Reply
Highlighted
L0 Member
Posts: 1
Registered: 2 weeks ago
Accepted Solution

Prototype to pass additional 'fields'

Hi, new user here trying out a local instance of minemeld.

 

I would like to know if there is any way to set up a miner node that will parse and pass along more than just the 'indicator' from the source feed. Specifically, some source feeds contain more information along with each indicator such as ASN info and country codes.

 

An example of a prototype config that I believe is parsing these additional fields is the dshield.block prototype found at: https://github.com/PaloAltoNetworks/minemeld-node-prototypes/blob/master/prototypes/dshield.yml

 

It seems like these columns are being parsed as 'fields' in the dshield.block prototype but I can't figure out how to include them in an output request such as: http//minemeld.instance/output/node/path?v=csv&f=indicator&f=dshield_name

 

Are these additional fields possibly being dropped by nodes whose prototype only passes along the 'indicator'? If so, is there a way I can tweak the prototype to pass along these fields?

 

Thanks!

 

L6 Presenter
Posts: 707
Registered: ‎03-03-2011

Re: Prototype to pass additional 'fields'

Hi @nickd5,

one of the nice feature of MineMeld is its internal flexible schema for representing indicators. Using this schema the Miners can capture all the context originally provided by the feed and translate it into additional attributes in the indicator.

If you don't see the field in the feed output, please make sure the output feed node is based on one of the stdlib.feed*WithValue. Output nodes based on these prototypes save both the indicator and the full list of attributes in the feed, by default instead output nodes based on stdlib.feed* keep only the indicators to save memory.