Zscaler and Minemeld v2

[lvmh_onenetwork]

Hello,

I'm trying to get simple data from https://ips.zscaler.net/pac/json. I tried to exploit the extractor with http://jmespath.org/ but really, I don't think I need an extractor here, just indicator "ip".

But it doesn't work :

age_out:
    default: null
    interval: 257
    sudden_death: true
attributes:
    confidence: 100
    share_level: green
    type: IPv4
indicator: ip
prefix: zs
source_name: zscaler
url: https://ips.zscaler.net/pac/json

Could you please help me solve this issue?

Thank you

Regards

[xhoms · Accepted solution]

Hi @lvmh_onenetwork,

in this case you need a JMESPath expression that converts a plain list of values into an array of objects.

Try this one:

age_out:
    default: null
    interval: 257
    sudden_death: true
attributes:
    confidence: 100
    share_level: green
    type: IPv4
extractor: 'ip[].{"indicator":@}'
prefix: zs
source_name: zscaler
url: https://ips.zscaler.net/pac/json

[xhoms · Accepted solution]

Hi @lvmh_onenetwork,

in this case you need a JMESPath expression that converts a plain list of values into an array of objects.

Try this one:

age_out:
    default: null
    interval: 257
    sudden_death: true
attributes:
    confidence: 100
    share_level: green
    type: IPv4
extractor: 'ip[].{"indicator":@}'
prefix: zs
source_name: zscaler
url: https://ips.zscaler.net/pac/json

[lvmh_onenetwork]

Hi,

Thanks again, it works perfectly!

I surely need to develop this aspect.

Regards