Hi, new user here trying out a local instance of minemeld.
I would like to know if there is any way to set up a miner node that will parse and pass along more than just the 'indicator' from the source feed. Specifically, some source feeds contain more information along with each indicator such as ASN info and country codes.
An example of a prototype config that I believe is parsing these additional fields is the dshield.block prototype found at: https://github.com/PaloAltoNetworks/minemeld-node-prototypes/blob/master/prototypes/dshield.yml
It seems like these columns are being parsed as 'fields' in the dshield.block prototype but I can't figure out how to include them in an output request such as: http//minemeld.instance/output/node/path?v=csv&f=indicator&f=dshield_name
Are these additional fields possibly being dropped by nodes whose prototype only passes along the 'indicator'? If so, is there a way I can tweak the prototype to pass along these fields?
Solved! Go to Solution.
one of the nice feature of MineMeld is its internal flexible schema for representing indicators. Using this schema the Miners can capture all the context originally provided by the feed and translate it into additional attributes in the indicator.
If you don't see the field in the feed output, please make sure the output feed node is based on one of the stdlib.feed*WithValue. Output nodes based on these prototypes save both the indicator and the full list of attributes in the feed, by default instead output nodes based on stdlib.feed* keep only the indicators to save memory.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!
The Live Community thanks you for your participation!