topic Re: Microsoft Azure Datacenter IP Ranges in General Topics

Microsoft Azure Datacenter IP Ranges

msabena — Thu, 26 May 2016 05:23:38 GMT

Hi Luigi,

One of my customers needs to allow traffic to Microsoft Azure Datacenter IP Ranges for Microsoft Power Bi. Any plans to add a miner for it?

The URL source is http://www.microsoft.com/EN-US/DOWNLOAD/confirmation.aspx?id=41653

The file is in XML format

I tried to create a new prototype but I couldn't find an XML class. Are you planning to add it?

Thanks,

Re: Microsoft Azure Datacenter IP Ranges

lmori — Thu, 26 May 2016 06:57:10 GMT

Hi Mauricio,

there is no Miner for Azure IP Ranges yet, but it will be easy to add. It will be added for the next minor release, sometime next week.

I have created minemeld-core enhancement #14 to track this.

I have also created enhancement #15 and #16 to track development of Miner for GCE and Google IP ranges.

Re: Microsoft Azure Datacenter IP Ranges

Sergey.Ivashkin-PL — Thu, 06 Oct 2016 09:08:11 GMT

Hi,

did you solve your issue? i also need to import azure ip range to palo.

thank you in advance

Re: Microsoft Azure Datacenter IP Ranges

lmori — Thu, 06 Oct 2016 13:36:59 GMT

Yes, Miners for GCE, Google IPs and Azure are now available in MineMeld.

Re: Microsoft Azure Datacenter IP Ranges

El-ahrairah — Thu, 25 May 2017 01:02:55 GMT

@lmori

I can see the prototype for the azure ranges on the Github page. But how do I go about adding it into my minemeld config? Total rookie here.

Cheers

Re: Microsoft Azure Datacenter IP Ranges

lmori — Fri, 26 May 2017 07:28:17 GMT

Hi @El-ahrairah,

just go to CONFIG, press IMPORT and copy & paste the following. Click on APPEND and then COMMIT. After the COMMIT you will find a new output node under NODES called azureIPv4s with the list of IPs used by Azure.

nodes:
  azure_cloudIPs:
    inputs: []
    output: true
    prototype: azure.cloudIPs
  cloud_IPv4s:
    inputs:
      - azure_cloudIPs
    output: true
    prototype: stdlib.aggregatorIPv4Generic
  azureIPv4s:
    inputs:
      - cloud_IPv4s
    output: false
    prototype: stdlib.feedHCWithValue

Re: Microsoft Azure Datacenter IP Ranges

michaelseto — Mon, 02 Oct 2017 23:34:45 GMT

@lmori

Right now, there's only one miner for all Azure Datacenter IPs -- there's an opportunity to split by region (e.g. USWest, USEast, etc) so that Minemeld users can more granularly select what IPs they want.

Is there any thought to expanding out the miner definitions so that there's one per region?

Thanks!

Re: Microsoft Azure Datacenter IP Ranges

xhoms — Tue, 03 Oct 2017 08:15:32 GMT

@michaelseto : The azure miner attachs the azure_region attribute to the indicators. You can see it in the miner logs.

{
    "_age_out": 4294967295000,
    "confidence": 100,
    "azure_region": "uksouth",
    "share_level": "green",
    "_last_run": 1507016882946,
    "sources": [
        "azure.xml"
    ],
    "first_seen": 1507016882946,
    "type": "IPv4",
    "last_seen": 1507016882946
}

That means that you can use the output node input filter capabilities to accept/drop indicators based on that indicator's attribute value. For instance, the following 'infilters' configuration would only accept indicators for the region 'uksouth'

infilters:
-   actions:
    - accept
    conditions:
    - __method == 'withdraw'
    name: accept withdraws
-   actions:
    - accept
    conditions:
    - azure_region == 'uksouth'
    - share_level == 'green'
    name: accept azure IP for region uksouth
-   actions:
    - drop
    name: drop all

Re: Microsoft Azure Datacenter IP Ranges

michaelseto — Thu, 05 Oct 2017 16:21:46 GMT

Ah thank you @xhoms.

Your solution is more elegant than my own.

I ended up modifying some of the python (/opt/minemeld/engine/core/minemeld/ft/azure.py) and creating new miner prototypes per region.

At least I learned something? haha.

-Mike

Re: Microsoft Azure Datacenter IP Ranges

lmori — Fri, 06 Oct 2017 09:19:57 GMT

Hi @michaelseto,

nice ! could you send us a pull request on the github repo ?

luigi

Re: Microsoft Azure Datacenter IP Ranges

jgramke — Tue, 11 Dec 2018 23:16:37 GMT

Can anybody suggest where I can learn about how to apply/modify the mentioned "output node input filter capabilities"? I guess my question is -- where would I put input filter code such as is shown here?

Thanks,

Re: Microsoft Azure Datacenter IP Ranges

Michael_D — Wed, 19 Dec 2018 20:22:35 GMT

It would like something like this

nodes:
  azure_cloudIPs:
    inputs: []
    output: true
    prototype: azure.cloudIPs
  cloud_IPv4s:
    inputs:
      - azure_cloudIPs
    output: true
    prototype: stdlib.aggregatorIPv4Generic
  azure_IPv4s:
    inputs:
      - cloud_IPv4s
    output: false
    prototype: stdlib.feedHCWithValue
  azure_uksouth_IPv4s:
    inputs:
      - cloud_IPv4s
    output: false
    prototype: stdlib.feedHCWithValue
    config:
      infilters:
      -   actions:
        - accept
        conditions:
        - __method == 'withdraw'
        name: accept withdraws
      -   actions:
        - accept
        conditions:
        - azure_region == 'uksouth'
        - share_level == 'green'
        name: accept azure IP for region uksouth
      -   actions:
        - drop
        name: drop all

Re: Microsoft Azure Datacenter IP Ranges

Ian_Grant — Tue, 22 Jan 2019 15:24:24 GMT

Hi All

I've got a follow on to this discussion. I've tried the Azure IP miner and it works nicely, but it doesn't give the level of granularity that I need. It lists prefixes by azure region, but not by Azure service.

I need to end with a list of IP addresses by PaaS service, specifically storage & sql in my case. There is a differnet url that holds all the prefixes in json format here - https://www.microsoft.com/en-us/download/confirmation.aspx?id=56519

Does anyone have a miner prototype that can do this?

Thanks

Re: Microsoft Azure Datacenter IP Ranges

lmori — Wed, 23 Jan 2019 13:51:15 GMT

Thanks for the suggestion, I opened a FR to track this: https://github.com/PaloAltoNetworks/minemeld-core/issues/311

Re: Microsoft Azure Datacenter IP Ranges

lvmh_onenetwork — Tue, 19 Nov 2019 12:40:49 GMT

Hello,

did you see the link used will be deprecated by June 30, 2020

IP Ranges for each cloud, broken down by region and by the tagged services in that cloud are now available on MS Download: Public: https://www.microsoft.com/en-us/download/details.aspx?id=56519
US Gov: http://www.microsoft.com/en-us/download/details.aspx?id=57063
Germany: http://www.microsoft.com/en-us/download/details.aspx?id=57064
China: http://www.microsoft.com/en-us/download/details.aspx?id=57062

These JSON files are updated weekly and include versioning both for the full file and each individual service tag in that file. The “AzureCloud” tag provides the IP ranges for that entire cloud (Public, USGov, Germany, China) and is also broken out by region within that cloud. Finally, the list of service tags in the file will be increasing as we’re constantly onboarding new azure teams to service tags.