Minemeld: Custom IP list, miner etc for EDL.

Showing results for 
Show  only  | Search instead for 
Did you mean: 

Minemeld: Custom IP list, miner etc for EDL.

L3 Networker

I apologize if this has been answered in previous posts, I've tried searching and it seems that I'm getting bit and pieces but not the whole picture.  


How would I go about creating my own list of IPs and then customizing Minemeld to mine \ gather the IPs to be used in an EDL.  We have McKesson products and they recently send us a PDF with a large list of IPs and URLs that need to be allowed in order for their products to function.  I was thinking that in the long run it may be easier to create a custom list vs manually creating a security policy. 


L7 Applicator

Hi @rkoenig,

is the PDF public ? do they also provide the content in a more machine readable format ?



Hi Luigi, that is a good question, I have tried searching for the document they sent me but have been unable to find it.  I will check with McKesson support and validate if the document is public and if they provide the content in a machine readable format.

Is there a miner that can be specifically pointed somewhere- a generic miner?

Hi @Sec101,


you might want to give my article Using MineMeld to extract indicators from a generic API that introduces the JSON, HTTP and CSV miners that could be considered the "general purpose miners"

  • 4 replies
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!