Page History

...

{

  ...

  ,"threatIntel" : {

            ...

           , "triageConfig" : {

                     "riskLevelRules" : {

                                 "exists(threatintels.hbaseThreatIntel.urldomain_without_subdomains.zeusList)" : 5

                               , "not(ENDS_WITH(urldomain_without_subdomains, '.com') or ENDS_WITH(urldomain_without_subdomains, '.net'))" : 10

                                        }

                     ,"aggregator" : "MAX"

                             }

                  }

}

In order to apply this triage configuration, we must modify the configuration for the squid sensor in the enrichment topology.  To do this, we should modify /usr/metron/0.1BETA/$METRON_HOME/config/zookeeper/sensors/squid.json on node1  However, since the configuration in zookeeper may have be out of sync with the configuration on disk, we must make sure they are in sync by executing the following command:

...

 We should ensure that the configuration for squid exists by checking out

TODO: the directory sensors is wrong. It shoudl be changed to enrichments. Also change field url to domain_without_subdomains

cat $METRON_HOME/config/zookeeper/sensorsenrichments/squid.json

Now we can edit the configuration.  In $METRON_HOME/config/zookeeper/sensorsenrichments/squid.json edit the section titled riskLevelRules and add the two rules above to the map:

• "exists(threatintels.hbaseThreatIntel.urldomain_without_subdomains.zeusList)" : 5

• "not(ENDS_WITH(urldomain_without_subdomains, '.com') or ENDS_WITH(urldomain_without_subdomains, '.net'))" : 10

Also, ensure that the aggregator field indicates MAX

...