topic EDL for Specific Azure IPs/Tags Using Minemeld in General Topics

EDL for Specific Azure IPs/Tags Using Minemeld

OwenFuller — Tue, 13 Jul 2021 20:27:56 GMT

I'm looking for a way to use the JSON file from Microsoft which lists Azure IPs and services tags (https://www.microsoft.com/en-us/download/confirmation.aspx?id=56519) to create an EDL. However, I only want to include the IPs for Storage.EastUS2 in the resulting EDL. I've seen reference to a prototype called azure.public-cloudIPsWithServiceTags on Reddit (https://www.reddit.com/r/paloaltonetworks/comments/hr6ckm/azure_ip_feed_from_json/), but I don't see this prototype listed in Minemeld.

Re: EDL for Specific Azure IPs/Tags Using Minemeld

BPry — Wed, 14 Jul 2021 01:20:55 GMT

@OwenFuller,

You sure you're running the most current version of MineMeld? azure.public-cloudIPsWithServiceTags and auzre.cloudIPsWithServiceTags are both core prototypes included out of the box. I'd try updating or just spin up the latest docker image to ensure that you're actually on the latest build.

So the beautiful thing about JSON is that you can manipulate it really easily. A little bit of Python and you could capture the Storage.EastUS2 addressPrefixes pretty easily and use the MineMeld API to serve this information back into MineMeld.