MineMeld - there's gold in them thar hills!
summary
MineMeld ingests diverse threat feeds, normalizes and deduplicates them, and exposes ready-to-ingest outputs so security controls can consume fewer, cleaner indicators. It runs as a Docker image (or from source via Ansible), boots with default admin/minemeld credentials, and shows concrete counts — e.g., the ET Open miner pulls 1834 indicators and a Talos feed pulls 1266 indicators. Outputs support format conversion (append ?tr=1 for CIDR) and integrate directly into Palo Alto dynamic lists and URL/domain profiles.
AI-written summary · about
chapters (9)
- 0:00Intro
- 0:58Who am I
- 1:41What is MineMeld
- 2:34Use cases
- 4:44Installation
- 10:05System
- 13:31Prototypes
- 18:03Advanced use cases
- 21:52Statistics
related talks
31mFiltering the Noise: Crafting an Actionable Threat Feed from Community-Shared Intelligence
34mWhat Minesweeper Can Teach Us About Security
38mAdversary Detection Pipelines: Finally Making Your Threat Intel Useful
28mWhere Are All of the Container Breaches?
30mTrawling for IOCs: Catching C2 in a Sea of Data
29mDetection Engineering: Defending Networks with Purpose
21mRise of Coinminers
30mSpotting Threats with Elastic SIEM