Forward AutoFocus Indicators to MineMeld

• Use an AutoFocus Samples Miner to forward Indicators from sample search results.
  1. Verify that MineMeld is running (see Start, Stop, and Reset MineMeld).
  2. Work with the Search Editor to set up a search.
  3. Create MineMeld Miner (
     ) from the search page.
     The node details include:

     1. Name—Give the miner a descriptive name.
     2. Prototype—The prototype is pre-selected (autofocus.samplesMiner).
     3. Query—This field is pre-populated with the conditions of your search.
     4. Scope—Select the scope of the search results: global, private, and public.
     5. Artifacts—Select which indicators AutoFocus will forward to MineMeld: Any indicators, only indicators that match MineMeld indicators, or None (MineMeld only extracts hashes from the sample search results).
     6. Connect to Processors—Select processors that will receive indicators from the miner.
        If you select a Scope of global, the miner extracts indicators from your private samples and public samples from you and other AutoFocus users; it does not extract indicators from other users’ private samples.
  4. Connect MineMeld Nodes (processor and output) to the miner you just created.
• Use an AutoFocus Indicator Store Miner to forward indicators from external sources stored in AutoFocus (see Manage Threat Indicators) to a destination outside of AutoFocus.
  1. Verify that MineMeld is running (see Start, Stop, and Reset MineMeld).
  2. Click Indicators on the navigation pane and optionally, Filter the indicators.
  3. Create MineMeld Miner (
     ).
     The node details include:

     1. Name—Give the miner a descriptive name.
     2. Prototype—The prototype is pre-selected (autofocus.indicatorStoreMiner).
     3. Query—If you filtered the indicators, this field is pre-populated with the filter you used.
     4. Connect to Processors—Select processors that will receive indicators from the miner.
  4. Connect MineMeld Nodes (processor and output) to the miner you just created.
• Use an AutoFocus Export List Miner to forward indicators from an AutoFocus export list.
  You can use the AutoFocus export list miner in AutoFocus-hosted MineMeld or in a MineMeld instance you deployed in your own environment. The default behavior of the miner is the same in either version of MineMeld.
  1. Verify that MineMeld is running (see Start, Stop, and Reset MineMeld).
  2. Create a Minemeld Node based on the prototype autofocus.exportList.
     When completing the additional required fields for the node, provide your AutoFocus API Key and the Label of the export list from which MineMeld will extract indicators.