WebEx prototype

alterioc — Mon, 30 Mar 2020 22:55:41 GMT

I'm trying to create a custom prototype to get the CIDRs from https://help.webex.com/en-us/WBX000028782/Network-Requirements-for-Webex-Teams-Services#Spark%20IP%20subnets%20for%20media/

I used the examples in https://live.paloaltonetworks.com/t5/MineMeld-Articles/MineMeld-to-Extract-Indicators-From-generic-API/ta-p/218757 and I'm using the minemeld.ft.http.HttpFT class, type IPv4, but it isn't working.

I wanted to use:

ignore_regex: ^(?!<li>)

indicator:

regex: '<li>(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(?:\/\d{2})) $CIDR$.*<\/li>

transform: \1

This gets me nothing. If I remove the $CIDR$.*<\/li> from the indicator I get just the first CIDR and no others. What am I doing wrong?

Re: WebEx prototype

alterioc — Wed, 08 Apr 2020 17:14:13 GMT

I could not do it in Minemeld so I just wrote a powershell script which is scheduled in Task Scheduler. I had to make the location of the list accessible with anonymous authentication. fyi

# Set the location of the EDL
$FileName="D:\inetpub\wwwroot\WebEx\webex-cidrlist.txt"
#
# Overwrite any existing data an empty file
write-output "" | out-file -FilePath $FileName -Encoding ASCII
#
# Grab the contents of the webpage and put in variable
$results = Invoke-WebRequest -Uri 'https://help.webex.com/en-us/WBX000028782/Network-Requirements-for-Webex-Teams-Services#Spark%20IP%20subnets%20for%20media' -UseBasicParsing
#
# Extract the CIDRs from the page and write them to the EDL
$cidrs = ([regex]::Matches($results.rawcontent,'(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(?:\/\d{2}))') | select value)
if ($cidrs.Length -gt 0) {
write-output $cidrs.value | Out-File -FilePath $FileName -Encoding ascii
}

exit

topic Re: WebEx prototype in General Topics

WebEx prototype

Re: WebEx prototype