Hello,
I'm using Minemeld 0.9.44 and I would to get 'range' from the URL https://ips.zscaler.net/cenr/json.
After several attempts with JSON prototype, trying to set different extractor, field (indicator set as range).
I'm still not able to get any information.
Could you please let me know what is the best what to extract 'range'?
Thank you
Regards
Solved! Go to Solution.
Hi @lvmh_onenetwork,
the following SimpleJSON based prototype works for me
age_out: default: null interval: 257 sudden_death: true attributes: confidence: 100 share_level: green type: IPv4 extractor: '"zscaler.net".*.*[][]' indicator: range prefix: zs source_name: zscaler url: https://ips.zscaler.net/cenr/json
Hello @xhoms
it works perfectly, but i'm not sure to understand the
'"zscaler.net".*.*[][]'
how does it works?
Regards
are you familiar with JMESPath expressions? Do you know the site http://jmespath.org/ ?
I highly recommend you to paste the JSON code from the ZSCALER URL into the JMESPath interactive test site to play with different expressions.
But, basically,
If you play in the interactive site you'll realize that "zscaler.net".*.* produces an array of continents containing each one of them an array of rages for each city.
The result is an array of ranges whose elements can be yielded into the MineMeld engine.
Thank you for the detail. I will study that.
Regards
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!
The Live Community thanks you for your participation!