Prototype to pass additional 'fields'

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Prototype to pass additional 'fields'

L0 Member

Hi, new user here trying out a local instance of minemeld.

 

I would like to know if there is any way to set up a miner node that will parse and pass along more than just the 'indicator' from the source feed. Specifically, some source feeds contain more information along with each indicator such as ASN info and country codes.

 

An example of a prototype config that I believe is parsing these additional fields is the dshield.block prototype found at: https://github.com/PaloAltoNetworks/minemeld-node-prototypes/blob/master/prototypes/dshield.yml

 

It seems like these columns are being parsed as 'fields' in the dshield.block prototype but I can't figure out how to include them in an output request such as: http//minemeld.instance/output/node/path?v=csv&f=indicator&f=dshield_name

 

Are these additional fields possibly being dropped by nodes whose prototype only passes along the 'indicator'? If so, is there a way I can tweak the prototype to pass along these fields?

 

Thanks!

 

1 accepted solution

Accepted Solutions

L7 Applicator

Hi @nickd5,

one of the nice feature of MineMeld is its internal flexible schema for representing indicators. Using this schema the Miners can capture all the context originally provided by the feed and translate it into additional attributes in the indicator.

If you don't see the field in the feed output, please make sure the output feed node is based on one of the stdlib.feed*WithValue. Output nodes based on these prototypes save both the indicator and the full list of attributes in the feed, by default instead output nodes based on stdlib.feed* keep only the indicators to save memory.

View solution in original post

1 REPLY 1

L7 Applicator

Hi @nickd5,

one of the nice feature of MineMeld is its internal flexible schema for representing indicators. Using this schema the Miners can capture all the context originally provided by the feed and translate it into additional attributes in the indicator.

If you don't see the field in the feed output, please make sure the output feed node is based on one of the stdlib.feed*WithValue. Output nodes based on these prototypes save both the indicator and the full list of attributes in the feed, by default instead output nodes based on stdlib.feed* keep only the indicators to save memory.

  • 1 accepted solution
  • 3047 Views
  • 1 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!