No indicators for output

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

No indicators for output

L1 Bithead

It was found that output (high, medium and low) have not incidcators event aggregator has over 2xxxx indicators. Please see attachment.

How to resolve it? Many thanks!

1 accepted solution

Accepted Solutions

Hi @timothyyip,

if you are using all the ransomwaretracker feeds that could be normal, as the RW_* feeds already include the contents of the single TC, LY, ... feeds. Aggregators remove duplicates.

 

Are you seeing indicators in the output nodes now ?

 

 

View solution in original post

8 REPLIES 8

L7 Applicator

Hi @timothyyip,

you don't see any indicator in outbound* and inbound* feeds ? when you click on the feed URLs, are they empty ?

 

luigi

L1 Bithead

it just shown a few indicators, however, according to aggregator, it shown that it has over 20000 indicators.

please see attachments.

 

thanks!

Please, could you export your config text from CONFIG page using the export button and share it ?

 

Thanks,

luigi

L1 Bithead

Please find attached configuration

Similar problem also occurred on Domain and URL output.

 

 

Hi @timothyyip,

I have tried loading your config on a MM test instance and it works for me.

Which version of MM are you running ? If it's older than 0.9.32, could you update it ? If not, was it upgraded from an older version ?

 

Couple of notes on your config:

- as all the IP feeds are already connected to IPv4Aggregator, connection from outboundaggregator and inboundaggregator to IPv4Aggregator are not really needed.

- ransomwaretracker.RW_* feeds already contains the indicators of ransomwaretracker.TC_*, LY_*, ... You could simplify your config and keep all your indicators by removing the ransomwaretracker.TC_*, LY_* , TL_* feeds. 

 

Screen Shot 2017-03-10 at 08.44.15.png

L1 Bithead
It is version 0.9.34 , the number of miner's indicators is not match with output.

Hi @timothyyip,

if you are using all the ransomwaretracker feeds that could be normal, as the RW_* feeds already include the contents of the single TC, LY, ... feeds. Aggregators remove duplicates.

 

Are you seeing indicators in the output nodes now ?

 

 

L1 Bithead

Yes, thank you!

  • 1 accepted solution
  • 13984 Views
  • 8 replies
  • 1 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!