Minemeld not pulling low and medium confidence feeds?

[BobHarrison]

Hello,

My firewall is able to pull several feeds from our minemeld server. However, it is not pulling our Low and Medium Confidence inbound feeds. Worked with PA support and they said there must be something wrong with our Minemeld server and suggested I post a question here.

thanks!

[lmori]

Hi @BobHarrison,

could you share some more details like a screenshot of the NODES view ? Are there indicators in the MC and HC feeds ? What kind of indicators are we talking about ?

Thanks !

luigi

[BobHarrison]

thanks for your reply! Here is a screenshot. Note that the high confidence feed is working fine, but the mc and lc are not.

[lmori]

Hi @BobHarrison,

the reason is that both inboundfeedlc and inboundfeedmc are empty, see the first column where you see 0 on both rows.

If you could attach the full graph I could give you a better suggestion, but if you are using the default configs all the indicators are marked High Confidence - i.e. with the default configinboundfeedlc and inboundfeedmc feeds are never populated.

If you add new Miners you should indicators fall in those feeds as well, check the tags associated to each Miner to see what kind of confidence is associated to the indicators.

[BobHarrison]

Here is the full graph, is this what you were asking for? Not really sure how to add new miners.

[BobHarrison]

Didn't show up last time, trying again with graph:

[lmori]

Hi @BobHarrison,

could we have a screenshot of the graph ? Go to NODES, select one of the nodes and then click on the graph tab on the left.

Thanks !

luigi

[BobHarrison]

Thanks for all your help! Sorry, didn't get what graphs you meant at first. Here is one from the low confidence feed: 

[lmori]

Hi @BobHarrison,

I didn't make myself clear, sorry. I meant the node connection graph, one tab below the one you just posted (the tab with a sort of fat asterisk on it).

Thanks!

[BobHarrison]

[lmori]

Hi @BobHarrison,

the inboundfeecmc and inboundfeedhc are empty because all the Miners feeding those output nodes produce High Confidence indicators. 

luigi

[BobHarrison]

Thanks, Luigi, how do I fix that? Or is that just how it operates? 

[lmori]

Hi @BobHarrison,

this is expected:

- in your configuration all the Miners attached to the inboundaggregator feeding inboundfeedmc and inboundfeedlc are producing only High Confidence indicators

- as High Confidence indicators are collected per design only by inboundfeedhc, inboundfeedmc and inboundfeedlc are left empty

When you will attach more Miners to inboundfeedaggregator, you could see inboundfeedmc and inboundfeedlc populated if the new Miners produce also medium confidence and low confidence indicators.

[BobHarrison]

So I should just leave it this way? 

[lmori]

Yes, it's working as expected.