<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Feed of one EC2 Availability Zone in General Topics</title>
    <link>https://live.paloaltonetworks.com/t5/general-topics/feed-of-one-ec2-availability-zone/m-p/78979#M99621</link>
    <description>&lt;P&gt;Is it possible to filter down the Amazon EC2 feed to specific availability zones (just us-east-1 or eu-west-1)?&lt;/P&gt;</description>
    <pubDate>Wed, 01 Jun 2016 22:13:31 GMT</pubDate>
    <dc:creator>mirichardson</dc:creator>
    <dc:date>2016-06-01T22:13:31Z</dc:date>
    <item>
      <title>Feed of one EC2 Availability Zone</title>
      <link>https://live.paloaltonetworks.com/t5/general-topics/feed-of-one-ec2-availability-zone/m-p/78979#M99621</link>
      <description>&lt;P&gt;Is it possible to filter down the Amazon EC2 feed to specific availability zones (just us-east-1 or eu-west-1)?&lt;/P&gt;</description>
      <pubDate>Wed, 01 Jun 2016 22:13:31 GMT</pubDate>
      <guid>https://live.paloaltonetworks.com/t5/general-topics/feed-of-one-ec2-availability-zone/m-p/78979#M99621</guid>
      <dc:creator>mirichardson</dc:creator>
      <dc:date>2016-06-01T22:13:31Z</dc:date>
    </item>
    <item>
      <title>Re: Feed of one EC2 Availability Zone</title>
      <link>https://live.paloaltonetworks.com/t5/general-topics/feed-of-one-ec2-availability-zone/m-p/78982#M99622</link>
      <description>&lt;P&gt;Yes, you can create a new prototype of output node and filter the incoming indicators based on the &lt;STRONG&gt;aws_region&lt;/STRONG&gt; attribute.&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;&lt;FONT size="4"&gt;&lt;STRONG&gt;Phase1 - create the prototype&lt;/STRONG&gt;&lt;/FONT&gt;&lt;/P&gt;
&lt;P&gt;- go to &lt;STRONG&gt;CONFIG&lt;/STRONG&gt;&lt;/P&gt;
&lt;P&gt;- click on the &lt;STRONG&gt;browse prototypes&lt;/STRONG&gt; button&lt;/P&gt;
&lt;P&gt;- search for &lt;STRONG&gt;stdlib.feedHCWithValue&lt;/STRONG&gt; and click on it&lt;/P&gt;
&lt;P&gt;- click on the &lt;STRONG&gt;NEW&lt;/STRONG&gt; button&lt;/P&gt;
&lt;P&gt;- give to the new prototype a name and copy &amp;amp; paste the following config in the text area&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;PRE&gt;infilters:
- name: accept withdraws
  conditions:
  - __method == 'withdraw'
  actions:
  - accept
- name: accept eu-west-1
  actions:
  - accept
  conditions:
  - aws_region == 'eu-west-1'
  - confidence &amp;gt; 75
- name: accept us-east-1
  actions:
  - accept
  conditions:
  - aws_region == 'us-east-1'
  - confidence &amp;gt; 75
- name: drop all  
  actions:
  - drop
store_value: true&lt;/PRE&gt;
&lt;P&gt;- click on &lt;STRONG&gt;OK&lt;/STRONG&gt;&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;&lt;FONT size="4"&gt;&lt;STRONG&gt;Phase2 - Use the new prototype&lt;/STRONG&gt;&lt;/FONT&gt;&lt;/P&gt;
&lt;P&gt;-&amp;nbsp;go to &lt;STRONG&gt;CONFIG&lt;/STRONG&gt;&lt;/P&gt;
&lt;P&gt;- click on &lt;STRONG&gt;browse prototypes&lt;/STRONG&gt; button&lt;/P&gt;
&lt;P&gt;- select the prototype you have created in Phase 1&lt;/P&gt;
&lt;P&gt;- click &lt;STRONG&gt;CLONE&lt;/STRONG&gt;&lt;/P&gt;
&lt;P&gt;- select as input the AWS Miner or an aggregator&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;luigi&lt;/P&gt;</description>
      <pubDate>Wed, 01 Jun 2016 22:25:27 GMT</pubDate>
      <guid>https://live.paloaltonetworks.com/t5/general-topics/feed-of-one-ec2-availability-zone/m-p/78982#M99622</guid>
      <dc:creator>lmori</dc:creator>
      <dc:date>2016-06-01T22:25:27Z</dc:date>
    </item>
  </channel>
</rss>

