Minemeld List or Miner for a static list of IPs/URLs

[chmotley]

Creating this post based on another thread. In a previous post's comment section, @spssspss asked "Is it possible to create a white list from an IPs address file?" and Luigi requested a new post be created for this functionality.. 

Can a list of IPs or URLs be hosted on MineMeld without the content actually being pulled from an external source?

Thanks!

-Chris

[xhoms · Accepted solution]

Hi @chmotley,

Yes. MineMeld can host indicators in a local database. The first approach was documented in Uploading list of indicators to MineMeld and supported by yaml files. Newer approach is based in a sqlite db, with an embeded aging engine and exposed via API. Implementation details in Using MineMeld as an Incident Response Platform

In summary, you need to add a "localDB" miner and upload the indicators to it using the script at https://gist.github.com/jtschichold/95f3906566b18b50cf2e3e1a44f1e785

[chmotley]

Thanks, Xavi!

I've added an FR (8269) to enable text-list functionality inside of MineMeld without the scripting requirements. Please feel free to review and vote!