Shadowserver Parser can't differentiate between "Accessible HTTP" and "Vulnerable HTTP"

[ghost]

See #1971 (comment) and #1971 (comment)

The two feeds Accessible HTTP Report and Vulnerable HTTP Report use the same file name scan_http. Our feed detection is solely based on the file name and detects now Vulnerable-HTTP. Fortunately, the columns are identical, but this still causes a wrong feed name to be added to the data, of the file is actually from the Accessible-HTTP feed. Shadowserver's docs say, that the tag column is always http for the Accessible HTTP feed, so the data is still differentiable maybe?

[monoidic]

Slight correction:

Our feed detection is solely based on the file name

You can match by feed name as well, and if this is done, then they are differentiated. This is only a problem if the feeds are matched by filename.