topic find IoC already in Minemeld in Advanced Threat Prevention Discussions

find IoC already in Minemeld

petercvan — Sat, 04 Jul 2020 21:07:55 GMT

I have a miner set up in Minemeld, to which I can add IP addresses for blocking. I would like to find out if our Minemeld, or PA NGFW, is already blocking an IP address. How can I do that?

Thanks

Re: find IoC already in Minemeld

mivaldi — Mon, 06 Jul 2020 19:22:54 GMT

Use global-find, either in the WebUI (Search in the upper right) or in the CLI.

Example:

> request system external-list global-find string '192.64.11.244'

/config/predefined/ip-block-list/entry[@name='panw-highrisk-ip-list']