How to add feed for github IPs?

[drewdown]

Little confused on how I actually do this. I want a list generated on minemeld from the following page: https://api.github.com/meta

How do I go about making it so that list is referenced via a policy to allow github APP to that list of IPs?  I am already using minemeld for o365 but that was canned and this isn't.  Appreciate any help anyone can provide.

Thanks 

[KasiWong]

not sure if you find the solution. here is the setup for the miner

[drewdown]

Thanks man, will configure and let you know how it goes.

[drewdown]

Did you manually add that or import it?  If manually can you copy/paste the syntax used to create it?  I tried to create a new miner using those same settings but it won't let me save it and I am not sure why. IE the OK box has a red circle with a line through it so I am doing something wrong.  

[KasiWong]

here is the code: seems like missing single quote around the extractor.

extractor: '*[].{indicator:@}'
indicator: indicator
url: https://api.github.com/meta

[drewdown]

Thanks that worked.  

How do I get a FEED BASE URL configured for this?  The goal there is to reference the list of github IPs via an EDL.  

[KasiWong]

then you create a regular IP aggregator:

stdlib.aggregatorIPv4Generic

then output: 

stdlib_feedHCGreenWithValue-IPv4

please refer to this thread: the idea is similar, his example is URL

https://live.paloaltonetworks.com/t5/Featured-Articles/Using-Custom-Indicators-with-MineMeld/ta-p/24...