Custom search filters for Anomali

[otlaP5]

Hello,

Is it possible to configure the Anomali miner to allow for custom queries? For example, in threatstream, I like to search for the following string in Analyze -> Observables. How can I configure the anomali.opticAPI miner to allow for this?

 ((type=ip and confidence >= 60 and itype!=scan_ip) or (type=url and confidence>=78 and severity!=low)) and modified_ts>=10d

[lmori]

Yes, but today you have to modify the prototype and add a new field query in the config section with the query you are interested in.