<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: Miner to collect AWS IP (region and service) in General Topics</title>
    <link>https://live.paloaltonetworks.com/t5/general-topics/miner-to-collect-aws-ip-region-and-service/m-p/447288#M100671</link>
    <description>&lt;P&gt;Lmori, thank you for your response.&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;Do you know, is it possible to list multiple regions in the same filter? Such as,&lt;/P&gt;&lt;P&gt;infilters:&lt;BR /&gt;- actions:&lt;BR /&gt;- accept&lt;BR /&gt;conditions:&lt;BR /&gt;- __method == 'withdraw'&lt;BR /&gt;name: accept withdraws&lt;BR /&gt;- actions:&lt;BR /&gt;- accept&lt;BR /&gt;conditions:&lt;BR /&gt;- aws_region == 'ap-southeast-2'&lt;BR /&gt;name: accept ap-southeast-2&lt;BR /&gt;&lt;STRONG&gt;- asw_region == 'us-east1'&lt;/STRONG&gt;&lt;BR /&gt;&lt;STRONG&gt;name: accept us-east1&lt;/STRONG&gt;&lt;BR /&gt;- actions:&lt;BR /&gt;- drop&lt;BR /&gt;name: drop all&lt;BR /&gt;store_value: true&lt;/P&gt;</description>
    <pubDate>Fri, 12 Nov 2021 19:33:00 GMT</pubDate>
    <dc:creator>Scott127</dc:creator>
    <dc:date>2021-11-12T19:33:00Z</dc:date>
    <item>
      <title>Miner to collect AWS IP (region and service)</title>
      <link>https://live.paloaltonetworks.com/t5/general-topics/miner-to-collect-aws-ip-region-and-service/m-p/152117#M98858</link>
      <description>&lt;P&gt;I hope mapping region and service.&lt;/P&gt;&lt;P&gt;but, minemeld is only 1 choice.&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;&lt;SPAN class="short_text"&gt;&lt;SPAN class=""&gt;Example&lt;/SPAN&gt;&lt;/SPAN&gt;, I want "service": "AMAZON" IP in "region": "ap-southeast-2".&lt;/P&gt;&lt;P&gt;&lt;SPAN class="short_text"&gt;&lt;SPAN class=""&gt;How can I match "region" in "service" IP?&lt;BR /&gt;&lt;/SPAN&gt;&lt;/SPAN&gt;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Tue, 11 Apr 2017 04:36:33 GMT</pubDate>
      <guid>https://live.paloaltonetworks.com/t5/general-topics/miner-to-collect-aws-ip-region-and-service/m-p/152117#M98858</guid>
      <dc:creator>yad2nus</dc:creator>
      <dc:date>2017-04-11T04:36:33Z</dc:date>
    </item>
    <item>
      <title>Re: Miner to collect AWS IP (region and service)</title>
      <link>https://live.paloaltonetworks.com/t5/general-topics/miner-to-collect-aws-ip-region-and-service/m-p/152198#M98859</link>
      <description>&lt;P&gt;Hi&amp;nbsp;&lt;a href="https://live.paloaltonetworks.com/t5/user/viewprofilepage/user-id/59571"&gt;@yad2nus&lt;/a&gt;,&lt;/P&gt;
&lt;P&gt;do this:&lt;/P&gt;
&lt;OL&gt;
&lt;LI&gt;in CONFIG click on the hamburger icon, search for &lt;STRONG&gt;stdlib.feedHCWithValue &lt;/STRONG&gt;and click on it&lt;/LI&gt;
&lt;LI&gt;click on &lt;STRONG&gt;NEW&lt;/STRONG&gt;&lt;/LI&gt;
&lt;LI&gt;in the&amp;nbsp;&lt;STRONG&gt;CONFIG&lt;/STRONG&gt;&amp;nbsp;of the new prototype paste the following:
&lt;PRE&gt;infilters:
-   actions:
    - accept
    conditions:
    - __method == 'withdraw'
    name: accept withdraws
-   actions:
    - accept
    conditions:
    - aws_region == 'ap-southeast-2'
    name: accept ap-southeast-2
-   actions:
    - drop
    name: drop all
store_value: true&lt;/PRE&gt;
&lt;/LI&gt;
&lt;LI&gt;press &lt;STRONG&gt;OK&lt;/STRONG&gt; and use the new prototype to create a new output node&lt;/LI&gt;
&lt;/OL&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;The new prototype should look like:&lt;/P&gt;
&lt;P&gt;&lt;span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="MineMeld-new-proto.png" style="width: 739px;"&gt;&lt;img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/8748i512B8C74F5F169B6/image-size/large/is-moderation-mode/true?v=v2&amp;amp;px=999" role="button" title="MineMeld-new-proto.png" alt="MineMeld-new-proto.png" /&gt;&lt;/span&gt;&lt;/P&gt;</description>
      <pubDate>Tue, 11 Apr 2017 15:25:02 GMT</pubDate>
      <guid>https://live.paloaltonetworks.com/t5/general-topics/miner-to-collect-aws-ip-region-and-service/m-p/152198#M98859</guid>
      <dc:creator>lmori</dc:creator>
      <dc:date>2017-04-11T15:25:02Z</dc:date>
    </item>
    <item>
      <title>Re: Miner to collect AWS IP (region and service)</title>
      <link>https://live.paloaltonetworks.com/t5/general-topics/miner-to-collect-aws-ip-region-and-service/m-p/152271#M98860</link>
      <description>&lt;P&gt;thank you for your support.&lt;/P&gt;&lt;P&gt;good.&lt;/P&gt;</description>
      <pubDate>Wed, 12 Apr 2017 00:56:40 GMT</pubDate>
      <guid>https://live.paloaltonetworks.com/t5/general-topics/miner-to-collect-aws-ip-region-and-service/m-p/152271#M98860</guid>
      <dc:creator>yad2nus</dc:creator>
      <dc:date>2017-04-12T00:56:40Z</dc:date>
    </item>
    <item>
      <title>Re: Miner to collect AWS IP (region and service)</title>
      <link>https://live.paloaltonetworks.com/t5/general-topics/miner-to-collect-aws-ip-region-and-service/m-p/447288#M100671</link>
      <description>&lt;P&gt;Lmori, thank you for your response.&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;Do you know, is it possible to list multiple regions in the same filter? Such as,&lt;/P&gt;&lt;P&gt;infilters:&lt;BR /&gt;- actions:&lt;BR /&gt;- accept&lt;BR /&gt;conditions:&lt;BR /&gt;- __method == 'withdraw'&lt;BR /&gt;name: accept withdraws&lt;BR /&gt;- actions:&lt;BR /&gt;- accept&lt;BR /&gt;conditions:&lt;BR /&gt;- aws_region == 'ap-southeast-2'&lt;BR /&gt;name: accept ap-southeast-2&lt;BR /&gt;&lt;STRONG&gt;- asw_region == 'us-east1'&lt;/STRONG&gt;&lt;BR /&gt;&lt;STRONG&gt;name: accept us-east1&lt;/STRONG&gt;&lt;BR /&gt;- actions:&lt;BR /&gt;- drop&lt;BR /&gt;name: drop all&lt;BR /&gt;store_value: true&lt;/P&gt;</description>
      <pubDate>Fri, 12 Nov 2021 19:33:00 GMT</pubDate>
      <guid>https://live.paloaltonetworks.com/t5/general-topics/miner-to-collect-aws-ip-region-and-service/m-p/447288#M100671</guid>
      <dc:creator>Scott127</dc:creator>
      <dc:date>2021-11-12T19:33:00Z</dc:date>
    </item>
  </channel>
</rss>

