Minemeld automatic updates required for future Azure Public IP changes and additions

Yongjie — Wed, 28 Jul 2021 16:19:46 GMT

We have a JSON file from the URL below which is updated weekly:

https://www.microsoft.com/en-us/download/confirmation.aspx?id=56519

Ideally, we would like to pull a list of IPV4 IP addresses out from the section "name": "AzureIoTHub", which needs to be converted into EDL format by MineMeld. The list of IPs can then be referenced in the security policies in Palo Alto.

Does anyone how to set up a customised prototype in Minemeld?

Thanks

Re: Minemeld automatic updates required for future Azure Public IP changes and additions

aleksandar.astardzhiev — Mon, 16 Aug 2021 13:24:59 GMT

Hi @Yongjie ,

What version of MineMeld are you running?

If you are running one of the laters you should be able to use the build-in miner Azure IPs. In previous version MineMeld was mining old URL that was not providing the what information for what service was used the IP range. But in the recent version (not sure since when) it is supporting service tag.

- You should see azure.cloudIPsWithServiceTags miner prototype

- You can clone it to create miner, that will mine the entire json file and filter the service you need on the output

- Using one of the standard output prototype create new and add filter condition to accept only prefixes with service tag of your choise.

Below is example I am using for output only Azure CosmosDB.

infilters: - actions: - accept conditions: - __method == 'withdraw' name: accept withdraws - actions: - accept conditions: - type == 'IPv4' - azure_system_service == 'AzureCosmosDB' - azure_region == 'westeurope' name: accept AzureCosmosDB IPv4 - actions: - drop name: drop all store_value: true

Note you can check the correct serive name from the original JSON.

topic Minemeld automatic updates required for future Azure Public IP changes and additions in General Topics

Minemeld automatic updates required for future Azure Public IP changes and additions

Re: Minemeld automatic updates required for future Azure Public IP changes and additions