topic Re: No indicators for output in General Topics

No indicators for output

timothyyip — Thu, 09 Mar 2017 03:53:06 GMT

It was found that output (high, medium and low) have not incidcators event aggregator has over 2xxxx indicators. Please see attachment.

How to resolve it? Many thanks!

Re: No indicators for output

lmori — Thu, 09 Mar 2017 10:43:39 GMT

Hi @timothyyip,

you don't see any indicator in outbound* and inbound* feeds ? when you click on the feed URLs, are they empty ?

luigi

Re: No indicators for output

timothyyip — Thu, 09 Mar 2017 10:49:42 GMT

it just shown a few indicators, however, according to aggregator, it shown that it has over 20000 indicators.

please see attachments.

thanks!

Re: No indicators for output

lmori — Thu, 09 Mar 2017 10:52:40 GMT

Please, could you export your config text from CONFIG page using the export button and share it ?

Thanks,

luigi

Re: No indicators for output

timothyyip — Fri, 10 Mar 2017 01:17:58 GMT

Please find attached configuration

Similar problem also occurred on Domain and URL output.

Re: No indicators for output

lmori — Fri, 10 Mar 2017 07:44:42 GMT

Hi @timothyyip,

I have tried loading your config on a MM test instance and it works for me.

Which version of MM are you running ? If it's older than 0.9.32, could you update it ? If not, was it upgraded from an older version ?

Couple of notes on your config:

- as all the IP feeds are already connected to IPv4Aggregator, connection from outboundaggregator and inboundaggregator to IPv4Aggregator are not really needed.

- ransomwaretracker.RW_* feeds already contains the indicators of ransomwaretracker.TC_*, LY_*, ... You could simplify your config and keep all your indicators by removing the ransomwaretracker.TC_*, LY_* , TL_* feeds.

Re: No indicators for output

timothyyip — Fri, 10 Mar 2017 09:44:00 GMT

It is version 0.9.34 , the number of miner's indicators is not match with output.

Re: No indicators for output

lmori — Fri, 10 Mar 2017 10:29:47 GMT

Hi @timothyyip,

if you are using all the ransomwaretracker feeds that could be normal, as the RW_* feeds already include the contents of the single TC, LY, ... feeds. Aggregators remove duplicates.

Are you seeing indicators in the output nodes now ?

Re: No indicators for output

timothyyip — Mon, 13 Mar 2017 01:21:16 GMT

Yes, thank you!