topic MineMeld: What is the difference of Share Level and stdlib name with/without value in General Topics

MineMeld: What is the difference of Share Level and stdlib name with/without value

JamesChim — Wed, 28 Feb 2018 01:06:08 GMT

Dear All Brothers,

I'm a new user to testing the MineMeld, but I cannot find any document to know the detail information.

In our environment testing, we would like to implement the Feed List to deny the traffic to a high-risk IP address and our testing, and we find below information is difficult to know the difference.

Case:

1. stdlib.feedHCGreen and stdlib.feedHCGreenWithValue

EDL for high confidence indicators (>75) and share level green, with value

What is the difference of with value or without value?

2. share_level (Red, Green, Yellow, Unknown)

Normally, you can use the Red, and Green for feed output, but the yellow comes from stdlib.listIPv4Generic

A. How to use the Yellow share level, and what is the main difference or propose of the share_level?

B. In Current MineMeld, you can generate and export the feed for Red, and Green. How about the Yellow or Unknow Share_Level?

Thanks & Regards,

James C

Re: MineMeld: What is the difference of Share Level and stdlib name with/without value

lmori — Fri, 02 Mar 2018 16:15:22 GMT

Hi @JamesChim,

which Miner is generating indicators with share level "Yellow"?

Looks like a bug, the right share level should be "amber": https://github.com/PaloAltoNetworks/minemeld-core/blob/master/docs/schema-indicator-0-1.json#L61

About with and without value, please just the ones "WithValue". WithValue means that both the indicators and its metadata (the "value") are stored in the feed, while the ones without value do not store metadata to save memory. The "WithValue" prototypes are more flexibile.

Re: MineMeld: What is the difference of Share Level and stdlib name with/without value

danilo.souza — Fri, 13 Jul 2018 19:04:25 GMT

Hi @lmori and @xhoms

In MM 0.9.46 we have the "libraesva" miners prototypes. All of them with share level Yellow. But we don't have an output prototype with this share level. I tried to create a new one from std.feedHCGreen, but it doesn't allow to change the share level to Yellow.

What is the best way to create an output prototype with share level Yellow?

Best regards.

Re: MineMeld: What is the difference of Share Level and stdlib name with/without value

xhoms — Mon, 23 Jul 2018 15:08:48 GMT

Hi @danilo.souza,

left a response in https://live.paloaltonetworks.com/t5/MineMeld-Discussions/Share-level-Yellow/m-p/223219/highlight/true#M2408