Configuring stdlib.localDB with an "age_out" breaks the miner, allowing only 1 IOC at a time.

KOFFENBACK — Fri, 30 Aug 2019 20:39:29 GMT

Below is a link of a test implementation as I learn Minemeld. I have read the following documentation.

Use Case

Using Desmito, we would like to submit IOCs to the stdlib.localDB miner. Based off of investigations, the analyst will determine the TTL (age_out) policy for the IOC. The default policy should be configured for a 24 hour TTL.

The test case, I am using 30-60 seconds TTL to test default TTL funcationality. However, I have been running into strange issues.

Test conditions requirements

Maintain a list of IOCs.
Remove IOCs which have expired.

Test Diagram

Case #1

The following settings have been configured on stdlib.localDB.
Observed behavior:

Adding a new IOC after one has been added, will remove all previous IOCs. Resulting in the miner only ever having 1 IOC. Regardless of the expiration date.
Expiration does properly work.

Tests Done:

Attempted using default for age_out policy.
Attempted using a manual age_out TTL legnth.

Case #2

The following settings have been configured on stdlib.localDB-true.
Observed behavior:

Adding a new IOC after one has been added, will remove all previous IOCs. Resulting in the miner only ever having 1 IOC. Regardless of the expiration date.
Expiration does properly work.

Tests Done:

Attempted using default for age_out policy.
Attempted using a manual age_out TTL legnth.

Case #3

The following settings have been configured on stdlib.localDB-true.
Observed behavior:

Is able to maintain a list of IOCs.
Expiration does not properly work.

Tests Done:

Attempted using default for age_out policy.
Attempted using a manual age_out TTL legnth.

Re: Configuring stdlib.localDB with an "age_out" breaks the miner, allowing only 1 IOC at

dave.cabio — Wed, 16 Dec 2020 11:09:21 GMT

hi @KOFFENBACK ,

have you found a solution for this problem?
I'm facing the same issue, the only workaround I've found is to set for each IOC TTL=Disabled.

@admin: do you have any update in program to fix this?

topic Configuring stdlib.localDB with an "age_out" breaks the miner, allowing only 1 IOC at a time. in General Topics

Configuring stdlib.localDB with an "age_out" breaks the miner, allowing only 1 IOC at a time.

Re: Configuring stdlib.localDB with an "age_out" breaks the miner, allowing only 1 IOC at