Merge pull request #10104 from righettod/ibmsrvassistant_upd

Add extractors to the "IBM Service Assistant" login panel detection template.

http/exposed-panels/ibm/ibm-service-assistant.yaml

@@ -2,16 +2,18 @@ id: ibm-service-assistant
 
 info:
   name: IBM Service Assistant Login Panel - Detect
-  author: dhiyaneshDK
+  author: dhiyaneshDK,righettod
   severity: info
   description: IBM Service Assistant login panel was detected.
+  reference:
+    - https://mediacenter.ibm.com/media/Using+the+IBM+Support+Assistant/0_ffe9o5w1
   classification:
     cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
     cwe-id: CWE-200
   metadata:
     max-request: 1
     shodan-query: http.title:"Welcome to Service Assistant"
-  tags: panel,ibm,service
+  tags: panel,ibm,service,login,detect
 
 http:
   - method: GET
@@ -27,4 +29,11 @@ http:
       - type: status
         status:
           - 200
-# digest: 4a0a004730450221009dfb2b04022e1d677249671c42cfa583257d74854eb9e09d614c77a50e443e9e02201795f12826ce8883a64aa98673a48224e65016d081a8c7b415709f8469ad17d2:922c64590222798bb761d5b6d8e72950
+
+    extractors:
+      - type: regex
+        part: body
+        group: 1
+        regex:
+          - '(?i)([a-z0-9\s]+)\s+Service\s+Assistant\s+Tool'
+          - '(?i)svcProductMtm\s+=\s+.?([0-9a-z\-]+).?'