From 0865a2a3f643793ac7e95accb10c132b4d0bb4c8 Mon Sep 17 00:00:00 2001
From: Matthew Kienow <matthew_kienow@rapid7.com>
Date: Tue, 9 Aug 2022 00:33:04 -0400
Subject: [PATCH] Add Duo Device Health and Mac Certifier

---
 identifiers/service_product.txt |  2 ++
 xml/x509_subjects.xml           | 20 ++++++++++++++++++++
 2 files changed, 22 insertions(+)

diff --git a/identifiers/service_product.txt b/identifiers/service_product.txt
index 9fd85e56..dcba6c55 100644
--- a/identifiers/service_product.txt
+++ b/identifiers/service_product.txt
@@ -128,6 +128,8 @@ Dovecot
 Drive
 Dropbear SSH
 Druid
+Duo Certifier
+Duo Device Health
 Dynamo
 E-mail Firewall
 E-mail Services
diff --git a/xml/x509_subjects.xml b/xml/x509_subjects.xml
index 3ac0111d..9846e69c 100644
--- a/xml/x509_subjects.xml
+++ b/xml/x509_subjects.xml
@@ -1755,4 +1755,24 @@
     <param pos="0" name="os.product" value="Proxmox"/>
   </fingerprint>
 
+  <fingerprint pattern="^CN=(\S{1,512}),OU=Endpoint Health,O=Duo Security\\, Inc.,L=Ann Arbor,ST=Michigan,C=US(?:,\S+)?$">
+    <description>Duo Device Health</description>
+    <example host.name="127.0.0.1">CN=127.0.0.1,OU=Endpoint Health,O=Duo Security\, Inc.,L=Ann Arbor,ST=Michigan,C=US,1.2.840.113549.1.9.1=#0c1e656e64706f696e746865616c74684064756f73656375726974792e636f6d</example>
+    <param pos="0" name="service.vendor" value="Duo"/>
+    <param pos="0" name="service.product" value="Duo Device Health"/>
+    <param pos="1" name="host.name"/>
+  </fingerprint>
+
+  <fingerprint pattern="^CN=(\S{1,512}),OU=Mac Certifier,O=Duo Security\\, Inc.,L=Ann Arbor,ST=Michigan,C=US(?:,\S+)?$">
+    <description>Duo Certifier</description>
+    <example host.name="localhost">CN=localhost,OU=Mac Certifier,O=Duo Security\, Inc.,L=Ann Arbor,ST=Michigan,C=US,1.2.840.113549.1.9.1=#0c18656e64706f696e744064756f73656375726974792e636f6d</example>
+    <param pos="0" name="service.vendor" value="Duo"/>
+    <param pos="0" name="service.product" value="Duo Certifier"/>
+    <param pos="0" name="os.vendor" value="Apple"/>
+    <param pos="0" name="os.family" value="Mac OS"/>
+    <param pos="0" name="os.product" value="Mac OS"/>
+    <param pos="0" name="os.cpe23" value="cpe:/o:apple:macos:-"/>
+    <param pos="1" name="host.name"/>
+  </fingerprint>
+
 </fingerprints>
\ No newline at end of file