trying to mine a json file

[AndyC_234]

so the json looks like this:

{"ip":["104.129.193.65","104.129.195.65","104.129.197.65","104.129.193.103","104.129.195.103","104.129.197.103"]} 

 this is my prototype

age_out:
default: null
interval: 257
sudden_death: true
attributes:
confidence: 100
share_level: green
type: IPv4
extractor: ip
indicator: null
prefix: zs
source_name: zscaler
url: https://ips.zscaler.net/pac/json

but it's showing 0 indicators... any thoughts?

[StefanvH]

Can someone of the community please help I have an exact similar issue except it is from an Infoblox feed.

https://infoblox-whitelist.s3.amazonaws.com/infoblox-ip-whitelist.json

However the json structure looks the same.

I have tried several things and ended up with this but still it keeps emtpy

age_out

• default: null

• interval: 257

• sudden_death: true

attributes

• confidence: 100

• share_level: green

• type: IPv4

extractor: '[]'
fields: ','

indicator: '"'

source_name: Infoblox.AWS.S3

url: https://infoblox-whitelist.s3.amazonaws.com/infoblox-ip-whitelist.json