@lmori @xhoms Hello, There are still unanswered questions regarding aging of indicators, as well as minemeld working output configuration. Can Minemeld function with “first_seen+2d” even if the indicator is still present in the feed? If “first_seen+2d” is accepted, and the miner pulls the feed again with the indicator still present what happens to the indicator? We are also trying to understand behaviors showing in our Minemeld instance such as: Miner node #1 has 7413 indicators Miner node #2 has 783 indicators Processor, with Miner node #1 and Miner node #2 as input, has 8196 indicators Output (minemeld.ft.redis.RedisSet) has 7413 indicators Same processor with different Output (minemeld.ft.taxii.DataFeed) and it currently has 587479 indicators – this number keeps on growing as indicators just keep getting added on until the next service restart. Any advice, guides or hints are much appreciated and thank you very much for your time and assistance.
... View more