{_3$cFk+G0ktN|qegR);4}-2;{E&+W zp*YJBsSBcKpZ`9RN34R33mNXBjZAF+wJ$P%`f#U4O{hQA^Xw{rf7NYhuV4^cz;x+( z+YiygxsUwR0XBW}v7k*kXVBn74d?1I4;zD(zWd~-5uMr;#?ONJy(f>hVtE&*_bW7z z+AKp>YP`3~A&rtWt-oT&zB3IXeX|D9B8}_JgZX2y@}!8J54C?Pr7iE*wlTDdfc6e+ z3q8eHrtd_|4w@!WxTQb3D<8F_b~n=rDE+9Pa8)B4M-{daNhWRaDIn#2xHj?Lqb}vp z&X8^;lIn(WYR_F463EL;YD1padh0T9cR1urv?I6z+ZK?i?{x5acJ|?*PqVK0TqK=z zBkPhnNraep?3EHv*MtxK#weU3swd}=kC`LH#O~6EbkT! zXs)&n!OGWQPMfmJEml+{7EqKS){d&l>Ec0lPR(m7@B0j&KJ&{**HL+lec=PMA12Z@ zf!7nGT)&?t;YVU zai^-q1cPK*!Xng6=V-BTV(L)gDDmBQ&(Blred3nySwfs3I$YL^_+!%1eWKj%(w}u` zuWDB5P{P-CbS689y6Mc72VOhpveG}VnJ$Pn;fu;$6~EgiYmD^Be%;zH`{CJOiR_MR zOVD*qXcNZtD>jRCNnl?azOk;Z;slzhHwa)WTN+TamI^MBIz99|Yr(T_hJJ_Qls0 z&}^^Kcu11qOgZ1R@D=Z=A&aa(ouk$D4<>v$jqQQ@cK|7gA~!~c1ps={0RV!(1Bj1{ zyMu=<80_i6{@3BJC{mqa;<3Yr6LEgU%riBSUecKPnPB3QQyNh?JJ!=qVa>q;)^;hq zGa2=yr&i37f?};HB^K6D?BI6sL7|1`v*vY}3nrF%{vZS+Hy-m4e|divp7t%jT})JG zV-ZV;lxairxOT+07CmkKakCLAe@Lc4amZPA{cP|ns$tkkf^EZOiR)wFkSD(qB6Q;!v{o+O#A>qwm5W)+17GBkO4T#<4paVS99w zw-1n>45dD@6z0-5P180jV}*)HCa&{JFL#SdLdnC(`2-)@?oVqT^l?TrY5}ui&{MlI zEAF`QRW^qj3J63kTIo_zNEFuu3qXUGneM?+<_cHWl5{ALkAQIa zQJvf}l4w*->eW%9&%xg;Cy8X1(*$}olzNk(xyd}TE~XDhvG%s(`*0JSJ>hX~YMfbO z;H_^8D5Vke&!`zOyNXh|+~}EsNds*7qG)2MX60mN2hjOJ5w+T3?5at)W(Q2?#ICVL zyCnxcd~wTZLgqR#z2moj&PQKOVvw0u*BfxytsFh$(w!M|P1#R=_CcH{-dJ41=tx$8 z)GPcYD+1&yK&nxaan+Fa=g7CXGhS)P<;?{*!8-Vz)|Tx~1nuN8lpjVgP0bOfI3TS0fY_;K}>td$)RpHP>Q`iNmFaE4=C+F3N#q!d@(tCA20niD#`hx7(uo7fgC zv)(yV+Aw`QV$Yw=)jm-NV4Ngict&2aB}B9Mxh#7rC z_>1Jdn_u8u&p9=v09oBl#?LC1wPcytVRBDQh8I+B-m+J`z3L;u+XG^A;!>Q~GT;t{ zzwZ4qBXs{qdcIbZe02c>0L;B)pZ`TaxPE7$&6y@HYrpm5h8Yo;U=FW}W#v--7gUL2 z+0uW#^o7uwa=auZYB!SaXM%^)m&3chfSP3d z(GMJ9pybE2nmg|!G|{FAv>L7_1@E3PHHPFs&e6>KMDL%U3(gB$EpzsaSg1bD7m4k3 zu?8`9cw5UUHxq``AFs-2(Q6S-eZGh~PD2wvA-OS=TwIyr+d{$8VX z;+Lz)V$g=-=9#`0InvpBcOgH+W(h|5`;bZb#y4gAUPQ@txor%dghj9Ss-EFqy<`ad zZ5G1rh0*KZ-QB%W_ys$*LJ5^gRzoI0)Mk*~HrqUusQjjQ5u3rVxev37e$G-`h#8>{6HtD3K? zZ#|>{PZGBUoq&jnBg=z^Ar-kio}!Vl_rvfuc^9hXm6LRULf0Y64zj+RZs$iJx)CP& zDvKh35!KsqxL1X=vaQ15V)O&Jf^V5kk}USrR>2=>e_aWY^I zH;p~%O&TD$tZm)+>f{CPpP*IX^smh>_m=1e*c6pZW%ZooUXiNLD!y>1FAQTju)OYD>M(j|p%{%5;<8}G zx*W(lBLAgH@-W2fXo~I!=~QLx)HgWLS}2#C*E7U%UrV>x63u>A{Lm3afj_N|jI|1= zggY?ULL38K@j-q}3I9WZcUAp1e7Nb4wVex-x5HSh2KjIE3>f-I?RfIGKn*~wcl!#o zhI-L7oqV@GaF(>UYI#uZbyH9`)Go3W3ERYB|IWO zKWgnRC)P!MRfQnWi!|6426~{eS#&J7?wMB(VMuaNR)KRzp>6lhsHM?0O8><0V{9N& zG2jS0NKJ-~{_A8(e9=j32auyWqzguy%va*v#~xz?OgQi8vX|6`A8pPqSb@`Cd6^f`8Kzm zSU6!L@K^a)f>22wGT3O8b{T#fk_n-ioB)g0fNNB9j>-k~%nQ-VLL`AL=S?6cS86m`2(= z%e0saf_<5Iv-rJilFeP67;S8G@N~6xXsWYqX6|TQM^Q8E^-9YW=SvyzNxZtp!s!xB zSw>pw`BJsNW+tY zagQ_vaC@5;y1pHSQ5p`PGQb^)V%hV3HLW)U2FrNlE^4I*+h>qD zuchL$ICko8bWMaPSw@&arb$!d5Y63zPv_Db>HR5RrLc2((3l*(toFQiH&Z1i#6Dr1 zoy;Fvzy1odu|8Eih;hG!tDNCuAT;SPzwXH);cK{G9fi%l6P-^S7KWe;@9vZzU$&Rl z#&>fQR{KzH$JODj-t(+znL1dFh0_#BUTnTj_imzw-f3$V(#&Do+phmpo~fSQJTe#; znjF4NP&u=*{HFSE(+AyE;%p_YSjy+>Z$JLHHq2Fa&5-!oGuA+Y~pT%Ou2FiX_7@Z1y zOh`Tv`ZDTNkKy#;z;~o$w@XvV#MZaYgOUXFp5>!WZkxx~)~$~h#thE>t5GD3+-Nbv zZy-%BXoz__Don@n4-b(6L*Pw8@#;E|fcRqgxHX$|$chvrx_VEv3j35$*c5VW%Hg_S zK~SK*FVk80gQYW6{=EZZv<}rrtpn7-lMf!80(o(d_x64IjCkI={8#BJ&4J%B^hXVC zwwP(SfWqt{yZKrwGUCMKfB!t9>BIhvP(Ig<9qBE3%F15$``co ziM=aceKS$#{UHCdu+w4X@%n4v`O!VhJ|x0pz2EO*WHMvA3TAvW3Y>$h%SLuycO+6g zfUQTwjC&y04gTN&ms$iE|FLj1u|{%d@HwExlm*SFHOosJX1e;O8k{k1KyZF$Y^_^I zLh_}o6_7}2p8q87jgH&Vik&BD(8b->*4@+j5OZ{np=J=8T{j#J*=IOsJvQCv-d>Uf zc0j|j2?`OB=bpe@a8R$$$NC{bk%FydyVfZZ*(LyR#1 z7BETAAd-cmOJP>TGjOw73k4vhSNNN2zOxp2Yshqk`H3Yh0GWk}x8C3GmZ!Y8*Bh30 zsD=v}6}^UM{x$@VMlGRwqL%Z@Zs#@{Z~&Pw&@Q0nqk8!fX&F}GPJ7S;88tBsx$eC) zWSfQhvo@I=A{~AqeUckuy8!F~5)jqH7gcf;8@hxfnGhHngKbd^>n0~iPm){?ITb>h z!<3{jwy~5_m(EQ}Qij%%VIUe)X{6|cU2ro{V{j2HOjbo?H1ZzF)Tyv3mrIZfko5_Oq&4mQzBhK4Qdr+Q~6Yj-*HHN&H@G^)tXtB6TI^M$Vn#$ zK3|#Anwxn=NyTiISms8+jjfL%YziX%w^@ZrFB)<%1YbrTr!ME z`$OEuQZdcukUlqq=viJpKDOhsYe(M(*Ugg%2$#p^bN-{b(SjfpjxU&$Tg})3pAKnqa~De5(EDiYx6-}rRbVzJV{{B^>%p5d(p@( zKi==)%l-T0%J>@^$Fi%|wosd*kBuIzIrHk>nS-nEh0Jo_unaa{deFO)B_+_pDSL8G zdM3yWZ{D)$cc^|<>x~=PX&q021=Wd?o!rO`Y;H3gp>3XaR}zq+9GWe-;=HQHCn%Jf zTUx$}8=Y$ zV+^dpi=ntR$T8waMaIPXs(>i?ChvO?N*1OEZW4rsp3eobnj}Pzxj%}ggo*lE!@xjB z3Y$YtDzrA2AOyA$Fy*zPgn0TLwm!}doo0pvMJ>lk8d309;mEtPVoJDvbQ**GZ?_i^ zR}Asd+b=BEeJBj-Xl{_ox%FPIz243%$lC#IJj+!j#FvGfkl47GqZU-V{;o7k=glkx zW@#ga3Rhv;b$H*tgVf_}PWsgFWnPx+(7H|Si7?d1@GoKk8dQ7VVH;5&;ha`r79E+T zb^}HRj=`BUGhY>gX8VjO5ShJ#?uq7&wx3r%e1CQ%?i)FN#b2X*rKxNe_-KzAj}RG# z?QLNKw8DQ+obWl8dn?U+gUQm-T$V0#7Ow8=kmD7QaRjU&8EJ{HI5<9h$;=IRof92) zl7X_N`Q9wWNb9jh{F`jO-Ye1dYX;>9;w}5s;HLWsa8muJ$B!XX@b{;zX(WR4=|fG(j?Q7l1+ zvzy~nH4;Cm!d9^yHGh@Ewo?02$^bCxmy(WWg)p56_xMa-uMB$Xy@x5^YDr~s$iL{! zSp${E+$3n%eB`0t7uK9H_Sd51F7niM&S`j?N<$mWb>>^Fxor*EzqU+2ZxGNfZN}>` zo;*!DWqDQkiFkaW2DP1WwBo12?Ro;D4fCi9D48>`VuFldDHO$yku`kE37=)ZcI;G- zSHtkingt&#P7U{q$W)g#BrHgmn+Iy|Rq0}arH5BhTqK<*JLMb0WAEE#YT^D3-_9Hr zVaO&oBbrGq~576sj1n&@VMB(`{3g&BR) zN2r4@nZ)>fs+*v|e*z1!E&4uk%1-k6?E*;cObiw#W!Q};IvplOu8)f>hv#~mEX$KH zavVv?o=j*+Pl`?_FL|OdvFznFUdOK0I-6A_jlo@Fp+i<3aeZQ!h`VBznLZb5kbAeIv{gQTMw0DO%4+DUJfBYi z#BDfz?&9{=!ujPoy+Su_yLcB1!}e+~sI|qee_;${kS9`}Xr!P0NDr04d3wqhTmetGgzVmv3lv$4~ z4vY$Z%)YeAsx!gMGYSZIs|4}xtGlXrh0T|flg92NZOqfWuex7f5vm?Lwjg!k|KQh$6`^jP^Ov&F8~CdRUi;g#pTjN4iCMEua<2;~0g+>YQr z@TXsci%fBaz9b|bgxPB*PF#kDX+RS7qoID-hIsnz!4)8T{(uYim@zNfK>eZ~Uj4Zh ziVF3?hBy`m(Gjn1J>>S$jiUUXvm2u^#%@55;|xi90;cVAez9b5oEpIA`ImXs;LSkY z7EE^_Tz8_MIqwdc3Y2ZHNVm&on9Vu$!EK& zz{`>yoi8FS4I&-6emj3yYem)c8uabX%~l6FVcm*0&dsvvi8pi<<0SA8%Rzcd`$-@a z0Py`qzA*lluHP$0mM$(1e-(ODB%RkJP-SbWCZL!`++Y@>8lsbUB;LZhB|RDxu~KnM zhnJl2@!QuX#ik`w=*U796W7Z9A_)-1GRr{NSw@?6xE76|39r)42InaoO8>ZwCQ?{h z!IH1lyJX9V=+oDNu|>Um!`Jbtcx11JO}>_XsvM3nH6~T%1cDC<`*r98ZjtXpgI^#I zKhB3~WwGp!I@iE;{>oK(_&tqai?I^pIGGXBpNkfcZ$5NM?zbTsctw1O`!n0dg(AEo z^W7Ib!=|3u2Y;*eFcY%(dWY~~(6ycYtlDelt6qG3vSNhATLZr6%Ep(^ACg)?EEck0 zV#>oh`G^@Py2^TB1}%A^EAx*I8Otj#=@tF6_ZAYo4WsS8(M#JM?`=d#r-^(qSe45b z(tnPqzcZgqG@n$D^-`UXo}#hxbr26^RGFPhEXd8rJM|l^pP(gw>Ng_kGx}jcjI9^a zg|--G7;~6@eHq<&_6>&9?2XuiWu>!pE8i*SMoR5)Z-V&RqRYRd3>0|i?Dw3kdbw3Z zf8VOVr{({>VSi20p%g*%ehy68TFW~CDoqG9kSVK)0l#j-8hAl9O_982Re+ezV5`A& zoVb5u#wnKLrm-%pY;vv`_o_~3EMeswO2Nk#r#eTT*o6o`Zihe`#q_Ys9@y~nHNuw^ z%EUfo_=3=$v7Pu^b>1JG6TqF*)9A!BG+YKG}Dya9|P zjmcL<1?|eg>+;ycxO3)jjrR*f%M*GL9opZ)rmYew<-NEBPEGRUI5O!Hr7cIsv~fdc z!>JO+bD4WI8(<_|!TDj$=mNVCojh94q!H=OO_vl_s$ut9)x4f2^x$!B{^r!e3Y)WH8m|Btil zPxzl^r+?sIUjF_+SfBnR_;a!Qe+fdU5dR|hk4xWwvi!N^^$&|B>VIVUYXR&}mOm@v z|FA^A)W}~t^JiQBs*nH4@@FCE9~J_<|H$%JS?5odKeN&QWr2D}`WMSTx#^$KKf~TX zPzTC?1;Iaoe}<8NfI3wF+w%VjDu06i6t;iB&(wc`|BKB1$@8aB{KIoY^B-kHLmBSH TZ3h6LzI-uXR8^hs_u2mgE4dE| literal 0 HcmV?d00001 diff --git a/inputs/dom_inf_rule_v2.txt b/inputs/dom_inf_rule_v2.txt index 6a160d7..46ef4ca 100644 --- a/inputs/dom_inf_rule_v2.txt +++ b/inputs/dom_inf_rule_v2.txt @@ -1 +1 @@ -(asset.name:lpges* or asset.name:lrdsi* or asset.name:nvr-s* or asset.name:rmilw* or asset.name:rsmiw* or asset.name:spbur* or asset.name:spcyb* or asset.name:specm* or asset.name:spemv* or asset.name:sppea* or asset.name:sptra* or asset.name:srcyb* or asset.name:srdsi* or asset.name:srlog* or asset.name:vburw* or asset.name:vdlab* or asset.name:vmpki* or asset.name:vmsym* or asset.name:vodsi* or asset.name:vpabn* or asset.name:vpabv* or asset.name:vpaii* or asset.name:vpaml* or asset.name:vpams* or asset.name:vpbck* or asset.name:vpbmt* or asset.name:vpbov* or asset.name:vpbur* or asset.name:vpccy* or asset.name:vpcht* or asset.name:vpcot* or asset.name:vpctv* or asset.name:vpcyb* or asset.name:vpdao* or asset.name:vpdsi* or asset.name:vpech* or asset.name:vpecm* or asset.name:vpemv* or asset.name:vpexp* or asset.name:vpflm* or asset.name:vpgaw* or asset.name:vpgeo* or asset.name:vpges* or asset.name:vpgtc* or asset.name:vphdn* or asset.name:vphrq* or asset.name:vpiad* or asset.name:vpisi* or asset.name:vplpe* or asset.name:vpmal* or asset.name:vpmet* or asset.name:vpnap* or asset.name:vpngw* or asset.name:vpoda* or asset.name:vporm* or asset.name:vppci* or asset.name:vppcm* or asset.name:vppix* or asset.name:vppmr* or asset.name:vpppe* or asset.name:vppwd* or asset.name:vpres* or asset.name:vpsaa* or asset.name:vpsam* or asset.name:vpsdt* or asset.name:vpsec* or asset.name:vpsic* or asset.name:vpsim* or asset.name:vpsro* or asset.name:vpssi* or asset.name:vpstq* or asset.name:vpthl* or asset.name:vptra* or asset.name:vptsy* or asset.name:vpvid* or asset.name:vpvpn* or asset.name:vpvsa* or asset.name:vraii* or asset.name:vrcyb* or asset.name:vrdsi* or asset.name:vrech* or asset.name:vrecm* or asset.name:vrgaw* or asset.name:vriad* or asset.name:vrlog* or asset.name:vrnms* or asset.name:vrpwd* or asset.name:vrres* or asset.name:vrsam* or asset.name:vrvid* or asset.name:vrvpn* or asset.name:vtdsi*) and not (asset.name:vpaiiat* or asset.name:vrdsiat* or asset.name:vpgesb* or asset.name:vpechat* or asset.name:vrechat* or asset.name:vdechat* or asset.name:vpsimas* or asset.name:vpppear* or asset.name:vpppeas* or asset.name:vpbipa* or asset.name:vraiia* or asset.name:vraptb*) \ No newline at end of file +(asset.name:lpges* or asset.name:lrdsi* or asset.name:nvr-s* or asset.name:rmilw* or asset.name:rsmiw* or asset.name:spbur* or asset.name:spcyb* or asset.name:specm* or asset.name:spemv* or asset.name:sppea* or asset.name:sptra* or asset.name:srcyb* or asset.name:srdsi* or asset.name:srlog* or asset.name:vburw* or asset.name:vdlab* or asset.name:vmpki* or asset.name:vmsym* or asset.name:vodsi* or asset.name:vpabn* or asset.name:vpabv* or asset.name:vpaii* or asset.name:vpaml* or asset.name:vpams* or asset.name:vpbck* or asset.name:vpbmt* or asset.name:vpbov* or asset.name:vpbur* or asset.name:vpccy* or asset.name:vpcht* or asset.name:vpcot* or asset.name:vpctv* or asset.name:vpcyb* or asset.name:vpdao* or asset.name:vpdsi* or asset.name:vpech* or asset.name:vpecm* or asset.name:vpemv* or asset.name:vpexp* or asset.name:vpflm* or asset.name:vpgaw* or asset.name:vpgeo* or asset.name:vpges* or asset.name:vpgtc* or asset.name:vphdn* or asset.name:vphrq* or asset.name:vpiad* or asset.name:vpisi* or asset.name:vplpe* or asset.name:vpmal* or asset.name:vpmet* or asset.name:vpnap* or asset.name:vpngw* or asset.name:vpoda* or asset.name:vporm* or asset.name:vppci* or asset.name:vppcm* or asset.name:vppix* or asset.name:vppmr* or asset.name:vpppe* or asset.name:vppwd* or asset.name:vpres* or asset.name:vpsaa* or asset.name:vpsam* or asset.name:vpsdt* or asset.name:vpsec* or asset.name:vpsic* or asset.name:vpsim* or asset.name:vpsro* or asset.name:vpssi* or asset.name:vpstq* or asset.name:vpthl* or asset.name:vptra* or asset.name:vptsy* or asset.name:vpvid* or asset.name:vpvpn* or asset.name:vpvsa* or asset.name:vraii* or asset.name:vrcyb* or asset.name:vrdsi* or asset.name:vrech* or asset.name:vrecm* or asset.name:vrgaw* or asset.name:vriad* or asset.name:vrlog* or asset.name:vrnms* or asset.name:vrpwd* or asset.name:vrres* or asset.name:vrsam* or asset.name:vrvid* or asset.name:vrvpn* or asset.name:vtdsi*) and operatingSystem.category2:"Server" and not (asset.name:vpaiiat* or asset.name:vrdsiat* or asset.name:vpgesb* or asset.name:vpechat* or asset.name:vrechat* or asset.name:vdechat* or asset.name:vpsimas* or asset.name:vpsimaapi* or asset.name:vpppear* or asset.name:vpppeas* or asset.name:vpbipa* or asset.name:vraiia* or asset.name:vraptb* or asset.name:vpexpat* or asset.name:vpexpbt* or asset.name:vpexpar*) diff --git a/inputs/pos-inf-v3-ready.txt b/inputs/pos-inf-v3-ready.txt new file mode 100644 index 0000000..46ef4ca --- /dev/null +++ b/inputs/pos-inf-v3-ready.txt @@ -0,0 +1 @@ +(asset.name:lpges* or asset.name:lrdsi* or asset.name:nvr-s* or asset.name:rmilw* or asset.name:rsmiw* or asset.name:spbur* or asset.name:spcyb* or asset.name:specm* or asset.name:spemv* or asset.name:sppea* or asset.name:sptra* or asset.name:srcyb* or asset.name:srdsi* or asset.name:srlog* or asset.name:vburw* or asset.name:vdlab* or asset.name:vmpki* or asset.name:vmsym* or asset.name:vodsi* or asset.name:vpabn* or asset.name:vpabv* or asset.name:vpaii* or asset.name:vpaml* or asset.name:vpams* or asset.name:vpbck* or asset.name:vpbmt* or asset.name:vpbov* or asset.name:vpbur* or asset.name:vpccy* or asset.name:vpcht* or asset.name:vpcot* or asset.name:vpctv* or asset.name:vpcyb* or asset.name:vpdao* or asset.name:vpdsi* or asset.name:vpech* or asset.name:vpecm* or asset.name:vpemv* or asset.name:vpexp* or asset.name:vpflm* or asset.name:vpgaw* or asset.name:vpgeo* or asset.name:vpges* or asset.name:vpgtc* or asset.name:vphdn* or asset.name:vphrq* or asset.name:vpiad* or asset.name:vpisi* or asset.name:vplpe* or asset.name:vpmal* or asset.name:vpmet* or asset.name:vpnap* or asset.name:vpngw* or asset.name:vpoda* or asset.name:vporm* or asset.name:vppci* or asset.name:vppcm* or asset.name:vppix* or asset.name:vppmr* or asset.name:vpppe* or asset.name:vppwd* or asset.name:vpres* or asset.name:vpsaa* or asset.name:vpsam* or asset.name:vpsdt* or asset.name:vpsec* or asset.name:vpsic* or asset.name:vpsim* or asset.name:vpsro* or asset.name:vpssi* or asset.name:vpstq* or asset.name:vpthl* or asset.name:vptra* or asset.name:vptsy* or asset.name:vpvid* or asset.name:vpvpn* or asset.name:vpvsa* or asset.name:vraii* or asset.name:vrcyb* or asset.name:vrdsi* or asset.name:vrech* or asset.name:vrecm* or asset.name:vrgaw* or asset.name:vriad* or asset.name:vrlog* or asset.name:vrnms* or asset.name:vrpwd* or asset.name:vrres* or asset.name:vrsam* or asset.name:vrvid* or asset.name:vrvpn* or asset.name:vtdsi*) and operatingSystem.category2:"Server" and not (asset.name:vpaiiat* or asset.name:vrdsiat* or asset.name:vpgesb* or asset.name:vpechat* or asset.name:vrechat* or asset.name:vdechat* or asset.name:vpsimas* or asset.name:vpsimaapi* or asset.name:vpppear* or asset.name:vpppeas* or asset.name:vpbipa* or asset.name:vraiia* or asset.name:vraptb* or asset.name:vpexpat* or asset.name:vpexpbt* or asset.name:vpexpar*)