CSV Feed Rolling Time

[annoyingapt]

trafficstars

Use case

Currently one of our devices which is pulling from an OpenCTI CSV feed is unable to append data to its existing feed, it wants to replace its own feed with what the CSV feed provides. Although it is fine if certain domains age out, we have a few hashes we want to keep pushing to the device.

Current Workaround

Currently I am using a high integer in the Rolling time (in minutes) field.

Proposed Solution

Have an optional tick box that allows for the max time allowed.