Non-reordered IoC feed

apackard — Wed, 16 May 2018 00:52:37 GMT

I have an IP IoC feed that I would like to ingest and re-publish via MM.

The feed is ordered by priority i.e. earlier addresses are newer\more active\higher risk, but if I ingest and publish (miner -> output) it is re-ordered by numeric order. Is there any way to prevent this and maintain the initial order?

Technically I have a way around it by inserting another solution between the original source and MM (ultimately I'm trying to limit the number of IoC's as there are more than we can ingest into our PA's and I was using the ?n=x option) but it's a bit clunky!

Re: Non-reordered IoC feed

xhoms — Wed, 16 May 2018 16:21:18 GMT

@apackard,

is it a plain list? no attributes attached to the indicators other than its possition in the list to indicate its relative risk?

If it is just a list over HTTP then you could think on extending the HttpFT class to attach to each indicator a numerical attribute with its order position value. And then use this value as an input filter criteria in the output node (i.e. order < 100)

topic Re: Non-reordered IoC feed in General Topics

Non-reordered IoC feed

Re: Non-reordered IoC feed