topic Re: Output node prototype that allows to specify file type (extension) in General Topics

Output node prototype that allows to specify file type (extension)

MaHe — Mon, 01 Jul 2019 10:48:47 GMT

We have product in place that requires the indicators to be in a text file and verifies if the file type extension is ".txt" ( --> e.g. Pulling from https://ransomwaretracker.abuse.ch/downloads/CW_C2_URLBL.txt diretly works but doesn't when pulling from Minemeld by using any standard EDL prototype --> ..feeds/feedHCWithValue-RSWT1 ). Does such a prototype exist or is there a workaround available?

Re: Output node prototype that allows to specify file type (extension)

lmori — Wed, 03 Jul 2019 10:52:15 GMT

May I know which product does this check?

One workaround would be configuring nginx to rewrite requests to /feeds/feedHCWithValue-RSWT1.txt to /feeds/feedHCWithValue-RSWT1

We could consider adding a feature to ignore the extension of a feed...

Luigi

Re: Output node prototype that allows to specify file type (extension)

MaHe — Wed, 03 Jul 2019 11:02:35 GMT

Hi Luigi,

Good idea. Thanks for the workaround, I'll give it a try. It's the Cisco Firepower Management Center (without the Threat Intelligence Director). In the long run we might consider using the Threat Intelligence Director that supports STIX/TAXII.

Martin