04-18-2016 07:09 AM
Dear,
I added the "malwaredomainlist.ip" as miner.
This is working (shows that it has mined about 1500 IPs), but when I add the miner input to a ipv4 or domain aggregator I do not get any output...
04-18-2016 07:59 AM
Dear mr.linus,
malwaredomainlist.ip generates IPv4 addresses only, that's the reason domain aggregator does not accept any of the generated indicators. If you check the prototype for stdlib.aggregatorDomain you will see the inbound filters applied to all the indicators. These filters accept WITHDRAWS and indicators with type domain. Evertyhing else is dropped.
The IPv4 aggregator instead should accept, but again it depends on the prototype you used to create the aggregator. malwaredomainlist.ip provides C2 IPs, and the indictors are marked as "outbound". Please, could you check that the IPv4 aggregator accepts "outbound" indicators ? You can look at the inbound filters inside the prototype.
It would be a good idea to add a new miner to poll the CSV file provided by malwaredomainlist instead of the IP list. I have created an ER (#8) to track this.
04-19-2016 01:29 AM
I am also working on a tracing function, to let the admin trace the flow of indicators across the graph. Should happen in a week or two.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
