topic Re: Bulk submission support using Web GUI? and CLI access to minemeld hosted in Autofocus? in General Topics

Bulk submission support using Web GUI? and CLI access to minemeld hosted in Autofocus?

lgiancaterini — Thu, 20 Apr 2017 02:50:47 GMT

I cannot see a way to do bulk submissions from the Web GUI that I know of so are there plans on having that capability in a future Minemeld release?

how to get CLI access to Minemeld hosted in Autofocus?

Re: Bulk submission support using Web GUI? and CLI access to minemeld hosted in Autofocus?

chirss — Fri, 21 Apr 2017 02:38:40 GMT

What do you mean by bulk submissions?

Re: Bulk submission support using Web GUI? and CLI access to minemeld hosted in Autofocus?

lgiancaterini — Fri, 21 Apr 2017 12:42:23 GMT

IP addresses, URL's, domains into a Minor.

Re: Bulk submission support using Web GUI? and CLI access to minemeld hosted in Autofocus?

chirss — Fri, 21 Apr 2017 14:34:53 GMT

Put the list into a file on a web server and point a miner to it.

Re: Bulk submission support using Web GUI? and CLI access to minemeld hosted in Autofocus?

lmori — Mon, 24 Apr 2017 06:48:45 GMT

An alternative is defining 3 local Miners and push indicators to the Miner using MineMeld API.

Re: Bulk submission support using Web GUI? and CLI access to minemeld hosted in Autofocus?

Kyle_Buffington — Tue, 13 Jun 2017 20:21:54 GMT

I was looking for this same information. I need to add 632 IP addresses to my current running IPv4 Blacklist feed and doing this 1 at a time via the GUI is a PITA. I like to put comments on my submissions so I will know what they are down the road.

Re: Bulk submission support using Web GUI? and CLI access to minemeld hosted in Autofocus?

lmori — Mon, 19 Jun 2017 12:38:16 GMT

Hi @Kyle_Buffington,

I have created as script that can be used to synchronize a local list of IPs with a local Miner in MineMeld:

https://gist.github.com/jtschichold/95f3906566b18b50cf2e3e1a44f1e785

The script reads a list of IPs/URLs/domains from a local file and uses the MineMeld API to push or remove indicators from a remote stdlib.local* Miner in a MineMeld instances.

Re: Bulk submission support using Web GUI? and CLI access to minemeld hosted in Autofocus?

Kyle_Buffington — Mon, 19 Jun 2017 14:37:01 GMT

Thank you for the script @lmori. Asking a peer for help because that is way out of my realm of how to use. I basicaly login via the web gui and add a manual IP to our blacklist is the extent of my knowledge of MineMeld and scripting. 🙂

Re: Bulk submission support using Web GUI? and CLI access to minemeld hosted in Autofocus?

lmori — Tue, 20 Jun 2017 12:19:55 GMT

Hi @Kyle_Buffington,

I just published an article about using the script:

https://live.paloaltonetworks.com/t5/MineMeld-Articles/Uploading-list-of-indicators-to-MineMeld/ta-p/162242

Re: Bulk submission support using Web GUI? and CLI access to minemeld hosted in Autofocus?

Kyle_Buffington — Fri, 23 Jun 2017 12:25:42 GMT

Awesome! Thank you!

Re: Bulk submission support using Web GUI? and CLI access to minemeld hosted in Autofocus?

Kyle_Buffington — Wed, 28 Jun 2017 19:25:22 GMT

Being able to add a Comment field in the script would be much appreciated Luigi. I like to mark why I am blacklisting an IP and have record of what it was weeks later when I am looking at the IP Addresses as a reminder. Possible?

I am doing 632 comments manually right now in the GUI after running the script to add all those IP addresses to my Miner.

Re: Bulk submission support using Web GUI? and CLI access to minemeld hosted in Autofocus?

lmori — Thu, 29 Jun 2017 08:40:55 GMT

Hi @Kyle_Buffington,

absolutely, that's something I wanted to add. About the syntax, would something like this work ?

# comment for indicator1
indicator1
# comment for indicator2
indicator2
...

Example

# Google Public DNS 1
8.8.8.8
# Google Public DNS 2
8.8.4.4

Re: Bulk submission support using Web GUI? and CLI access to minemeld hosted in Autofocus?

Kyle_Buffington — Thu, 29 Jun 2017 14:10:17 GMT

@lmori Yes that works well I believe.

Re: Bulk submission support using Web GUI? and CLI access to minemeld hosted in Autofocus?

sbayrak — Mon, 13 May 2019 13:47:26 GMT

Hi lmori,

Palo Alto told me that it was impossible to push anything to MineMeld hosted in Autofocus by using MineMeld API?

It could only be done with your own MineMeld instance hosted anywhere else, that's what they added... is that the case?

Cheers

Re: Bulk submission support using Web GUI? and CLI access to minemeld hosted in Autofocus?

Hongji.Guo — Fri, 17 May 2019 16:50:50 GMT

Hello lmori.

Where does your script install ? on the minemeld host ? if yes, I need access to the CLI of minemeld which I don't have

Thanks