MineMeld custom processor / output node question ?

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

MineMeld custom processor / output node question ?

L0 Member

Hi all,

    I have a customer that is asking if we ingest thier ThreatConnect feed into MM, could a custom processor / output node be built that sends

 

destination IP address,port

192.168.0.11,43

and then they would like this PUSHED from the output node to another system for ingestion ? 

 

I've seen the standard IPv4 processor and output parameters, but didn't see any parameters for including a port with an IP address. Also everything I've seen for output has been pull method, can we push as well ? I'm wondering if additional code to the processor or output node can be done to achieve this ?

 

Thanks

2 REPLIES 2

L7 Applicator

That would be the responsibility of the output node. There are some output nodes that push indicators, like DagPusher or logstash output node (or CEF).

I don't know if TC Miner pulls also ports, @xhoms knows all about it. If ports are pulled and placed in an indicator attribute the output node could retrieve them and push along the IP to the external API.

BTW, which external API is your customer interested in?

L5 Sessionator

Hi @jcardenosa,

 

current ThreatConnect miner does not extract port information from IPv4 indicators. That means that, to satisfy this use case:

  1. a new feature to extract port attributes should be added to the TC Miner and
  2. a new output node capable of generating your formatted output would be needed as well
  • 4008 Views
  • 2 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!