Customizing Parameters for Alienvault

Reply
L0 Member

Customizing Parameters for Alienvault

Hello, I am new to MineMeld and was trying to figure out how to customiz the alienvault reputation prototype to only pull in values with a alienvault_reliability > 5. 

 

I have the feed setup to an stdlib.aggregatorIPv4Generic and then to a FeedHCwithValue that I customized to drop anything with an alienvault_reliability < 5. However it does not seem to work as I still get the full feed.

 

For the infilters I have:

 

infilters:
-   actions:
    - accept
    conditions:
    - __method == 'withdraw'
    name: accept withdraws
-   actions:
    - drop
    conditions:
    - alienvault_reliability < 5
    name: drop reliability < 5
-   actions:
    - accept
    conditions:
    - confidence > 75
    name: accept confidence > 75
-   actions:
    - drop
    name: drop all
store_value: true

 

Can someone point me in the right direction as to what step I am msissing?

 

Appreciate it.

L7 Applicator

Re: Customizing Parameters for Alienvault

Hi @rrspyder,

the reason is that alienvault_reliability is currently interpreted as a string. You should then use something like this:

infilters:
-   actions:
    - drop
    conditions:
    - alienvault_reliability == "0"
    name: drop alienvault_reliability 0
-   actions:
    - drop
    conditions:
    - alienvault_reliability == "1"
    name: drop alienvault_reliability 1
-   actions:
    - drop
    conditions:
    - alienvault_reliability == "2"
    name: drop alienvault_reliability 2
-   actions:
    - drop
    conditions:
    - alienvault_reliability == "3"
    name: drop alienvault_reliability 3
-   actions:
    - drop
    conditions:
    - alienvault_reliability == "4"
    name: drop alienvault_reliability 4
-   actions:
    - accept
    conditions:
    - confidence > 75
    name: accept confidence > 75
-  actions:
   - drop
   name: drop all
store_value: true
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!