ZPA Minemeld feed from json source truncated to last record

SlowTypist — Thu, 13 Feb 2020 08:43:46 GMT

Problem Summary:

Trying to locally convey - as a feed - all subnet block ranges from https://ips.zscaler.net/zpa/json - but only getting the last presented.

URL Being referenced: https://ips.zscaler.net/zpa/json

Example Content:

What we want to get?

List of all IP address ranges - eg.

192.168.1.0/24
172.16.2.0/24

To become something like....

192.168.1.1 - 192.168.1.254
172.16.2.1 - 172.16.2.254

ie. all subnet ranges within Content[].IPs[] ranges of the json input.

What was done?

Step 1: Created Inital Prototype

- Started with copy of "itcertpa.IP"
- Clicked New
- Details:

Name = minemeldlocal.SL-ZPA-proto5

MINEREXPERIMENTAL
ABOUT minemeldlocal
Local prototype library managed via MineMeld WebUI
ABOUT minemeldlocal.SL-ZPA-proto5
Proto 5
CLASS
minemeld.ft.http.HttpFT
INDICATOR TYPES
IPv4
TAGS
ConfidenceHighShareLevelGreen
CONFIG
age_out
default: null
interval: 270
sudden_death: true
attributes
confidence: 100
share_level: green
type: IPv4
extractor Content[].IPs[]
indicator
regex: (.*\")([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}/[0-9]{1,2})(\".*)
transform: \2
prefix zs
source_name zscaler
url https://ips.zscaler.net/zpa/json

Step 2 - Created Miner Node

Name = SL-ZPA-Miner5
STATUS
CLASS minemeld.ft.http.HttpFT
PROTOTYPE minemeldlocal.SL-ZPA-proto5
STATE STARTED
LAST RUN 2020-02-13 14:59:29 +0800 WAITING
# INDICATORS 1
OUTPUT ENABLED
INPUTS none

Step 3 - Created Aggregator Prototype/Processor Node

Name = minemeldlocal.SL-ZPA-AggProto5

PROCESSORSTABLE
ABOUT minemeldlocal
Local prototype library managed via MineMeld WebUI
ABOUT minemeldlocal.SL-ZPA-AggProto5
Generic Aggregator for IPv4 indicators. Inputs with names starting with "wl" will be interpreted as whitelists.
CLASS
minemeld.ft.ipop.AggregateIPv4FT
INDICATOR TYPES
IPv4
TAGS
None
CONFIG
infilters
NAME CONDITIONS ACTIONS
accept withdraws
__method == 'withdraw'
accept
accept IPv4
type == 'IPv4'
accept

Step 4 - Created Aggregator Node

Name = SL-ZPA-Agg5

STATUS
CLASS minemeld.ft.ipop.AggregateIPv4FT
PROTOTYPE minemeldlocal.SL-ZPA-AggProto5
STATE STARTED
# INDICATORS 1
OUTPUT ENABLED
INPUTS
SL-ZPA-Miner5

Step 5 - Created Output Node

Name = SL-ZPA-Out5
STATUS
CLASS minemeld.ft.redis.RedisSet
PROTOTYPE minemeldlocal.SL-ZPA-OutProto5
STATE STARTED
FEED BASE URL https://192.168.19.144/feeds/SL-ZPA-Out5
TAGS
# INDICATORS 1
OUTPUT DISABLED
INPUTS
SL-ZPA-Agg5

Step 6 - I pressed "Commit" - this resulted in the stop/restart & reported no errrors....but

The result presented at https://192.168.19.144/feeds/SL-ZPA-Out5:

211.144.19.126-211.144.19.126

So it looks like it has retained the last line. The interpretation of the mask looks corrrect - but I need to
see all ip ranges.

If I am reading the meaning of the Indicators value correctly it looks like there has only been one
subnet value presented from the start of the action by the Miner ( although I may be misunderstanding the
relevant sequence of processing ).

Can anyone shed any light on where I am going wrong?

Many Thanks.

Re: ZPA Minemeld feed from json source truncated to last record

SlowTypist — Thu, 13 Feb 2020 10:16:13 GMT

Hi,

After looking around at lots of other prototype definitions and running some more tests I found "a" solution.

I moved to replication of a prototype with class = minemeld.ft.json.SimpleJSON".

After this I just used the simple extractor line ; Content[].IPs[].{"indicator":@}

All good after this.

Thanks.

topic Re: ZPA Minemeld feed from json source truncated to last record in General Topics

ZPA Minemeld feed from json source truncated to last record

Re: ZPA Minemeld feed from json source truncated to last record