Change Intel framework to round-robin insertion events across proxies

This commit is contained in:
Jon Siwek 2018-05-24 14:35:25 -05:00
parent 45178f3051
commit fe478877c6
6 changed files with 119 additions and 1 deletions

View file

@ -0,0 +1,5 @@
new_item triggered for 1.2.3.4 by manager on manager-1
insert_item: 4.3.2.1 inserted by worker-2
new_item triggered for 4.3.2.1 by worker-2 on manager-1
insert_item: 123.123.123.123 inserted by worker-1
new_item triggered for 123.123.123.123 by worker-1 on manager-1

View file

@ -0,0 +1,10 @@
#separator \x09
#set_separator ,
#empty_field (empty)
#unset_field -
#path intel
#open 2018-02-27-17-03-26
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p seen.indicator seen.indicator_type seen.where seen.node matched sources fuid file_mime_type file_desc
#types time string addr port addr port string enum enum string set[enum] set[string] string string string
1519751006.478387 - - - - - 123.123.123.123 Intel::ADDR Intel::IN_ANYWHERE worker-2 Intel::ADDR worker-1 - - -
#close 2018-02-27-17-03-26

View file

@ -0,0 +1,4 @@
new_indicator: 1.2.3.4 inserted by manager
new_indicator: 4.3.2.1 inserted by worker-2
new_item triggered for 123.123.123.123 by worker-1 on worker-1
new_indicator: 123.123.123.123 inserted by worker-1

View file

@ -0,0 +1,5 @@
new_indicator: 1.2.3.4 inserted by manager
new_item triggered for 4.3.2.1 by worker-2 on worker-2
new_indicator: 4.3.2.1 inserted by worker-2
new_indicator: 123.123.123.123 inserted by worker-1
Doing a lookup