07-12-2017 01:38 PM
I created a domain whitelist called wlDomains, a node based on stdlib.listDomainGeneric and added the whitelist to my domain aggregator. I then added the indicator "aol.com" (lowercase, without the quotes).
When I checked the feed for the output node though, it still listed "AOL.COM". I had to add an all uppercase entry to wlDomains in order for AOL.COM to be removed.
Is this expected?
07-12-2017 11:56 PM
you are right, this should be improved. But the best place is improving the aggregator to support case insensitive matches. I have created and ER to track this: https://github.com/PaloAltoNetworks/minemeld-core/issues/229