topic Re: Minemeld - excluding entries from URL list in General Topics

Minemeld - excluding entries from URL list

danletkeman — Mon, 26 Mar 2018 15:05:26 GMT

Hello,

I have setup IPv4 and URL lists for O365 using minemeld for whitelisting. I have noticed that the office365.onenote prototype in minemeld includes www.youtube.com in the url list. How would I go about removing that entry and a few others from the generated list?

Thanks,

Dan.

Re: Minemeld - excluding entries from URL list

xhoms — Mon, 26 Mar 2018 15:27:57 GMT

Hi @danletkeman,

just add a "localDB" miner to your setup (clone the stdlib.localDB prototype) and name it anything starting with "wl_" (stands for WhiteList). Attach this miner to the same processor receiving the o365 indicators.

Couple of screenshots attached.

Re: Minemeld - excluding entries from URL list

wiresharky — Wed, 20 Nov 2019 12:08:22 GMT

might not understand this, but why does this remove the urls from the list?

i would have guessed it would add them.