Prototype to pass additional 'fields'

[nickd5]

Hi, new user here trying out a local instance of minemeld.

I would like to know if there is any way to set up a miner node that will parse and pass along more than just the 'indicator' from the source feed. Specifically, some source feeds contain more information along with each indicator such as ASN info and country codes.

An example of a prototype config that I believe is parsing these additional fields is the dshield.block prototype found at: https://github.com/PaloAltoNetworks/minemeld-node-prototypes/blob/master/prototypes/dshield.yml

It seems like these columns are being parsed as 'fields' in the dshield.block prototype but I can't figure out how to include them in an output request such as: http//minemeld.instance/output/node/path?v=csv&f=indicator&f=dshield_name

Are these additional fields possibly being dropped by nodes whose prototype only passes along the 'indicator'? If so, is there a way I can tweak the prototype to pass along these fields?

Thanks!

[lmori · Accepted solution]

Hi @nickd5,

one of the nice feature of MineMeld is its internal flexible schema for representing indicators. Using this schema the Miners can capture all the context originally provided by the feed and translate it into additional attributes in the indicator.

If you don't see the field in the feed output, please make sure the output feed node is based on one of the stdlib.feed*WithValue. Output nodes based on these prototypes save both the indicator and the full list of attributes in the feed, by default instead output nodes based on stdlib.feed* keep only the indicators to save memory.