About SantiBT

So I've several issues with the web service, this service dies sometimes normally, I don't konw why...I'm researching about this but I don't see nothing. I think that a good solution is that (cron task) for example.     Thanks in advance ... View more

Great!   Thx ... View more

**bleep**!!!!   jajajajaja   Sorry, I'm stupid.   Thanks a lot!!! ... View more

Hi Imori,   Yes, is on aggregator processor, you can see over the logs:   2/3/2017 16:01:56 +0100 TEST-aggr-TEST DROP_UPDATE 0.0.0.0 confidence: 80share_level: redsources: ["test.ipsrc"]first_seen: 1488466915898type: ipv4last_seen: 1488466915898 source_node: TEST-IP-TEST   2/3/2017 16:01:56 +0100 TEST-aggr-TEST DROP_UPDATE 0.0.0.0 confidence: 80share_level: redsources: ["test.ipsrc"]first_seen: 1488466915898type: ipv4last_seen: 1488466915898 source_node: TEST-IP-TEST   My node is config so:   CLASS minemeld.ft.http.HttpFT INDICATOR TYPES IPv4IPv6 TAGS CONFIG attributes confidence: 80 share_level: red type: ipv4 delimeter # fieldnames indicator ignore_regex ^# interval 3600 source_name test.ipsrc url http://test.server.local/ip-test.txt My aggregator config is:   CLASS minemeld.ft.ipop.AggregateIPv4FT INDICATOR TYPES IPv4 TAGS None CONFIG infilters NAME CONDITIONS ACTIONS accept withdraws __method == 'withdraw' accept accept IPv4 type == 'IPv4' accept drop all drop whitelist_prefixes wl I'm seening prefectly the IP on my node but its impossible can see these IPs on the aggregator, I see this message "DROP_UPDATE" always.   Do you know why??     Thanks! ... View more

Of course! Tell me when and I'll check your mine!   Thanks a lot ... View more

Hi Lmori!!   Yes, I'm interesting in a miner for MISP!!!! it will be a great idea!!!!   Do you known that??????   Please, let me know if you need more info about this!!   Regards! ... View more

So I want to integrate MISP into Minemeld, I don't want to integrate Minemeld into MISP.   How I can integrate MISP into Minemeld??????   Regards! ... View more

Hi Kimwii   Do you refer about file config??? such us:   attributes: confidence: 80 share_level: green type: IPv4 delimiter: '#' fieldnames: - indicator interval: 3600 source_name: misp.reputation.ip-dst url: http://ip_myMisp/attributes/text/download/ip-dst add_url(event, url, category=’Network activity’, to_ids=True, comment=None, distribution=None, proposal=False)       is it so??????   Thx ... View more

Hi,   Do you know something sample about integration with MISP (Malware Information share platform)???   So another question is about scripts, can I launch a script into conifg a new prototype? If I've created a new prototype I set a url option...can I set the url option for script option????   Thanks a lot ... View more