About shanu2405

Solved: The file nodes.json needs to be updated at /opt/minemeld/engine/core folder as well. Not sure why, but it doesn't work until I restart the system. ... View more

Thanks Luigi.   That was the issue. Commit fixed it. Coming to the Custom Prototype: I am trying to split the JSON feed of Azure IPs based on services/region/both. Here is what I tried which failed. I can’t remember exactly, but I think it was created from aws.AMAZON     minemeldlocal_ms_AzurePublicIP_JSON-AD:         class: minemeld.ft.json.SimpleJSON         config:             age_out:                 default: null                 interval: 257                 sudden_death: true             attributes:                 confidence: 100                 share_level: green                 type: IPv4             extractor: values[].properties.addressPrefixes[].{indicator:@}             infilters:                 actions: accept                 conditions: __method == 'withdraw' name_azure == 'AzureActiveDirectory'                 name: accept withdraws             prefix: azure             source_name: azure             url: https://www.microsoft.com/en-us/download/details.aspx?id=56519         description: all Azure ranges         development_status: STABLE         indicator_types:         - IPv4         node_type: miner         tags:         - ConfidenceHigh         - ShareLevelGreen    -------------------------------------- I found it worked for region in another post and tried similar conditions to accept indicators. It does work for region+service, but not for services alone.   Here is what I have created   Miner uses prototype: azure.cloudIPsWithServiceTags Processor uses: ------------ infilters: -   actions:     - accept     conditions:     - __method == 'withdraw'     name: accept withdraws -   actions:     - accept     conditions:     - type == 'IPv4'     - azure_id == 'AzureCloud.uksouth2'     name: accept IPv4 -   actions:     - drop     name: drop all   This seems to be working in most of the cases unless I filter services which have their names matching with other IDs (region based) – example: "id": "AzureActiveDirectory",  - 95 indicators "id": "AzureActiveDirectoryDomainServices", - 73 indicators   When such is the case, it keeps only unique values (22 indicators) and removes both values in case of a duplicate. I’m not really good with scripting. Is there a way we can make the condition attribute as exact match?   Thanks again for your help. ... View more