Output node prototype that allows to specify file type (extension)

[MaHe]

We have product in place that requires the indicators to be in a text file and verifies if the file type extension is ".txt" ( --> e.g.  Pulling from https://ransomwaretracker.abuse.ch/downloads/CW_C2_URLBL.txt  diretly works but doesn't when pulling from Minemeld by using any standard EDL prototype --> ..feeds/feedHCWithValue-RSWT1 ). Does such a prototype exist or is there a workaround available?

[lmori]

May I know which product does this check?

One workaround would be configuring nginx to rewrite requests to /feeds/feedHCWithValue-RSWT1.txt to /feeds/feedHCWithValue-RSWT1

We could consider adding a feature to ignore the extension of a feed...

Luigi

[MaHe]

Hi Luigi, 

Good idea. Thanks for the workaround, I'll give it a try. It's the Cisco Firepower Management Center (without the Threat Intelligence Director). In the long run we might consider using the Threat Intelligence Director that supports STIX/TAXII. 

Martin