Update taxonomies to current RSIT and vice-versa

[ghost]

There are currently multiple mismatches as noted in #1350

Our taxonomies are using a space character while the enisa version uses dashes. E.g. malicious code (intelmq) vs malicious-code (enisa). A summary of our differences:

From the taxonomy expert bot code, in intelmq but in not in ENISA eCSIRT-II taxonomy

• "dropzone": "information content security", # not in ENISA eCSIRT-II taxonomy
• "leak": "information content security", # not in ENISA eCSIRT-II taxonomy
• "backdoor": "intrusions", # not in ENISA eCSIRT-II taxonomy
• "compromised": "intrusions", # not in ENISA eCSIRT-II taxonomy,
• "defacement": "intrusions", # not in ENISA eCSIRT-II taxonomy
• "unauthorized-command": "intrusions", # not in ENISA eCSIRT-II taxonomy
• "unauthorized-login": "intrusions", # not in ENISA eCSIRT-II taxonomy
• "botnet drone": "malicious code", # not in ENISA eCSIRT-II taxonomy, deprecated -> infected system
• "dga domain": "malicious code", # not in ENISA eCSIRT-II taxonomy
• "malware": "malicious code", # not in ENISA eCSIRT-II taxonomy
• "ransomware": "malicious code", # not in ENISA eCSIRT-II taxonomy
• "other": "other", # not in ENISA eCSIRT-II taxonomy
• "proxy": "other", # not in ENISA eCSIRT-II taxonomy
• "tor": "other", # not in ENISA eCSIRT-II taxonomy
• "unknown": "other", # not in ENISA eCSIRT-II taxonomy
• "vulnerable client": "vulnerable", # not in ENISA eCSIRT-II taxonomy
• "vulnerable service": "vulnerable", # not in ENISA eCSIRT-II taxonomy

Differently named types:

• "ids alert": "intrusion attempts", # ENISA eCSIRT-II taxonomy: 'ids-alert'
• "c&c": "malicious code", # ENISA eCSIRT-II taxonomy: 'c2server'
• "infected system": "malicious code", # ENISA eCSIRT-II taxonomy: 'infected-system'
• "malware configuration": "malicious code", # ENISA eCSIRT-II taxonomy: 'malware-configuration'

From an intelmq perspective we always need to care about backwards compatibility.

cc @aaronkaplan @th-certbund

https://github.com/enisaeu/Reference-Security-Incident-Taxonomy-Task-Force

[aaronkaplan]

so from what I get from #1350 the conclusion was to fix it in the next major release, right?

[ghost]

Did everything we can do here, next step Taxonomy meeting, split off #1409 for this