About jsamide

i created an empty file called 30-feeds-auth.yml and then used that command and it said 'command not found'   is there another step?  ... View more

after many attempts I did figure this out with authentication.   thank you for ALL your help.  ... View more

also, how do I add basic auth?  is that an indicator? share level? ... View more

so my data looks like this: [{"IP":"69.213.8.8","URL":null},{"IP":"139.59.97.137","URL":null},{"IP":"192.99.142.235","URL":null},{"IP":"58.222.39.154","URL":null},{"IP":"69.64.147.10","URL":null},{"IP":"45.122.138.238","URL":null},]   here is my config:           class : minemeld.ft.json.SimpleJSON         config :             source_name : zero.IP             url : https://digital.wired.com/exports/download/Palo-Alto-5a9ea59994e78.json             Extractor : IP             prefix : sc             indicator : IP             fields :                 -IP                 -URL   now I am not able to find my file in the list of configurations ... View more

for the JMESPath where and how do I define the extractor process?  Do I need to register this somewhere?  ... View more

I will be doing some light reading ... View more

I am trying to grab a json file that contains IPv and URL so would it look something like:     extractor: "badIP"             prefix: NOT SURE WHAT THIS POINTS TO             indicator: ip_prefix             fields:                 - IP                 - URL ... View more

getting Error in Commit: Bad request   my file: description: >     Threat Intelligence url: https://digital.wired.com prototypes:     blackwired:         author: Sam         development_status: EXPERIMENTAL         node_type: miner         indicator_types: [   URL, IPv4, ]         tags:             - ConfidenceHigh             - ConfidenceLow             - ConfidenceMedium             - ShareLevelRed         description: >             Miner for careI. You need a valid API Key             to use this Miner.         class: minemeld.ft.json.SimpleJSON         config:     url: https://digital.black.com/exports/download/Palo-Alto-5a9ea59994e78.json             age_out:                 default: 90d                 sudden_death: true                 interval: 3307             attributes:                 share_level: red                 confidence: 30 ... View more

I will try that out now ... View more

@xhoms does  the  minemeld.ft.json.SimpleJSON  class require a username/password? ... View more

I too wish to add a generic API.     HTTP/S based API  (CHECK) No or Basic Authentication (user + password) (CHECK) Single transaction (one call retrieves the whole indicator list – no pagination) (CHECK) Indicators are provided in plain, html, csv or json format. (CHECK) what class would I use?  I have tried several.  I see where I can enter username/token but not sure where to add the actual url to grab json file.   THIS IS NOT WORKING:  class: minemeld.ft.anomali.Intelligence   here is my config   description: >     Threat Intelligence url: https://digital.black.com/exports/download/Palo-Alto-5a9ea59994e78.json prototypes:     blackwired:         author: Jason         development_status: EXPERIMENTAL         node_type: miner         indicator_types: [   URL, IPv4, ]         tags:             - ConfidenceHigh             - ConfidenceLow             - ConfidenceMedium             - ShareLevelRed         description: >             Miner for careI. You need a valid API Key             to use this Miner.         class: minemeld.ft.anomali.Intelligence         config:             age_out:                 default: 90d                 sudden_death: true                 interval: 3307             attributes:                 share_level: red                 confidence: 30 ... View more