If I have Malware appliance that is already calculating the hash of a
file, would there be a way to populate the system on a continual basis
similar to a feed and set it as a blacklist, therefore alerting when a
particular hash/md5 is identified? I u...
I would like to add a custom feed that focuses on URL as an indicator.
Using domain and mapping them to alias.host does not seem to be overly
beneficial as it creates a lot noise and triggers on potentially a
non-indicator. As I do not see URL as bei...
Hi There - I have a client that is using Internet routable addressing on
their private network (historical) and I'd like to change the
GeoLocation in NW 10 to reflect the organization rather then leveraging
default tagged country, organization, etc. ...
Hi There - I would like to either export a list or a report of "High
Confidence" malware events and there associated filenames. Does anyone
know of a way to do this? Thanks
I have recent deployment of NW Malware appliance and it is picking up an
unusually high number of High Confidence events. Some of the files it
has detected are in-house custom scripts or applications. Is there a way
to exclude these files from being ...
I must be doing something wrong. I have the latest http_lua_options
installed in its default state.I have also installed the parser to
concatenate meta values together to build the URL that Christopher
Ahearn wrote and provided to the community. I ha...
Okay thanks. I suppose where I'm stumped is trying to link the MD5/HASH
to additional added Meta values. Perhaps this is a limitation.
Ultimately I would like to import a list similar to a feed where the MD5
could then be a pointer to additional meta...
Thanks for the info. I do have my traffic defined for direction and that
appears to be working as required. I did add the line to GroPrivate.ipl
and unfortunately it does not look like it will allow an override of the
existing Maxmind data. I will ke...
