https://live.paloaltonetworks.com/t5/featured-articles/using-custom-indicators-with-minemeld/ta-p/241043 <P><EM><STRONG>Note:&nbsp;Palo Alto Networks made an <FONT color="#FF6600">end-of-life announcement about the&nbsp;MineMeld</FONT>™ application in AutoFocus™&nbsp;on August 1, 2021. Please <A href="https://live.paloaltonetworks.com/t5/blogs/minemeld-end-of-life-announcement/ba-p/419392" target="_self">read this article</A> to learn about our&nbsp;recommended migration options.</STRONG></EM></P> <HR /> <H1>Introduction</H1> <P>This document provides an example of how to configure a custom miner in MineMeld in order to track custom IoCs. The miner can be configured to track IP addresses, domains, or URLs. The indicators can&nbsp;adapt to the Palo Alto Networks firewall for use within various policies.</P> <P>&nbsp;</P> <P>Use Case Diagram</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Picture1.png" style="width: 800px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/17643i4401774129EE0729/image-size/large/is-moderation-mode/true?v=v2&amp;px=999" role="button" title="Picture1.png" alt="Picture1.png" /></span></P> <H1><A name="_Toc530677635" target="_blank"></A>Configuration</H1> <H2><A name="_Toc530677636" target="_blank"></A>MineMeld</H2> <P>&nbsp;</P> <P>The first step is to create a new miner using the <STRONG>stdlibListURLGeneric</STRONG> protoype.</P> <P>&nbsp;</P> <P>Go to the&nbsp;CONFIG area.</P> <P>&nbsp;</P> <P>&nbsp;</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Picture2.png" style="width: 677px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/17642i246D73AE6DF632FB/image-size/large/is-moderation-mode/true?v=v2&amp;px=999" role="button" title="Picture2.png" alt="Picture2.png" /></span></P> <P>&nbsp;</P> <P>Click on the “eye” icon in the lower&nbsp;left to change to expert mode. Once in expert mode, a plus icon will appear on the right, allowing you to add a MineMeld node.</P> <P>&nbsp;</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Picture3.png" style="width: 800px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/17641iC5A4F71232924C0B/image-size/large/is-moderation-mode/true?v=v2&amp;px=999" role="button" title="Picture3.png" alt="Picture3.png" /></span></P> <P>&nbsp;</P> <P>Select the plus sign and&nbsp;create a name for the new node. Prepend the name with the letters "wl" (for whitelist&nbsp;– although, the list can be used for positive or negative security purposes). From the PROTOTYPE drop-down, select <STRONG>stdlibListURLGeneric</STRONG>. In this example, I will show you how to create a URL miner to keep track of custom URL-based IoCs.</P> <P>&nbsp;</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Picture4.png" style="width: 800px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/17644i095E9DFBFD5E8AB9/image-size/large/is-moderation-mode/true?v=v2&amp;px=999" role="button" title="Picture4.png" alt="Picture4.png" /></span></P> <P>&nbsp;</P> <P>Select OK to save the new miner node.</P> <P>&nbsp;</P> <P>You should see the miner in the list.</P> <P>&nbsp;</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Picture5.png" style="width: 800px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/17645i1EEDE93A1FE634CD/image-size/large/is-moderation-mode/true?v=v2&amp;px=999" role="button" title="Picture5.png" alt="Picture5.png" /></span></P> <P>&nbsp;</P> <P>Next, create the Output node. This node will use the miner you just created and publish it to MineMeld’s internal web server, so the firewall can read the list and use it in various policies.</P> <P>&nbsp;</P> <P>From the CONFIG&nbsp;area, select the icon to see the prototypes. In the search field, look for “OUTPUT.” Find one similar to what you want your output to look like. In this example, I used <STRONG>stdlib.HCREDWithValue</STRONG>. Select the prototype and click&nbsp;“New” to create a new output based on the one selected.</P> <P>&nbsp;</P> <P>Give it a name, and&nbsp;you may also edit the CONFIG portion.</P> <P>&nbsp;</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Picture6.png" style="width: 800px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/17647iBC5130E3AA1FCB5A/image-size/large/is-moderation-mode/true?v=v2&amp;px=999" role="button" title="Picture6.png" alt="Picture6.png" /></span></P> <P>&nbsp;</P> <P>Go back to CONFIG, enter expert mode, and&nbsp;click the plus&nbsp;icon to create a new output node based on the prototype you just created. Give it a name and select the output prototype in the dropdown. For the input, select the custom miner node previously created.</P> <P>&nbsp;</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Picture7.png" style="width: 800px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/17646i85DCFE9427CBA9DB/image-size/large/is-moderation-mode/true?v=v2&amp;px=999" role="button" title="Picture7.png" alt="Picture7.png" /></span></P> <P>&nbsp;</P> <P>Select OK to save.</P> <P>&nbsp;</P> <P>You should see both of the custom nodes created.</P> <P>&nbsp;</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Picture8.png" style="width: 800px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/17648i6B4AC55B37CEFDA5/image-size/large/is-moderation-mode/true?v=v2&amp;px=999" role="button" title="Picture8.png" alt="Picture8.png" /></span><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Picture9.png" style="width: 800px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/17649i03FFC014F8C0A8EB/image-size/large/is-moderation-mode/true?v=v2&amp;px=999" role="button" title="Picture9.png" alt="Picture9.png" /></span></P> <P>&nbsp;</P> <P>When you're ready, select <STRONG>COMMIT</STRONG> in the upper left-hand corner to save the nodes and put them to work. Wait for the relevant services to be stopped and restarted before continuing. Watch the upper right-hand corner for status messages.&nbsp;</P> <P>&nbsp;</P> <P>To use the list, go to nodes and select <STRONG>+ADD INDICATOR</STRONG> in the upper right-hand corner.</P> <P>&nbsp;</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Picture10.png" style="width: 679px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/17650iC44EA545575B215B/image-size/large/is-moderation-mode/true?v=v2&amp;px=999" role="button" title="Picture10.png" alt="Picture10.png" /></span></P> <P>&nbsp;</P> <P>&nbsp;</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Picture11.png" style="width: 474px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/17651i5A8384A5FCFFA27B/image-size/large/is-moderation-mode/true?v=v2&amp;px=999" role="button" title="Picture11.png" alt="Picture11.png" /></span></P> <P>&nbsp;</P> <P>Fill in the fields and click OK. In my case, I am adding the URL indicator, <EM><A href="http://example.com" target="_blank" rel="noopener">http://example.com</A></EM>. You can change the&nbsp;SHARE LEVEL by clicking the level until the one you want appears. Adding a comment is a helpful reminder as to why the indicator was added.&nbsp;</P> <P>&nbsp;</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Picture12.png" style="width: 800px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/17652iEE6CCAC8F41CE58F/image-size/large/is-moderation-mode/true?v=v2&amp;px=999" role="button" title="Picture12.png" alt="Picture12.png" /></span></P> <P>&nbsp;</P> <P>Click the&nbsp;OUTPUT node you created and notice the FEED BASE URL link. You can open the link to see the published list that the firewall will read.</P> <P>&nbsp;</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Picture13.png" style="width: 800px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/17653iC5C4DC7E69C5824C/image-size/large/is-moderation-mode/true?v=v2&amp;px=999" role="button" title="Picture13.png" alt="Picture13.png" /></span></P> <P>&nbsp;</P> <P>&nbsp;</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Picture14.png" style="width: 800px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/17654iD6C9C872F2EDC926/image-size/large/is-moderation-mode/true?v=v2&amp;px=999" role="button" title="Picture14.png" alt="Picture14.png" /></span><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Picture15.png" style="width: 800px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/17655i0EC3153425CF7239/image-size/large/is-moderation-mode/true?v=v2&amp;px=999" role="button" title="Picture15.png" alt="Picture15.png" /></span></P> <P>&nbsp;</P> <P>To manage your custom IoCs, select Nodes and the URL miner created. Click on the <I>INDICATOR</I>&nbsp;icon to see the list. Here, you can delete entries and change the&nbsp;SHARE LEVEL or COMMENTS.</P> <P>&nbsp;</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Picture16.png" style="width: 800px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/17656iA0E745CC5100E175/image-size/large/is-moderation-mode/true?v=v2&amp;px=999" role="button" title="Picture16.png" alt="Picture16.png" /></span></P> <P>&nbsp;</P> <P>The list is now ready to be consumed by the firewall.</P> <P>&nbsp;</P> <H2><A name="_Toc530677637" target="_blank"></A>Firewall</H2> <P>&nbsp;</P> <P>To use the list within your Palo Alto Networks firewall, go to Objects &gt; External Dynamic Lists and select the Add button in the lower left-hand portion of the screen.</P> <P>&nbsp;</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Picture17.png" style="width: 258px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/17657iF757068511FE4A0A/image-size/large/is-moderation-mode/true?v=v2&amp;px=999" role="button" title="Picture17.png" alt="Picture17.png" /></span></P> <P>&nbsp;</P> <P>For Type, select the appropriate type for the node type created in MineMeld (URL List in this case). Copy the FEED BASE URL from MineMeld and paste it into Source. To test it, click the <STRONG>Test Source URL</STRONG> button.</P> <P>&nbsp;</P> <P>Notice the additional string <EM>“?v=panosurl”</EM> at the end of the MineMeld URL. This is a MineMeld option parameter&nbsp;that causes MineMeld to deliver the list in a format that is understandable to the Palo Alto Networks firewall. For example, it will strip out HTTP:// and HTTPS:// for each entry since this type of prepended data is not allowed by the firewall.</P> <P>&nbsp;</P> <P>See a full list of MineMeld parameters here: <SPAN><A href="https://live.paloaltonetworks.com/t5/MineMeld-Articles/Parameters-for-the-output-feeds/ta-p/146170" target="_blank">https://live.paloaltonetworks.com/t5/MineMeld-Articles/Parameters-for-the-output-feeds/ta-p/146170</A></SPAN></P> <P>&nbsp;</P> <P>Click OK to save.</P> <P>&nbsp;</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Picture18.png" style="width: 800px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/17658i252FCE6F836A18F4/image-size/large/is-moderation-mode/true?v=v2&amp;px=999" role="button" title="Picture18.png" alt="Picture18.png" /></span></P> <P>&nbsp;</P> <P>The final step is to use the EDL within a policy. In this example, we can create a Security Policy to block traffic&nbsp;desinated to any site within the list. Go to Policies &gt; Security and add a new rule (or modify an existing rule) where you want the policy to take effect.</P> <P>&nbsp;</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Picture19.png" style="width: 258px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/17659i0F318BF7A44AFDA0/image-size/large/is-moderation-mode/true?v=v2&amp;px=999" role="button" title="Picture19.png" alt="Picture19.png" /></span></P> <P>&nbsp;</P> <P>In the Destination tab, under Destination Address, click Add and select the EDL you just created.&nbsp;<STRONG>Commit</STRONG> the config to complete the addition.</P> <P>&nbsp;</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Picture20.png" style="width: 800px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/17660i2C96D097FBE76FAE/image-size/large/is-moderation-mode/true?v=v2&amp;px=999" role="button" title="Picture20.png" alt="Picture20.png" /></span></P> <P>&nbsp;</P> <P>&nbsp;</P> <H1><A name="_Toc530677638" target="_blank"></A>Other Use Cases</H1> <P>There are other areas within the Palo Alto Networks firewall where External Dynamic Lists may be used.</P> <P>&nbsp;</P> <H2><A name="_Toc530677639" target="_blank"></A>NAT Policies</H2> <P>An EDL may be utilized within NAT policies in either Source or Destination Addresses.</P> <P>&nbsp;</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Picture21.png" style="width: 800px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/17661i5A04786CFEA1B72B/image-size/large/is-moderation-mode/true?v=v2&amp;px=999" role="button" title="Picture21.png" alt="Picture21.png" /></span></P> <P>&nbsp;</P> <H2><A name="_Toc530677640" target="_blank"></A>QoS Policies</H2> <P>Use an EDL as a Source or Destination Address within a QoS policy.</P> <P>&nbsp;</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Picture22.png" style="width: 800px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/17662i26334935C8D4DE3D/image-size/large/is-moderation-mode/true?v=v2&amp;px=999" role="button" title="Picture22.png" alt="Picture22.png" /></span></P> <P>&nbsp;</P> <H2><A name="_Toc530677641" target="_blank"></A>Policy Based Forwarding Rules</H2> <P>Use an EDL as a Source or Destination Address within a Policy Based Forwarding Rule.</P> <P>&nbsp;</P> <P>&nbsp;</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Picture23.png" style="width: 800px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/17663i07773323125AB0F8/image-size/large/is-moderation-mode/true?v=v2&amp;px=999" role="button" title="Picture23.png" alt="Picture23.png" /></span></P> <P>&nbsp;</P> <H2><A name="_Toc530677642" target="_blank"></A>Decryption Policies</H2> <P>Use an EDL as a Source or Destination Address within a Decryption Policy.</P> <P>&nbsp;</P> <P>&nbsp;</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Picture24.png" style="width: 800px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/17664iE1CC53475694B1AA/image-size/large/is-moderation-mode/true?v=v2&amp;px=999" role="button" title="Picture24.png" alt="Picture24.png" /></span></P> <P>&nbsp;</P> <H2><A name="_Toc530677643" target="_blank"></A><SPAN>Other Policies</SPAN></H2> <P>Other policies in which an EDL may be used as a Source or Destination (or both) Address:</P> <UL> <LI>Tunnel Inspection</LI> <LI>Application Override</LI> <LI>Authentication</LI> <LI>DoS Protection</LI> </UL> <P>&nbsp;</P> <P>&nbsp;</P> <H1><A name="_Toc530677644" target="_blank"></A>Summary</H1> <P>Using MineMeld is a powerful and easy way to maintain your own threat feeds based on IP, URL, and Domain. Using these feeds in your security policy is as easy as pointing the firewall to the published list and referring to the list in one or more policies. There are many use cases for EDLs in both positive and negative enforcement scenarios. See the Live link below for additional ideas on incorporating EDLs with MineMeld into your enterprise security operations.</P> <P>&nbsp;</P> <P>To learn more about the free MineMeld tool:</P> <P><SPAN><A href="https://live.paloaltonetworks.com/t5/MineMeld/ct-p/MineMeld" target="_blank">https://live.paloaltonetworks.com/t5/MineMeld/ct-p/MineMeld</A></SPAN></P> <P>&nbsp;</P> <P>To learn more about External Dynamic Lists:</P> <P><SPAN><A href="https://www.paloaltonetworks.com/documentation/81/pan-os/pan-os/policy/use-an-external-dynamic-list-in-policy/external-dynamic-list" target="_blank">https://www.paloaltonetworks.com/documentation/81/pan-os/pan-os/policy/use-an-external-dynamic-list-in-policy/external-dynamic-list</A></SPAN></P> <P>&nbsp;</P> Tue, 14 Dec 2021 14:04:29 GMT kwall00 2021-12-14T14:04:29Z https://live.paloaltonetworks.com/t5/featured-articles/using-custom-indicators-with-minemeld/ta-p/241043 <P>Need a way to feed your own IOC's into MineMeld to be consumed by a Palo Alto Networks firewall? Here's a step-by-step guide.</P> Tue, 14 Dec 2021 14:04:29 GMT https://live.paloaltonetworks.com/t5/featured-articles/using-custom-indicators-with-minemeld/ta-p/241043 kwall00 2021-12-14T14:04:29Z https://live.paloaltonetworks.com/t5/featured-articles/using-custom-indicators-with-minemeld/tac-p/448429#M32 <P>If I can use "wl" for the whitelist, is there also an option for a custom blacklist?&nbsp; If I can add URLs or IPs to a custom whitelist, I'd also like the ability to have a custom blacklist as well.&nbsp; Is this possible, like using "bl" instead of "wl"?</P> Thu, 18 Nov 2021 16:19:21 GMT https://live.paloaltonetworks.com/t5/featured-articles/using-custom-indicators-with-minemeld/tac-p/448429#M32 Jack.Siergiej 2021-11-18T16:19:21Z