MineMeld custom processor / output node question ?

Reply
L0 Member

MineMeld custom processor / output node question ?

Hi all,

    I have a customer that is asking if we ingest thier ThreatConnect feed into MM, could a custom processor / output node be built that sends

 

destination IP address,port

192.168.0.11,43

and then they would like this PUSHED from the output node to another system for ingestion ? 

 

I've seen the standard IPv4 processor and output parameters, but didn't see any parameters for including a port with an IP address. Also everything I've seen for output has been pull method, can we push as well ? I'm wondering if additional code to the processor or output node can be done to achieve this ?

 

Thanks

L7 Applicator

Re: MineMeld custom processor / output node question ?

That would be the responsibility of the output node. There are some output nodes that push indicators, like DagPusher or logstash output node (or CEF).

I don't know if TC Miner pulls also ports, @xhoms knows all about it. If ports are pulled and placed in an indicator attribute the output node could retrieve them and push along the IP to the external API.

BTW, which external API is your customer interested in?

Highlighted
L5 Sessionator

Re: MineMeld custom processor / output node question ?

Hi @jcardenosa,

 

current ThreatConnect miner does not extract port information from IPv4 indicators. That means that, to satisfy this use case:

  1. a new feature to extract port attributes should be added to the TC Miner and
  2. a new output node capable of generating your formatted output would be needed as well
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!