metron-docker/compose/hbase/conf/threatintel-extractor.json

{
  "config": {
    "columns": {
      "ip": 0
    },
    "indicator_column": "ip",
    "type" : "malicious_ip",
    "separator": ","
  },
  "extractor": "CSV"
}