Carbon Black Feed Not Showing Indicators in Report

ghost commented 4 years ago

Describe the bug

When using the v=carbonblack option to generate a feed into the correct format for Carbon Black Response no indicators are included from the output node. Tried with multiple output types and with feeds within only 5-10 indicators and feeds with 000's of indicators. None appear in the list.

Expected behavior

If I remove the v=carbonblack parameter I see a list of all the indicators are normal so assuming this feature has a bug.

Current behavior

As above.

Possible solution

Not sure.

Steps to reproduce

Create a output node that has some domains or IPv4 indicators
Browse to the node URL and append ?v=carbonblack to the URL
Scroll to bottom of page (past base64 encoded images) and look to see if anything is populated within theiocs { } section.

Screenshots

Context

Your Environment

Version used: 0.9.70
Environment name and version (e.g. Chrome 59, node.js 5.4, python 3.7.3): Docker Image (paloaltonetworks/minemeld:latest)
Operating System and version (desktop or mobile):

welcome[bot] commented 4 years ago

:tada: Thanks for opening your first issue here! Welcome to the community!

xhoms commented 4 years ago

Thanks @mpgough for reporting the issue. CarbonBlack output feed only supports IPv4, md5 and domain (not URL!) indicator types. Could you, please, double-check the indicators you're missing are of domain type instead of url?

ghost commented 4 years ago

Issues on my side. Please ignore.

PaloAltoNetworks / minemeld