topic Re: O365 URL rewrite in General Topics

O365 URL rewrite

ckemp — Thu, 15 Nov 2018 23:03:29 GMT

I'm using minemeld to pull the O365 urls into my PAN. I get a list that has entries like
*.domain.com
sub.domain1.com

I need to import those entries and rewrite them so they look like
*.domain.com/
domain.com/
*.sub.domain1.com/
sub.domain1.com/

Any pointers would be appreciated.

Re: O365 URL rewrite

lmori — Tue, 20 Nov 2018 13:47:56 GMT

Hi @ckemp,

could you tell us more about this rewrite? Why is that needed?

Re: O365 URL rewrite

ckemp — Tue, 20 Nov 2018 14:05:20 GMT

We use an External Dynamic List from minemeld to ingest Office 365 URLs and IPs into PAN. Microsoft presents the urls as *.skype.com. If I go to www.skype.com, I get access. If I go to skype.com, I am blocked. I understand the “*” is a token and PAN expects to find something there, such as “www”, not for to be empty or null. This is a problem. I’m not sure how to manage this other than parse the list again for every *.domain.com entry create a domain.com entry.

Re: O365 URL rewrite

lmori — Tue, 20 Nov 2018 22:09:42 GMT

Hi @ckemp,

what version of PAN-OS are you running on? I think the matching behavior was changed to let *.skype.com match also skype.com at some point.

Thanks,

luigi

Re: O365 URL rewrite

ckemp — Tue, 20 Nov 2018 23:17:02 GMT

I’m running 8.1.4.

Re: O365 URL rewrite

eyunghans — Mon, 17 Dec 2018 17:16:54 GMT

I've confirmed this is the behavior on v8.1.5 as well, a specific entry for the root domain is required as a wildcare does not function.

@lmori what would be the best way to file this?

Re: O365 URL rewrite

lmori — Wed, 19 Dec 2018 10:29:03 GMT

@eyunghans thanks for testing this. I am working on it. The plan is to enhance panosurl modifier to translate *.domain.com into domain.com and *.domain.com in the generated feed.

Re: O365 URL rewrite

ckemp — Wed, 19 Dec 2018 12:55:54 GMT

Any ETA on when this would be available?

Re: O365 URL rewrite

lmori — Thu, 20 Dec 2018 15:36:13 GMT

Just merged the PR to the develop branch on github:

https://github.com/PaloAltoNetworks/minemeld-core/pull/307

This will be in the next release. You can test it now if you use the Ansible playbook.

Re: O365 URL rewrite

ckemp — Thu, 20 Dec 2018 16:00:41 GMT

We do not use Ansible playbook. Do you know when the next release will be available?

Re: O365 URL rewrite

Sec101 — Thu, 20 Dec 2018 16:09:52 GMT

@lmori

Can you reply to this thread once this is updated, or do you suggest we monitor github?

Re: O365 URL rewrite

ckemp — Thu, 20 Dec 2018 16:11:10 GMT

This thread. I do not monitor github.

Re: O365 URL rewrite

ckemp — Thu, 10 Jan 2019 14:14:08 GMT

The rewrite rule is not working for top level domains, but it is for subdomains. I would expect to see

*.skype.com

skype.com

It is working for *.broadcast.skype.com.

Re: O365 URL rewrite

lmori — Fri, 11 Jan 2019 10:18:02 GMT

Hi @ckemp,

just tested this and I can see the doubled entries for skype.com. I am about to release the binary packages for the updates. Which version are you running on?

Re: O365 URL rewrite

ckemp — Fri, 11 Jan 2019 13:07:27 GMT

I am on 0.9.52.

ubuntu@minemeld:~$ sudo /usr/sbin/minemeld-auto-update
2019-01-11 13:06:45,572 INFO:0.9.11 Current status:
2019-01-11 13:06:45,572 INFO:0.9.11 minemeld-engine: current: 0.9.52 latest: 0.9.52
2019-01-11 13:06:45,573 INFO:0.9.11 minemeld-webui: current: 0.9.52 latest: 0.9.52
2019-01-11 13:06:45,573 INFO:0.9.11 minemeld-prototypes: current: 0.9.52 latest: 0.9.52
2019-01-11 13:06:45,739 DEBUG:0.9.11 curl output:
2019-01-11 13:06:45,773 DEBUG:0.9.11 curl output:
2019-01-11 13:06:45,773 DEBUG:0.9.11 gpgv: /usr/bin/gpgv --ignore-time-conflict --keyring /etc/apt/trusted.gpg --keyring /etc/apt/trusted.gpg.d/minemeld.gpg /tmp/mmaupackagesgpgDWAPvd /tmp/mmaupackagesQUUdhl
2019-01-11 13:06:45,778 INFO:0.9.11 gpgv output: gpgv: Signature made Fri 07 Dec 2018 09:32:50 AM UTC using RSA key ID 7B630999
gpgv: Good signature from "Palo Alto Networks, MineMeld Team <minemeld@paloaltonetworks.com>"
gpgv: aka "[invalid image]"

2019-01-11 13:06:45,783 INFO:0.9.11 No package to deploy, exit
ubuntu@minemeld:~$

Re: O365 URL rewrite

lmori — Sun, 13 Jan 2019 08:38:38 GMT

Hi @ckemp,

you need 0.9.52.post1, not available yet on the binary update channel. I will publish it tomorrow.

Luigi

Re: O365 URL rewrite

lmori — Tue, 15 Jan 2019 08:23:29 GMT

@ckemp @Sec101, I have just published the binary package of 0.9.52.post1 to the update channel. This contains the improvement to the output feed to cope with PAN-OS limitation.

Re: O365 URL rewrite

ckemp — Tue, 15 Jan 2019 16:32:24 GMT

Updated Minemeld.

Restart Minemeld engine and force import on PA. Not showing up in EDL.

Re: O365 URL rewrite

lmori — Tue, 15 Jan 2019 16:35:34 GMT

Could you check directly the MineMeld feed with the browser?

luigi

Re: O365 URL rewrite

ckemp — Tue, 15 Jan 2019 17:05:46 GMT

Pulled the file into Notepad++