id: fortianalyzer-certificate

info:
  name: Fortinet FortiAnalyzer Certificate - Detect
  author: johnk3r
  severity: info
  metadata:
    verified: true
    max-request: 1
    shodan-query: ssl:"ou=fortianalyzer"
  tags: ssl,tls,fortinet,fortianalyzer,discovery

ssl:
  - address: "{{Host}}:{{Port}}"

    matchers-condition: and
    matchers:
      - type: word
        part: subject_dn
        words:
          - "emailAddress=support@fortinet.com, L=Sunnyvale, ST=California, C=US"

      - type: word
        part: subject_dn
        words:
          - "OU=FortiAnalyzer"

    extractors:
      - type: dsl
        dsl:
          - 'subject_cn'
# digest: 4a0a0047304502203e219afa9bae294a8c15b175cdd77472df6f5c09d3b7839e8be930c9ffe5d1ac022100be2b3f617380c1f7c37d2b6871d990d8c8865edae0d1cabc70bcee62b3c26d1c:922c64590222798bb761d5b6d8e72950