From 5effc6eca5b6ab2cc89d39eef102c933fc916145 Mon Sep 17 00:00:00 2001
From: Anastassiya Torovik <anastassiya_torovik@rapid7.com>
Date: Wed, 28 Aug 2024 16:41:38 +0200
Subject: [PATCH] VC-2125 Add sip-banner record for Telepresence with higher
 certainty

---
 identifiers/os_family.txt  |  1 +
 identifiers/os_product.txt |  3 ++-
 xml/sip_banners.xml        | 18 ++++++++++++++++++
 3 files changed, 21 insertions(+), 1 deletion(-)

diff --git a/identifiers/os_family.txt b/identifiers/os_family.txt
index 23ac2a73..a141b41b 100644
--- a/identifiers/os_family.txt
+++ b/identifiers/os_family.txt
@@ -189,6 +189,7 @@ System Storage
 T3 Termination
 TASKalfa
 TDS750 Series
+TelePresence
 Teradici
 Time Capsule
 TippingPoint
diff --git a/identifiers/os_product.txt b/identifiers/os_product.txt
index b5115a03..008565a0 100644
--- a/identifiers/os_product.txt
+++ b/identifiers/os_product.txt
@@ -69,15 +69,16 @@ Document Centre
 Dynix
 EDR G902 Firmware
 EDR-G903 Firmware
+EOS
 EdgeBlaster
 EdgeOS
 Email Appliance
 Enterprise AP
 Enterprise Linux
 Enterprise WAP
-EOS
 EqualLogic
 Excella
+Expressway
 FRITZ!OS
 Fabric OS
 Fastmark M5
diff --git a/xml/sip_banners.xml b/xml/sip_banners.xml
index e3cd9afd..cc78bf49 100644
--- a/xml/sip_banners.xml
+++ b/xml/sip_banners.xml
@@ -197,6 +197,24 @@
     <param pos="1" name="hw.product"/>
   </fingerprint>
 
+
+  <fingerprint pattern="^(TANDBERG\/(\d+)) \(((X|TC)\d+\S+).*\)$">
+    <description>Cisco/Tandberg TelePresence</description>
+    <example os.version="TC7.0.2.aecf2d9" hw.product="TANDBERG/519">TANDBERG/519 (TC7.0.2.aecf2d9)</example>
+    <example os.version="X12.5.2" hw.product="TANDBERG/4137">TANDBERG/4137 (X12.5.2 (TEST SW))</example>
+    <example os.version="X8.2.1" hw.product="TANDBERG/4130">TANDBERG/4130 (X8.2.1)</example>
+    <example os.version="TC5.1.4.295090" hw.product="TANDBERG/516">TANDBERG/516 (TC5.1.4.295090)</example>
+    <param pos="0" name="os.vendor" value="Cisco"/>
+    <param pos="0" name="os.family" value="TelePresence"/>
+    <param pos="0" name="os.product" value="Expressway"/>
+    <param pos="0" name="os.device" value="Video Conferencing"/>
+    <param pos="3" name="os.version"/>
+    <param pos="0" name="os.certainty" value="0.85"/>
+    <param pos="0" name="hw.vendor" value="Cisco"/>
+    <param pos="0" name="hw.family" value="TelePresence"/>
+    <param pos="0" name="hw.device" value="Video Conferencing"/>
+    <param pos="1" name="hw.product"/>
+  </fingerprint>
   <!-- NEC -->
 
   <fingerprint pattern="^NEC SL2100/([\d.]+)$">