Customizing Parameters for Alienvault

rrspyder — Fri, 23 Jun 2017 21:43:29 GMT

Hello, I am new to MineMeld and was trying to figure out how to customiz the alienvault reputation prototype to only pull in values with a alienvault_reliability > 5.

I have the feed setup to an stdlib.aggregatorIPv4Generic and then to a FeedHCwithValue that I customized to drop anything with an alienvault_reliability < 5. However it does not seem to work as I still get the full feed.

For the infilters I have:

infilters:
-   actions:
    - accept
    conditions:
    - __method == 'withdraw'
    name: accept withdraws
-   actions:
    - drop
    conditions:
    - alienvault_reliability < 5
    name: drop reliability < 5
-   actions:
    - accept
    conditions:
    - confidence > 75
    name: accept confidence > 75
-   actions:
    - drop
    name: drop all
store_value: true

Can someone point me in the right direction as to what step I am msissing?

Appreciate it.

Re: Customizing Parameters for Alienvault

lmori — Tue, 27 Jun 2017 17:16:57 GMT

Hi @rrspyder,

the reason is that alienvault_reliability is currently interpreted as a string. You should then use something like this:

infilters:
-   actions:
    - drop
    conditions:
    - alienvault_reliability == "0"
    name: drop alienvault_reliability 0
-   actions:
    - drop
    conditions:
    - alienvault_reliability == "1"
    name: drop alienvault_reliability 1
-   actions:
    - drop
    conditions:
    - alienvault_reliability == "2"
    name: drop alienvault_reliability 2
-   actions:
    - drop
    conditions:
    - alienvault_reliability == "3"
    name: drop alienvault_reliability 3
-   actions:
    - drop
    conditions:
    - alienvault_reliability == "4"
    name: drop alienvault_reliability 4
-   actions:
    - accept
    conditions:
    - confidence > 75
    name: accept confidence > 75
-  actions:
   - drop
   name: drop all
store_value: true

topic Re: Customizing Parameters for Alienvault in General Topics

Customizing Parameters for Alienvault

Re: Customizing Parameters for Alienvault