From 106fcd3d9c7ba15df7041fd9949f151d011b2a4c Mon Sep 17 00:00:00 2001
From: Anastassiya Torovik <anastassiya_torovik@rapid7.com>
Date: Fri, 30 Aug 2024 12:48:33 +0200
Subject: [PATCH 1/3] Update sip_banners record for Cisco Telepresence

---
 identifiers/os_family.txt  |  1 +
 identifiers/os_product.txt |  3 ++-
 xml/sip_banners.xml        | 10 +++++-----
 3 files changed, 8 insertions(+), 6 deletions(-)

diff --git a/identifiers/os_family.txt b/identifiers/os_family.txt
index 23ac2a73..a141b41b 100644
--- a/identifiers/os_family.txt
+++ b/identifiers/os_family.txt
@@ -189,6 +189,7 @@ System Storage
 T3 Termination
 TASKalfa
 TDS750 Series
+TelePresence
 Teradici
 Time Capsule
 TippingPoint
diff --git a/identifiers/os_product.txt b/identifiers/os_product.txt
index b5115a03..008565a0 100644
--- a/identifiers/os_product.txt
+++ b/identifiers/os_product.txt
@@ -69,15 +69,16 @@ Document Centre
 Dynix
 EDR G902 Firmware
 EDR-G903 Firmware
+EOS
 EdgeBlaster
 EdgeOS
 Email Appliance
 Enterprise AP
 Enterprise Linux
 Enterprise WAP
-EOS
 EqualLogic
 Excella
+Expressway
 FRITZ!OS
 Fabric OS
 Fastmark M5
diff --git a/xml/sip_banners.xml b/xml/sip_banners.xml
index e3cd9afd..60c6c7c9 100644
--- a/xml/sip_banners.xml
+++ b/xml/sip_banners.xml
@@ -178,7 +178,7 @@
     <param pos="3" name="hw.product"/>
   </fingerprint>
 
-  <fingerprint pattern="^(TANDBERG/(\d+)) \((\S+).*\)$">
+  <fingerprint pattern="^(TANDBERG\/(\d+)) \((X\d+\S*|XC\d+\S*|TC\d+\S*|TCNC\d+\S*).*\)$">
     <description>Cisco/Tandberg TelePresence</description>
     <example os.version="TC7.0.2.aecf2d9" tandberg.model="519" hw.product="TANDBERG/519">TANDBERG/519 (TC7.0.2.aecf2d9)</example>
     <example os.version="X12.5.2" tandberg.model="4137" hw.product="TANDBERG/4137">TANDBERG/4137 (X12.5.2 (TEST SW))</example>
@@ -186,9 +186,10 @@
     <example os.version="XC2.2.1-b2bua-1.0" hw.product="TANDBERG/4353" tandberg.model="4353">TANDBERG/4353 (XC2.2.1-b2bua-1.0)</example>
     <example os.version="TC5.1.4.295090" hw.product="TANDBERG/516" tandberg.model="516">TANDBERG/516 (TC5.1.4.295090)</example>
     <example os.version="TCNC5.1.4.295090" hw.product="TANDBERG/517" tandberg.model="517">TANDBERG/517 (TCNC5.1.4.295090)</example>
-    <param pos="0" name="os.vendor" value="Tandberg"/>
-    <param pos="0" name="os.family" value="Linux"/>
-    <param pos="0" name="os.product" value="Linux"/>
+    <param pos="0" name="os.vendor" value="Cisco"/>
+    <param pos="0" name="os.family" value="TelePresence"/>
+    <param pos="0" name="os.product" value="Expressway"/>
+    <param pos="0" name="os.device" value="Video Conferencing"/>
     <param pos="2" name="tandberg.model"/>
     <param pos="3" name="os.version"/>
     <param pos="0" name="hw.vendor" value="Cisco"/>
@@ -196,7 +197,6 @@
     <param pos="0" name="hw.device" value="Video Conferencing"/>
     <param pos="1" name="hw.product"/>
   </fingerprint>
-
   <!-- NEC -->
 
   <fingerprint pattern="^NEC SL2100/([\d.]+)$">

From a58e20569bd9298cce277fc3e47eaa40bb1c5142 Mon Sep 17 00:00:00 2001
From: Anastassiya Torovik <anastassiya_torovik@rapid7.com>
Date: Mon, 2 Sep 2024 14:01:41 +0200
Subject: [PATCH 2/3] Make Cisco Telepresence records consistent

---
 xml/sip_banners.xml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/xml/sip_banners.xml b/xml/sip_banners.xml
index 60c6c7c9..3e97da54 100644
--- a/xml/sip_banners.xml
+++ b/xml/sip_banners.xml
@@ -167,9 +167,9 @@
     <description>Cisco/Tandberg TelePresence w/Cisco Model Name</description>
     <example os.version="TC7.3.7.01c84fd" tandberg.model="528" hw.product="EX60">TANDBERG/528 (TC7.3.7.01c84fd) Cisco-EX60</example>
     <example os.version="ce9.6.0.76c1685b70e" tandberg.model="529" hw.product="RoomKitMini">TANDBERG/529 (ce9.6.0.76c1685b70e) Cisco-RoomKitMini</example>
-    <param pos="0" name="os.vendor" value="Tandberg"/>
-    <param pos="0" name="os.family" value="Linux"/>
-    <param pos="0" name="os.product" value="Linux"/>
+    <param pos="0" name="os.vendor" value="Cisco"/>
+    <param pos="0" name="os.family" value="TelePresence"/>
+    <param pos="0" name="os.product" value="Expressway"/>
     <param pos="1" name="tandberg.model"/>
     <param pos="2" name="os.version"/>
     <param pos="0" name="hw.vendor" value="Cisco"/>

From aa54ae35d772e499d14ec15c45a7b1a91c314f68 Mon Sep 17 00:00:00 2001
From: Anastassiya Torovik <anastassiya_torovik@rapid7.com>
Date: Mon, 2 Sep 2024 14:49:53 +0200
Subject: [PATCH 3/3] Adjust regex and examples for Cisco Telepresence record 2
 in sip_banners

---
 xml/sip_banners.xml | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/xml/sip_banners.xml b/xml/sip_banners.xml
index 3e97da54..0db99808 100644
--- a/xml/sip_banners.xml
+++ b/xml/sip_banners.xml
@@ -163,10 +163,9 @@
     <param pos="2" name="hw.version"/>
   </fingerprint>
 
-  <fingerprint pattern="^TANDBERG/(\d+) \((.*)\) Cisco-(\S+)$">
+  <fingerprint pattern="^TANDBERG\/(\d+) \((X\d+\S*|XC\d+\S*|TC\d+\S*|TCNC\d+\S*).*\) Cisco-(\S+)$">
     <description>Cisco/Tandberg TelePresence w/Cisco Model Name</description>
     <example os.version="TC7.3.7.01c84fd" tandberg.model="528" hw.product="EX60">TANDBERG/528 (TC7.3.7.01c84fd) Cisco-EX60</example>
-    <example os.version="ce9.6.0.76c1685b70e" tandberg.model="529" hw.product="RoomKitMini">TANDBERG/529 (ce9.6.0.76c1685b70e) Cisco-RoomKitMini</example>
     <param pos="0" name="os.vendor" value="Cisco"/>
     <param pos="0" name="os.family" value="TelePresence"/>
     <param pos="0" name="os.product" value="Expressway"/>