URL White Listing

[netmaster_UC3M]

Hi all,

First of all, we are impressed about MineMeld, thanks Luigi for your ideas and work.

We have just started to play with MineMeld and wandering the format to whitelist domains and network ranges using stdlib.listURLGeneric (as wlURL)

We would like to allow web access to any host at 192.168.0.0/16 and any URL to *.somedomain.com

We tried several options, but only full match worked for us.

Is it possible to set up a regular expression or enable partial match on that white list.

Thanks in advance.

[lmori]

Hi netmaster_UC3M,

I am glad you are liking MM !

IPv4 Aggregator and URL/domains aggregator are different:

- IPv4 Aggregator understand the semantic of the IPv4 indicators and can be used to whitelist ranges, CIDR or unicast IPs. This means that if you send it an indicator like "10.0.0.0/8" as whitelist, the range 10.0.0.0-10.255.255.255 will be whitelisted. If a malicious indicator is partially overlapping that range, like 10.255.255.255-11.0.0.0, the overlapping part will be whitelisted and only the non-overlapping part will be send downstream - in this case 11.0.0.0.

- URL/domains aggregators are simpler and currently support only perfect match for whitelist and aggregation. I have plans to support wildcard or better regexs, but this is still in planning.

Hope this helps.

luigi