About austinrappeport

Is it possible to bulk upload to the LocalDB Nodes?  The input UI appears to only accept a single indicator per line, and doesn't do any validation of the information being input. ... View more

I am getting no indicators when I run an AutoFocus miner on an AutoFocus search to pull in the files my Firewalls submitted to Wildfire and did not block.  The query I'm running is:  {"operator":"all","children":[{"field":"sample.malware","operator":"is","value":1},{"field":"session.status","operator":"is not","value":"blocked"},{"field":"session.upload_src","operator":"is","value":"Firewall"}]}   However, when I run this in the AutoFocus search I get plenty of results.  See the attached screenshots for a comparison between the two.  I even tried to change the Prototype configuration to set the initial interval to an extremely long time, because some of the results are more than 24 hours old.  Still nothing pulls back results.   Any idea whats going wrong?  Can minemeld not properly run searches on AutoFocus session metatdata?  Is this some kind of bug or am I just missing something obvious.  Thanks for the help! ... View more

What are the typical system specs folks are using for their production MineMeld instances?  Are there any minimum system requirements documented anywhere?  Thanks for the help! ... View more