Really good tool!

[jochristian]

Hi,

This is an really good tool for managing dynamic lists.
So far I have tested a basic setup and I have a few comments/suggestions.

* How do I change the ssl certificate for MineMeld.

* Will you also implement domain blocklists soons (currently running 7.1 beta).
* How about making our own miner. Information about this.
* Will you also support ipv6?

Just a few things that I thought of.

Thanks for this great tool. Looking forward to the development!

/Jo Christian

[lmori]

Thanks ! We are glad you like it !

1) cetificate and private key are stored in /etc/nginx/minemeld.cer and /etc/nginx/minemeld.pem. You can just replace them with your cert and private key and "sudo service nginx reload"

2) already supported. zeustracker.baddomains, autofocus.exportlist produce also domains. If you have a specific domain feed you are interested in, please let me know. If you look at the autofocus video, you can find instructions on how to add a new subgraph for handling domains (domain aggregator + output feeds)

https://live.paloaltonetworks.com/t5/MineMeld-Discussions/Video-MineMeld-on-AWS-amp-Autofocus-Export...

3) 2 ways to do this: writing your own prototype with a configuration of an existing miner class or write your own full miner, if the protocol or format of the feed is not supported yet by one of the existing miner classes. We are working on the documentation for both options. Stay tuned, at least for the first option it will be just a matter of days. Some users have already started contributing prototypes, but with the docs it will be much easier for everyone 🙂

4) IPv6 is already supported to some extent, there are still some glitches we are working on. A full IPv6 aggregator is in roadmap.

Thanks again,

Luigi

[jochristian]

Hi,

Thanks for your update.
I downloaded the ova file, and I noticed now that there are many updates for this Ubuntu image.
Could I get any problems updating the packages in Ubuntu outdated, with Minemeld?

/Jo Christian

[lmori]

Absolutely, you can also use Ubuntu mechanism to automatically install security updates:

http://askubuntu.com/questions/194/how-can-i-install-just-security-updates-from-the-command-line

[jochristian]

Perfect!

Regarding url/domain lists I have used this one in 7.1 beta. Looks good.

https://openphish.com/feed.txt  <-- URL feed

Maybe something to add to Minemeld?

/Jo Christian

[lmori]

Thanks ! I have just added the prototype to the library.

You will find a miner for it in the next release. It generates URL indicators.

[jochristian]

Nice! 🙂

BTW, I found openphish, and a few other feeds that I am testing on this webpage:

https://zeltser.com/malicious-ip-blocklists/
A few of them could be quite interesting to add to Minemeld.

/Jo Christian

[lmori]

Thanks, we will take a look at those.