How to add feed for github IPs?

Reply
Highlighted
L4 Transporter

How to add feed for github IPs?

Little confused on how I actually do this. I want a list generated on minemeld from the following page: https://api.github.com/meta

 

How do I go about making it so that list is referenced via a policy to allow github APP to that list of IPs?  I am already using minemeld for o365 but that was canned and this isn't.  Appreciate any help anyone can provide.

 

Thanks 

Highlighted
L1 Bithead

Re: How to add feed for github IPs?

not sure if you find the solution. here is the setup for the miner

KasiWong_0-1580747152916.png

 

Highlighted
L4 Transporter

Re: How to add feed for github IPs?

Thanks man, will configure and let you know how it goes.

 

 

L4 Transporter

Re: How to add feed for github IPs?

Did you manually add that or import it?  If manually can you copy/paste the syntax used to create it?  I tried to create a new miner using those same settings but it won't let me save it and I am not sure why. IE the OK box has a red circle with a line through it so I am doing something wrong.  

 

miner-github.png

Highlighted
L1 Bithead

Re: How to add feed for github IPs?

here is the code: seems like missing single quote around the extractor.

extractor: '*[].{indicator:@}'
indicator: indicator
url: https://api.github.com/meta

Highlighted
L4 Transporter

Re: How to add feed for github IPs?

Thanks that worked.  

 

How do I get a FEED BASE URL configured for this?  The goal there is to reference the list of github IPs via an EDL.  

Highlighted
L1 Bithead

Re: How to add feed for github IPs?

then you create a regular IP aggregator:

stdlib.aggregatorIPv4Generic

then output: 

stdlib_feedHCGreenWithValue-IPv4

please refer to this thread: the idea is similar, his example is URL

https://live.paloaltonetworks.com/t5/Featured-Articles/Using-Custom-Indicators-with-MineMeld/ta-p/24...

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!