@ChrisIchelson
Ok I've looked over the SSLBL list. Since you are looking to pull this feed directly from SSLBL there is going to be a slight issue. The issue is that you need a column that contains what will be placed into the meta language key to reference when the feed gets a match. What this means is that you will probably need to write a small script that reaches out to the SSLBL csv, pulls it down, and then adds a new entry to the end of all the lines that are not comments. Here is an example of what I mean.
# Firstseen,DstIP,DstPort
2024-09-16 12:04:19,185.146.88.217,1024, SSLBL Blacklist
2024-09-13 19:50:40,147.45.44.107,443, SSLBL Blacklist
2024-09-13 11:37:46,63.141.252.2,3736, SSLBL Blacklist
2024-09-06 14:47:02,104.21.59.197,443, SSLBL Blacklist
2024-09-06 14:47:02,104.21.57.118,443, SSLBL Blacklist
As you can see I have added SSLBL Blacklist to the end of every line. This is what you will key off of when you do an Investigation, report, or run an alert rule. Without this in the CSV there would be no easy way to find the results of this feed. I guess you could use the port column but that could be extremely cryptic and you wouldn't know what actually caused the session to be tagged. Using a name like this allows for easier identification and filtering. If you want to pursue this method there are a few things you need to keep in mind:
1. There cannot be any blank spaces at the end of the line as this will cause the feed not to compile correctly.
2. There cannot be any blank lines in the CSV file, either at the beginning, between lines, or at the end. Otherwise the feed will not compile correctly.
3. Any line that starts with a # will be considered a comment and skipped. Comments can occur anywhere in the file.
So as long as you are able to pull the raw CSV file down and do the above manipulations and then have that CSV file somewhere that is accessible to the Admin server you can use the Custom Feed documentation provided earlier for creating the recurring feed. Here is a recap of those steps.
1. Feed type is CSV
2. Feed Task Type is Recurring
3. Name the feed something like SSLBL_Blacklist. Anything will do as this is just the label for the feed in the Feeds area and if you need to locate it on a decoder.
4. Set the URL to a web location that contains the modified CSV that the admin server can get to. Ex. https://internal.server/blacklist/modified.sslipblacklist.csv
5. Click Verify to make sure that the Admin server can reach the CSV file. If it can't then you'll need to determine why. If there is a HTTP proxy server in the way you'll need to check the Use Proxy checkbox and fill in the appropriate proxy information that the Admin server will need to use to reach the CSV.
6. Set how often you want the Admin server to refresh the feed under Recur Every
7. Click Next
8. Select all the decoders you want to have the feed or select the group that contains the decoders that will receive the feed.
9. Click Next
10. Now you have to define the columns that will make up the configuration of the feed. When this is combined with the CSV it tells the decoders how to use and read the contents of the CSV.
11. Type should be IP since the IP addresses are single IPs. If the addresses were in CIDR notation then you would set it to IP Range. Remember you cannot combine CIDR notation and non CIDR notation ip addresses in a single feed. So if you were using a primarily CIDR notated CSV you would have to set all single IP addresses to /32 to match the notation and allow it to compile correctly.
12. As you are using IP as the type you would not need to worry about the callback key. This is used only for Non IP feeds and represents the meta type of the index. By default when IP and IP range is selected it uses ip.src and ip.dst as the internal callback keys.
13. Index column should be set to the column that contains the IP address. In this case column 2. This will gray out that column header in the Define Values list below and there will be no drop down in the Key row.
14. Under the Define Values you should see a sample list from your CSV file. The column that has the added SSLBL Blacklist label that was added will need to have its Key set to the Meta Language Key you want the SSLBL Blacklist label to appear in. As an example you could set this to the alert Meta Language Key and when you investigated on Alert you would see SSLBL Blacklist tagged on any sessions where the ip.src or ip.dst matched the IP address in your CSV file. You can also use custom meta language keys here. Just make sure that any custom key you want to use is already fully setup in the system so it will show up in the drop down key list for the column you are using.
15. Click Next. This will take you to the Review area. Here you can confirm that everything looks the way you want and it is ready to compile and push to the decoders. If there is anything that doesn't look right you can use the back button to make changes. Once you hit finish it will compile and push the first run of the feed and then the Recur Every will take over from there.
You can confirm if the feed worked correctly by going to one of your decoder's explore page. Go under the decoder -> parser -> feeds folder if I remember correctly. You should see the feed name in there. There should be a stats node or something similar where you can see information about the feed. There should be a Values entry. The number in that entry should match up with the number of uncommented lines in your CSV file. This allows you to make sure that it compiled correctly. If there were any issues these numbers should not match up. If they don't, you'll need to review the CSV file to see if one of the situation I mentioned at the start happened concerning spaces.
You should be able to use this method for any custom feed you want, recurring or otherwise. The key is making sure you have a column that you can use as the entry for the meta language key that makes sense when it comes time to do your investigations or alerting.
I know there is a lot here but I hope this helps to clear up any uncertainty you may have had with the process.
