topic Re: Minemeld List or Miner for a static list of IPs/URLs in General Topics

Minemeld List or Miner for a static list of IPs/URLs

Retired Member — Thu, 28 Dec 2017 17:44:19 GMT

Creating this post based on another thread. In a previous post's comment section, @spssspss asked "Is it possible to create a white list from an IPs address file?" and Luigi requested a new post be created for this functionality..

Can a list of IPs or URLs be hosted on MineMeld without the content actually being pulled from an external source?

Thanks!

-Chris

Re: Minemeld List or Miner for a static list of IPs/URLs

xhoms — Thu, 28 Dec 2017 18:02:56 GMT

Hi @Retired Member,

Yes. MineMeld can host indicators in a local database. The first approach was documented in Uploading list of indicators to MineMeld and supported by yaml files. Newer approach is based in a sqlite db, with an embeded aging engine and exposed via API. Implementation details in Using MineMeld as an Incident Response Platform

In summary, you need to add a "localDB" miner and upload the indicators to it using the script at https://gist.github.com/jtschichold/95f3906566b18b50cf2e3e1a44f1e785

Re: Minemeld List or Miner for a static list of IPs/URLs

Retired Member — Thu, 28 Dec 2017 18:33:48 GMT

Thanks, Xavi!

I've added an FR (8269) to enable text-list functionality inside of MineMeld without the scripting requirements. Please feel free to review and vote!