I have the problem that minemeld whitelists don't seem to work on our self-hosted minemeld version.
I have the following setup:
The wlDomeinAggregator contains a few domainnames, so they should be removed from the CEF output node.
When investigating the issue I found out that no 'withdraw' event is triggered in the CEF node when a new whitelist entry is added. I am wondering why this doesn't happen. When an input miner(for example feodetrackr removes an IP) removes an IOC a 'withdraw' event is triggered for that IP.
I tried different setups. I tried adding the input node(generic domain list) to the domainaggregator directly. I tried the localdb miner. Nothing seems to work.
Help would be appreciated.
Solved! Go to Solution.
I think I found a solution to this:
First of all I deleted rabbitmq, it is not necesarry anymore. After that I changed the requirements.txt(/<mm dir>/engine/core) file so newer versions are used:
After that cd /<mm dir>/engine/core && /<mm dir>/engine/current/bin/python setup.py install.
For me this seems to work on RedHat 7.6. You can remove traced logs by either mm-traced-purge --all or rm -rf /<mm dir>/local/traced. Restart minemeld with 'service minemeld restart'.
Maybe it is a good idea to update the requirements in the git repository?
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!
The Live Community thanks you for your participation!