topic IOCs. How can one create custom type? in General Topics

IOCs. How can one create custom type?

Lyuben.Bahtarliev — Sun, 16 Oct 2016 15:14:58 GMT

Hello,

The last couple of days I`m enjoying myself with the minemeld engine and I find it astonishing. I managed to create dynamic feeds from RIPE archives for some geolocation EDLs, will soon post them by the way.

However, I would love to be able to define custom IOC types. For example - hash, filename, etc. This way much more information can be gathered and correlated to other types already present (e.g. url and domain).

Fiddling around the source, the only definition of these (types) I`ve found is in the json schema. So should defining the type just there would be sufficient? I guess not?

Can someone provide any guidelines or instructions on accomplishing this, if feasible at all?

Thanks,

Lyuben

Re: IOCs. How can one create custom type?

lmori — Sun, 16 Oct 2016 20:54:10 GMT

Hi @Lyuben.Bahtarliev,

adding new types is extremely easy, you should be careful with some nodes where the processing dependes on type.

Could you open an issue on minemeld-core github repo (https://github.com/PaloAltoNetworks/minemeld-core) and specify the IOC types you would like to see supported ? This way we can track support for the new types there and add them in the next release.

It would be awesome if you could also create a pull request with the RIPE feeds !

Thanks,

luigi

Re: IOCs. How can one create custom type?

lmori — Wed, 19 Oct 2016 04:46:54 GMT

Hi @Lyuben.Bahtarliev,

FYI, if you were looking for file hashes I have just added them to the schema for the next release: https://github.com/PaloAltoNetworks/minemeld-core/pull/70