New Prototype - Spamhaus ASN-DROP List

[simonsigre]

Would be good to have a text or some for of list based data type so lists such as;
https://www.spamhaus.org/drop/asndrop.txt

Can be imported and parsed with regex such as;

(^.*)+(?=[\ ; ])...(..)+(?:.\|.)+(.*)

[jtschichold]

Would you use a new indicator type ASN for this?

[simonsigre]

@jtschichold absolutely, it would be great.
The field should support values in format "AS"+32bit.

[simonsigre]

@jtschichold any thoughts on when this may (or not) be available?

[jtschichold]

It shouldn't take long, may I just ask you how do you plan to consume it?

[simonsigre]

Not sure what you mean by consume ... the aggregated de-duped data from minemeld will be fed into SIEMS similar to that of other outputs .

[jtschichold]

Implemented, shipped in the next release

[simonsigre]

@jtschichold noticed the following (and it may be being pedantic);

"description": "Autonmous system (IPv4 and IPv6 only)"
https://github.com/PaloAltoNetworks/minemeld-core/blob/1cbbefa9705b80355ff6f6f639057e6b63b51c67/docs/schema-indicator-0-1.json#L72

Should this not read
Autonmous system 2 and 4 byte ASNs?

Also, as there is no standard for this as such;

1. 1221
2. AS1221
3. AS59206
4. AS135108 Enosys Solutions Pty Ltd

The miner or aggregator will need to know as the dedup function will fail and in some cases people might get bad matches if they implement 2-byte with a * AS1221* as this could match;

AS1221 Telstra Pty Ltd
AS12211 Operations & Compliance Network LLC
AS12212 Ravand Cybertech Inc.
...