topic Re: Zscaler and Minemeld v2 in General Topics

Zscaler and Minemeld v2

lvmh_onenetwork — Wed, 16 May 2018 15:27:49 GMT

Hello,

I'm trying to get simple data from https://ips.zscaler.net/pac/json. I tried to exploit the extractor with http://jmespath.org/ but really, I don't think I need an extractor here, just indicator "ip".

But it doesn't work :

age_out:
    default: null
    interval: 257
    sudden_death: true
attributes:
    confidence: 100
    share_level: green
    type: IPv4
indicator: ip
prefix: zs
source_name: zscaler
url: https://ips.zscaler.net/pac/json

Could you please help me solve this issue?

Thank you

Regards

Re: Zscaler and Minemeld v2

xhoms — Wed, 16 May 2018 15:49:44 GMT

Hi @lvmh_onenetwork,

in this case you need a JMESPath expression that converts a plain list of values into an array of objects.

Try this one:

age_out:
    default: null
    interval: 257
    sudden_death: true
attributes:
    confidence: 100
    share_level: green
    type: IPv4
extractor: 'ip[].{"indicator":@}'
prefix: zs
source_name: zscaler
url: https://ips.zscaler.net/pac/json

Re: Zscaler and Minemeld v2

lvmh_onenetwork — Thu, 17 May 2018 07:01:18 GMT

Hi,

Thanks again, it works perfectly!

I surely need to develop this aspect.

Regards