Is there currently a prototype miner that can be configured and used to pull from a generic API?
My example is Infoblox, but I can see this working with multiple infrastructure tools. I'm working with both AutoFocus-hosted Minemeld, and the stand-alone VM.
Thanks!
-Chris
Hi @chmotley,
MineMeld can grab indicators from generic API provided that the following conditions are met:
If one of the conditions is not met, then a custom node (miner) must be coded.
I too wish to add a generic API.
what class would I use? I have tried several. I see where I can enter username/token but not sure where to add the actual url to grab json file.
THIS IS NOT WORKING: class: minemeld.ft.anomali.Intelligence
here is my config
description: >
Threat Intelligence
url: https://digital.black.com/exports/download/Palo-Alto-5a9ea59994e78.json
prototypes:
blackwired:
author: Jason
development_status: EXPERIMENTAL
node_type: miner
indicator_types: [ URL, IPv4, ]
tags:
- ConfidenceHigh
- ConfidenceLow
- ConfidenceMedium
- ShareLevelRed
description: >
Miner for careI. You need a valid API Key
to use this Miner.
class: minemeld.ft.anomali.Intelligence
config:
age_out:
default: 90d
sudden_death: true
interval: 3307
attributes:
share_level: red
confidence: 30
Hi @jsamide,
how does your content looks like?
@jsamide SimpleJSON supports username/password (basic auth) but it is not a requirement.
I will try that out now
getting Error in Commit: Bad request
my file:
description: >
Threat Intelligence
url: https://digital.wired.com
prototypes:
blackwired:
author: Sam
development_status: EXPERIMENTAL
node_type: miner
indicator_types: [ URL, IPv4, ]
tags:
- ConfidenceHigh
- ConfidenceLow
- ConfidenceMedium
- ShareLevelRed
description: >
Miner for careI. You need a valid API Key
to use this Miner.
class: minemeld.ft.json.SimpleJSON
config:
url: https://digital.black.com/exports/download/Palo-Alto-5a9ea59994e78.json
age_out:
default: 90d
sudden_death: true
interval: 3307
attributes:
share_level: red
confidence: 30
@jsamide, your miner configuration lacks class configuration parameters like extractor, indicator and fields.
I can help you with the class configuration (JMESPath expression indicator extractor) but you should share with us an example of the content that you want to mine.
I am trying to grab a json file that contains IPv and URL so would it look something like:
extractor: "badIP"
prefix: NOT SURE WHAT THIS POINTS TO
indicator: ip_prefix
fields:
- IP
- URL
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!