topic Re: MineMeld custom processor / output node question ? in General Topics

MineMeld custom processor / output node question ?

jcardenosa — Tue, 22 Jan 2019 17:11:08 GMT

Hi all,

I have a customer that is asking if we ingest thier ThreatConnect feed into MM, could a custom processor / output node be built that sends

destination IP address,port

192.168.0.11,43

and then they would like this PUSHED from the output node to another system for ingestion ?

I've seen the standard IPv4 processor and output parameters, but didn't see any parameters for including a port with an IP address. Also everything I've seen for output has been pull method, can we push as well ? I'm wondering if additional code to the processor or output node can be done to achieve this ?

Thanks

Re: MineMeld custom processor / output node question ?

lmori — Wed, 23 Jan 2019 13:09:07 GMT

That would be the responsibility of the output node. There are some output nodes that push indicators, like DagPusher or logstash output node (or CEF).

I don't know if TC Miner pulls also ports, @xhoms knows all about it. If ports are pulled and placed in an indicator attribute the output node could retrieve them and push along the IP to the external API.

BTW, which external API is your customer interested in?

Re: MineMeld custom processor / output node question ?

xhoms — Wed, 23 Jan 2019 14:42:05 GMT

Hi @jcardenosa,

current ThreatConnect miner does not extract port information from IPv4 indicators. That means that, to satisfy this use case:

a new feature to extract port attributes should be added to the TC Miner and
a new output node capable of generating your formatted output would be needed as well