It was found that output (high, medium and low) have not incidcators event aggregator has over 2xxxx indicators. Please see attachment.
How to resolve it? Many thanks!
Solved! Go to Solution.
I have tried loading your config on a MM test instance and it works for me.
Which version of MM are you running ? If it's older than 0.9.32, could you update it ? If not, was it upgraded from an older version ?
Couple of notes on your config:
- as all the IP feeds are already connected to IPv4Aggregator, connection from outboundaggregator and inboundaggregator to IPv4Aggregator are not really needed.
- ransomwaretracker.RW_* feeds already contains the indicators of ransomwaretracker.TC_*, LY_*, ... You could simplify your config and keep all your indicators by removing the ransomwaretracker.TC_*, LY_* , TL_* feeds.
if you are using all the ransomwaretracker feeds that could be normal, as the RW_* feeds already include the contents of the single TC, LY, ... feeds. Aggregators remove duplicates.
Are you seeing indicators in the output nodes now ?
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The Live Community thanks you for your participation!