8000 plugins:Tagger · newdominic/moloch Wiki · GitHub
[go: up one dir, main page]
Skip to content

plugins:Tagger

Jump to bottom Edit New page
Maddalena, Art edited this page Sep 23, 2016 · 2 revisions

plugins:Tagger HOWTO

The Tagger plugin allows you to automatically assign tags when certain content matches the item in the tagfile.

Tagging by five types of data is currently possible:

  • IP address
  • Host(name)
  • md5
  • email (fields)
  • uri (fields).

To get started you will need to uncomment tagger.so plugin in config file.

Next, prepare and upload your tagger files.

  • Place your IPs into iptagdata
  • Hosts into hosttagdata
  • md5s into md5tagdata
  • email fields into emailtagdata
  • uri fields into uritagdata

Once done, you should be able to upload content with taggerUpload.pl script:

./capture/plugins/taggerUpload.pl localhost:9200 ip iptagdata tag tag .. tag
./capture/plugins/taggerUpload.pl localhost:9200 host hosttagdata tag ..
./capture/plugins/taggerUpload.pl localhost:9200 md5 md5tagdata tag
./capture/plugins/taggerUpload.pl localhost:9200 email emailtagdata tag
./capture/plugins/taggerUpload.pl localhost:9200 uri uritagdata tag```


The simplest version of the Tagger file format is a list of items; one item per line. Advanced format parameters are also supported. Please see [[TaggerFormat]] for details.

Moloch Wiki

Add a custom sidebar

Clone this wiki locally
0