PaloAltoNetworks / minemeld

Main MineMeld documentation repo
379 stars 64 forks source link

Age out issue with stdlib.localDB miner #54

Open cam7 opened 3 years ago

cam7 commented 3 years ago

Describe the bug

Unexpected behavior for aging out an indicator using stdlib.localDB miner

Possible solution

I would need to publish an indicator almost immediately after it is inserted into the list, and age out this indicator quickly after it is manually deleted from the indicators list.

Potentially apply the parameters described here : https://live.paloaltonetworks.com/t5/minemeld-articles/configuring-nodes/ta-p/77185

Steps to reproduce

Current miner prototype configuration described in screenshot below. Logs provided also show that the indicator is automatically aged out 20 seconds after its insertion, which should not be the case as default parameter from the age out policy is set to null.

Screenshots

image

image

Context

Running Minemeld version 0.9.70 on Ubuntu 16.04 LTS