Miner for firehol

[chirss]

This one is fairly straight forward. Based on an ipv4 miner:

attributes:
confidence: 50
direction: inbound
share_level: green
type: IPv4
ignore_regex: ^#
source_name: firehol.blocklist_net_ua
url: https://raw.githubusercontent.com/firehol/blocklist-ipsets/master/blocklist_net_ua.ipset
user_agent: MineMeld

There are a ton of lists just under his blocklist ipsets:

https://github.com/firehol/blocklist-ipsets

I'm not sure if this is the right way to go about processing the data long term, but in the short term it looks handy.

[lmori]

Hi @chirss,

thanks ! did you find this list effective in your environment ?

Thanks,

luigi

[chirss]

Ya. But firehol has a ton of lists. It might be worth contacting them directly to see if they have a preferred way to grab the data than from github.