Minemeld - excluding entries from URL list

[danletkeman]

Hello,

I have setup IPv4 and URL lists for O365 using minemeld for whitelisting.  I have noticed that the office365.onenote prototype in minemeld includes www.youtube.com in the url list.  How would I go about removing that entry and a few others from the generated list?

Thanks,

Dan.

[xhoms · Accepted solution]

Hi @danletkeman,

just add a "localDB" miner to your setup (clone the stdlib.localDB prototype) and name it anything starting with "wl_" (stands for WhiteList). Attach this miner to the same processor receiving the o365 indicators.

Couple of screenshots attached.

[wiresharky]

might not understand this, but why does this remove the urls from the list?

i would have guessed it would add them.