MISP - Filter events/attributes

[acouceiro]

Hi all, 

First I'm going to explain the use case I'm working on.

I have the MISP integration working properly. Every day I download the new attributes and publish them in a list to be consumed later by different sources.

This is our configuration:

Now what I want to do is create another miner that feeds from the MISP but downloads only the attributes from a specific Creator org. I want to treat these events differently from others.

According to the documentation (https://github.com/PaloAltoNetworks/minemeld-misp) it seems that it can be done by adding the filter to the node:

I have tried the following configuration, but can't get it to work. When activated Minemeld remains in a corrupt state and is always in starting state. The configuration I have tried is:

Does anyone know if it is possible to filter the events based on the Creator Org?

Thank you in advance, 

Best regards.