https://live.paloaltonetworks.com/t5/general-topics/custom-search-filters-for-anomali/m-p/238012#M98487 <P>Hello,</P><P>&nbsp;</P><P>Is it possible to configure the Anomali miner to allow for custom queries? For example, in threatstream, I like to search for the following string in Analyze -&gt; Observables. How can I configure the&nbsp;anomali.opticAPI miner to allow for this?</P><P>&nbsp;</P><PRE> ((type=ip and confidence &gt;= 60 and itype!=scan_ip) or (type=url and confidence&gt;=78 and severity!=low)) and modified_ts&gt;=10d</PRE><P>&nbsp;</P> Wed, 31 Oct 2018 17:53:51 GMT otlaP5 2018-10-31T17:53:51Z https://live.paloaltonetworks.com/t5/general-topics/custom-search-filters-for-anomali/m-p/238012#M98487 <P>Hello,</P><P>&nbsp;</P><P>Is it possible to configure the Anomali miner to allow for custom queries? For example, in threatstream, I like to search for the following string in Analyze -&gt; Observables. How can I configure the&nbsp;anomali.opticAPI miner to allow for this?</P><P>&nbsp;</P><PRE> ((type=ip and confidence &gt;= 60 and itype!=scan_ip) or (type=url and confidence&gt;=78 and severity!=low)) and modified_ts&gt;=10d</PRE><P>&nbsp;</P> Wed, 31 Oct 2018 17:53:51 GMT https://live.paloaltonetworks.com/t5/general-topics/custom-search-filters-for-anomali/m-p/238012#M98487 otlaP5 2018-10-31T17:53:51Z https://live.paloaltonetworks.com/t5/general-topics/custom-search-filters-for-anomali/m-p/240559#M98488 <P>Yes, but today you have to modify the prototype and add a new field <EM>query</EM> in the <EM>config</EM> section with the query you are interested in.</P> Tue, 20 Nov 2018 13:20:48 GMT https://live.paloaltonetworks.com/t5/general-topics/custom-search-filters-for-anomali/m-p/240559#M98488 lmori 2018-11-20T13:20:48Z