indicators and values

Reply
L2 Linker

indicators and values

 Hi,

   I noticed that when creating the '_process_item' code for a new miner, you generate data as an indicator, and a value.  I am able to generate an EDL with my code, but it looks like the values associated with the indicators are not present.  

 

Does anybody know what types of feeds you would need to create to see the values associated with their corresponding indicators?

L7 Applicator

Re: indicators and values

Hi @vb0398,

sorry for the late reply, you can click on LOGS in the top right corner of the Miner window to see all the indicators/values generatred by the Miner. See screenshots below.

MineMeld-1.png

 

Screen Shot 2017-06-19 at 14.29.58.png

 

To see the value in the feed you should:

  • use a prototype with name stdlib.feed*WithValue
  • in the URL of the feed, add the parameter to specify a format rendering the value - like v=json
L2 Linker

Re: indicators and values

hi @lmori - thanks for your reply..

   So I am using a prototype with name "stdlib.feedHCRedWithValue PROTOTYPE" 

 

 

As for the URL to download the feed, are you saying it would look like the following :

 

https://<minemeld_server>/feeds/<feed_output>&v=json

 

 

(I'm sure that's not it as I get an 'Unknown feed' message...)

 

thanks...

L7 Applicator

Re: indicators and values

Hi @vb0398,

you should use a URL like this:

https://<minemeld_server>/feeds/<feed_output>?v=json

 

(note the question mark instead of the &)

L2 Linker

Re: indicators and values

hi @lmori - 

   thanks - works great.

 

Ingesting this data into a Palo Alto device, I'm assuming the only way is via an EDL, and that would just be the standard/generic feed input (i.e., '<ip address start>-<ip address end>')  Is that correct?

L7 Applicator

Re: indicators and values

Hi @vb0398,

for ingesting with Palo Alto Networks NGFW you can use EDL format ("plain") or DAG output nodes.

EDL can be used for IPs (/32, ranges and CIDRs), URLs and domains.

DAG output node only for /32 IPs.

 

My suggestion for traditional feeds is using EDLs.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!