Creating this post based on another thread. In a previous post's comment section, @spssspss asked "Is it possible to create a white list from an IPs address file?" and Luigi requested a new post be created for this functionality..
Can a list of IPs or URLs be hosted on MineMeld without the content actually being pulled from an external source?
Solved! Go to Solution.
Yes. MineMeld can host indicators in a local database. The first approach was documented in Uploading list of indicators to MineMeld and supported by yaml files. Newer approach is based in a sqlite db, with an embeded aging engine and exposed via API. Implementation details in Using MineMeld as an Incident Response Platform
In summary, you need to add a "localDB" miner and upload the indicators to it using the script at https://gist.github.com/jtschichold/95f3906566b18b50cf2e3e1a44f1e785
I've added an FR (8269) to enable text-list functionality inside of MineMeld without the scripting requirements. Please feel free to review and vote!
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!
The Live Community thanks you for your participation!