I created a domain whitelist called wlDomains, a node based on stdlib.listDomainGeneric and added the whitelist to my domain aggregator. I then added the indicator "aol.com" (lowercase, without the quotes).
When I checked the feed for the output node though, it still listed "AOL.COM". I had to add an all uppercase entry to wlDomains in order for AOL.COM to be removed.
Is this expected?
you are right, this should be improved. But the best place is improving the aggregator to support case insensitive matches. I have created and ER to track this: https://github.com/PaloAltoNetworks/minemeld-core/issues/229
Coming back to this, I see the option was closed back in Sep, 2017, but I find that the DNS white list is still case sensitive (I white listed aol.com, the domain feed has AOL.COM, still in the feed as a suspicious domain).
Is it going to remain this way?
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The Live Community thanks you for your participation!