cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Who Me Too'd this topic

How to filter O365 API feed?

L1 Bithead

I would like to filter for indicators with the category "allow" or "optimize" only. How would you define the filter for that? I cannot find that much information regarding filtering using a processor. I hope my steps are correct? 

  1. create a new prototype of the IPv4Generic processor
  2. create infilters for that
    infilters:
    -   actions:
        - accept
        conditions:
        - __method == 'withdraw'
        name: accept withdraws
    -   actions:
        - accept
        conditions:
        - o365_category == 'Allow'
        name: accept o365_categoryAllow
    - actions:
    - accept
    conditions:
    - o365_category == 'Optimize'
    name: accept o365_categoryOptimize - actions: - drop name: drop all
  3. create a processor node using the previously selfmade prototype
  4. set as input the o365 miner
  5. create a output / feed node using the HCGreenWithValue prototype & set as input the selfmade processor

Thanks a lot for your help!

Who Me Too'd this topic