topic Windows Update feed in minemeld in General Topics

Windows Update feed in minemeld

scott.jones — Wed, 10 Jul 2019 19:50:57 GMT

I'm trying to find out if there's already a miner that someone's created for windows update URLs/IPs. I am using the O365 one with reasonable success, so I'd like to incorporate the windows updates into minemeld and take advantage of the dynamic list functionality for some of my rules.

Thanks!

Re: Windows Update feed in minemeld

tlamonta — Thu, 06 Oct 2022 18:41:59 GMT

Same here. I am looking for a stable URL/IP feed or file for Microsoft Updates. We also tried policy based on the 'ms-update' app-ID but finding its hit or miss.

Re: Windows Update feed in minemeld

BPry — Mon, 10 Oct 2022 02:57:24 GMT

@tlamonta,

You won't find an IP list from Microsoft that they officially publish. You need to use the published URLs (and their wildcards) that haven't really changed in years at this point.