DROP_UPDATE

[eevarestus]

Hi,

I've just created a new node and I'm seeing events such us: DROP_UPDATE on aggregator type.  Does anybody have an idea of what could be the issue?

[xhoms]

Hi @eevarestus,

can you share the EMIT_UPDATE and DROP_UPDATE log details? The aggregator is refusing to accept the UPDATE messages and it will probably be related to its input filter configuration. Indicator Type? Share Level? Confidence?

[eevarestus]

Hi xhoms

Here is the files

[xhoms]

@eevarestus, do you mind sharing your "inboundaggregator" prototype config?

[eevarestus]

xhoms,

Here is the inboundaggregator config

[xhoms]

@eevarestus, it looks to me that you're facing the same configuration issue that @raji_toor rised in the discussion https://live.paloaltonetworks.com/t5/MineMeld-Discussions/Zero-indicators-in-inboundfeed/m-p/194991#...