topic Re: How to add feed for github IPs? in General Topics

How to add feed for github IPs?

drewdown — Tue, 21 Jan 2020 15:35:28 GMT

Little confused on how I actually do this. I want a list generated on minemeld from the following page: https://api.github.com/meta

How do I go about making it so that list is referenced via a policy to allow github APP to that list of IPs? I am already using minemeld for o365 but that was canned and this isn't. Appreciate any help anyone can provide.

Thanks

Re: How to add feed for github IPs?

KasiWong — Mon, 03 Feb 2020 16:26:56 GMT

not sure if you find the solution. here is the setup for the miner

Re: How to add feed for github IPs?

drewdown — Mon, 03 Feb 2020 19:50:53 GMT

Thanks man, will configure and let you know how it goes.

Re: How to add feed for github IPs?

drewdown — Tue, 04 Feb 2020 15:16:36 GMT

Did you manually add that or import it? If manually can you copy/paste the syntax used to create it? I tried to create a new miner using those same settings but it won't let me save it and I am not sure why. IE the OK box has a red circle with a line through it so I am doing something wrong.

Re: How to add feed for github IPs?

KasiWong — Tue, 04 Feb 2020 15:32:28 GMT

here is the code: seems like missing single quote around the extractor.

extractor: '*[].{indicator:@}'
indicator: indicator
url: https://api.github.com/meta

Re: How to add feed for github IPs?

drewdown — Tue, 04 Feb 2020 15:59:46 GMT

Thanks that worked.

How do I get a FEED BASE URL configured for this? The goal there is to reference the list of github IPs via an EDL.

Re: How to add feed for github IPs?

KasiWong — Tue, 04 Feb 2020 16:06:09 GMT

then you create a regular IP aggregator:

stdlib.aggregatorIPv4Generic

then output:

stdlib_feedHCGreenWithValue-IPv4

please refer to this thread: the idea is similar, his example is URL

https://live.paloaltonetworks.com/t5/Featured-Articles/Using-Custom-Indicators-with-MineMeld/ta-p/241043