Talos Blacklist

[Hal_Blum]

I am trying to create a miner/processor/output nodes for the talos black list ( https://talosintelligence.com/documents/ip-blacklist ) and am failing. Has anyone got this to work?

[xhoms]

@Hal_Blum : Just create and consume a new prototype based on the HttpFT class. You can use, for instance, the prototype "openbl.base" as the base for the new prototype.

[iThreatHunt]

I use this config for blacklsit ip only