Syslog Miner -> DAG Output

apackard — Tue, 26 Feb 2019 02:14:01 GMT

Is it possible to chain a syslog input\miner to a DAG output?

Scenario is I'd like to forward critical Threats to MineMeld to block the source address permanently (or at least longer than the max 3,600 seconds available as a block-ip IPS action) by bouncing back a DAG update (or failing that by adding to an EDL source etc).

I have a way of doing this currently but it's a bit complex, so hoping I can do so within MM.

Thanks

Re: Syslog Miner -> DAG Output

lmori — Thu, 28 Feb 2019 07:54:03 GMT

Hi @apackard,

check this article to do this via HTTP Log forwarding from PAN-OS:

https://live.paloaltonetworks.com/t5/MineMeld-Articles/Using-MineMeld-as-an-Incident-Response-Platform/ta-p/174690

topic Syslog Miner -> DAG Output in General Topics

Syslog Miner -> DAG Output

Re: Syslog Miner -> DAG Output