About harankumar_hk

Great @KevinAS   . Thanks again.    I am documenting the Minemeld integration and use cases with elastic search . Thinking to take it with Community via either blog post or Github.   You deserve a big credit for the Logstash configuration.    Let me know your interst and email ID.   would like to connect with you and add you for credits for the github/documentation.    I am available @  harankumar92@gmail.com   Regards, Haran ... View more

Hello @KevinAS   Great ! This is exactly my use case.  I have some cl;arification with below method.  what is  /usr/share/logstash/search-minemeld-src.json.  should i create a search-minemeld-src.json with below content . I went through documenattion and understood some basics. but  your explanation would be useful     Also  below filter.  Will this give the range or just take the indicator value as first IP - last Ip [only two IPs]   dissect { mapping => { "@indicator" => "%{firstIP}-%{lastIP}" }   Thanks, Haran ... View more

Thank you so much @KevinAS .   I Tried trimming the format in @indicator field.     I used Dissect mapping from logstash.  [ Thanks to logstash community for suggestions]   dissect { mapping => { "@indicator" => "%{@indicator}-%{}" } }   This gave me @indicator field with single CIDR format .  but I Think it wont convert range of IP into many CIDR on that range.   for example :  I think this trimming will give only  @indicator = 192.52.43.112 in the place of @indicator = 196.52.43.112-196.52.43.255.   I will try your python script alteration as well.  that makes more sense though complex.   here is my final Logstash config that trimmed the IP range into single IP CIDR.   input { tcp { port => 5514 } } filter { # Tag minemeld events if "@origin" in [message] { mutate { add_tag => "minemeld" } json { source => "message" } } #dissecting IPV4 into CIDR format if "IPv4" in [type] { dissect { mapping => { "@indicator" => "%{@indicator}-%{}" } } } } output { elasticsearch { hosts => "http://192.168.56.10:9200" index => "logstash-threatintel-%{+YYYY.MM.dd}" } } ... View more

You are awesom @KevinAS    - Thank you.  I am successfully getting minemeld IOC into elasticsearch.    can you help me with one more query.  Currently the indicators are getting parsed as range types.  how can we get it as a single IP range.   Is it something we can configure in minemeld  or is there a way to trim the indicator field in logstash ?    your help would be really useful.    ... View more

Thanks kev.   I deleted logstash output in minemeld and reconfigured.    But I get Unrecognized SSL message error while running logstash.  is it because that I configured self signed cert in minemeld server ?? can you help me fixing this.  ... View more

Hello Community - Can someone help me with my above query.  what is the best way used for getting minemeld data into elasticsearch.  ?  ... View more