CIF Local Feeds

[sametsazak]

I created a feed configuration file to add new threat intelligence feeds, i wrote regex patterns and it works well. But I want to add more malware IPs and urls. I have some text files, how can I export them to CIF? Is there a local storage in CIF?

[giovino]

You can put a local file path in the "remote" key within a cif-smrt config file. example

Process:

1. Write a cif-smrt config file (file.yml) to parse the data in the local text file
2. Do not put the config file into /etc/cif/rules/default unless this local text file will be updated hourly/daily by another process.
3. Manually process the text file with a command something similar to this:

sudo su - cif -c "/opt/cif/bin/cif-smrt -c -d -r /home/user/file.yml"

Does this answer your question?

[sametsazak]

Yeah, this is totally what I want to hear. Thank you.

[giovino]

yw