topic Re: Link autofocus and minemeld in General Topics

Link autofocus and minemeld

Sarou22 — Wed, 24 Mar 2021 15:25:57 GMT

Hello,

Could you please explain me the link between autofocus and minemeld?

Thank you.

Re: Link autofocus and minemeld

LAYER_8 — Mon, 31 Jan 2022 19:49:03 GMT

Sure, Autofocus is being sunset in favor of Threat Intel Management (TIM).

Essentially, during a security incident, it's hard to investigate and operationalize data. To get questions answered like "is this a targeted attack, or generalized script? Who is the perpetrator, how do we stop them? What assets are at risk, where are attacks coming from and going to?" All that in a centralized place. Find that overview here.

Minemeld is a free tool that collects data and aggregates them into lists. For example, if you wanted to write a rule that allowed traffic using application "Facebook" only to known Facebook IPs, minemeld will be able to scrape those and output them into an EDL for the NGFW to ingest.

Re: Link autofocus and minemeld

JimMcGrady — Mon, 14 Mar 2022 03:41:47 GMT

Xsoar seems like a much bigger system than Minemeld or Autofocus. Is there anything that simply does the threat list aggregation and formatting for Palo, without all the other functions?

Re: Link autofocus and minemeld

LAYER_8 — Tue, 22 Mar 2022 16:32:19 GMT

Minemeld is still community supported here on LiveCommunity, so you can use it to build your custom lists and import threat feeds, if you choose.

We also maintain some of our own lists here. With threat prevention subscription we give you 4 different EDLs specific to threat, as well.

Re: Link autofocus and minemeld

BPry — Tue, 22 Mar 2022 16:55:22 GMT

Just as an FYI, the MineMeld image hasn't gotten updated in quite a long time. You could continue to utilize the Docker image and properly isolate it to become less of an issue, but it's still pretty outdated.

ENVOY is a potential solution you could look into along with EDL Manager depending on the feature set that you actually need to utilize.