<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: Miner for google ASN in General Topics</title>
    <link>https://live.paloaltonetworks.com/t5/general-topics/miner-for-google-asn/m-p/230873#M97370</link>
    <description>&lt;P&gt;Hi &lt;a href="https://live.paloaltonetworks.com/t5/user/viewprofilepage/user-id/25609"&gt;@igarcia&lt;/a&gt;,&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;some companies like &lt;A href="https://ipinfo.io/pricing" target="_self"&gt;https://ipinfo.io/pricing&lt;/A&gt; provide subscriptions plans to extract IP data programmatically using a lot of different search criterias being the AS number of of them. Their API is compatible with the MineMeld &lt;STRONG&gt;SimpleJSON&lt;/STRONG&gt; &lt;STRONG&gt;class&lt;/STRONG&gt; so only a single prototype would be needed for paid accounts.&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;If you're looking for a &lt;EM&gt;free&lt;/EM&gt; way to get that information then you could create a &lt;STRONG&gt;HttpFT&lt;/STRONG&gt; &lt;STRONG&gt;class&lt;/STRONG&gt; prototype to parse the content of the pages they generate when you call their &lt;A href="https://ipinfo.io/AS&amp;lt;xxxxx" target="_blank"&gt;https://ipinfo.io/AS&amp;lt;xxxxx&lt;/A&gt;&amp;gt; entry point. This method is not as reliable as the paid one because any change in the page layout might crash the HTML parsing process.&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;The following pair of HttpFT class prototypes (one for IPv4 / one for IPv6) are successfully extracting the Google prefixes (AS15169) as of now in my lab.&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;For IPv4 prefixes:&lt;/P&gt;
&lt;PRE&gt;age_out:
    default: null
    interval: 3600
    sudden_death: true
attributes:
    confidence: 100
    share_level: green
    type: IPv4
indicator:
    regex: AS15169\/(([0-9]{1,3}\.){3}[0-9]{1,3}\/[0-9]{1,2})
    transform: \1
interval: 3600
source_name: google.ipv4
url: https://ipinfo.io/AS15169&lt;/PRE&gt;
&lt;P&gt;For IPv6 prefixes:&lt;/P&gt;
&lt;PRE&gt;age_out:
    default: null
    interval: 3600
    sudden_death: true
attributes:
    confidence: 100
    share_level: green
    type: IPv4
indicator:
    regex: AS15169\/([0-9a-f]{1,4}:[0-9a-f:]+\/[0-9]{1,3})
    transform: \1
interval: 3600
source_name: google.ipv4
url: https://ipinfo.io/AS15169&lt;/PRE&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;</description>
    <pubDate>Fri, 14 Sep 2018 18:34:53 GMT</pubDate>
    <dc:creator>xhoms</dc:creator>
    <dc:date>2018-09-14T18:34:53Z</dc:date>
    <item>
      <title>Miner for google ASN</title>
      <link>https://live.paloaltonetworks.com/t5/general-topics/miner-for-google-asn/m-p/230867#M97369</link>
      <description>&lt;P&gt;Hello all,&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;Has anybody created or know a way to mine the IPs published by a ASN, f.i. Google ASN?'&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;BR,&lt;/P&gt;</description>
      <pubDate>Fri, 14 Sep 2018 14:52:01 GMT</pubDate>
      <guid>https://live.paloaltonetworks.com/t5/general-topics/miner-for-google-asn/m-p/230867#M97369</guid>
      <dc:creator>igarcia</dc:creator>
      <dc:date>2018-09-14T14:52:01Z</dc:date>
    </item>
    <item>
      <title>Re: Miner for google ASN</title>
      <link>https://live.paloaltonetworks.com/t5/general-topics/miner-for-google-asn/m-p/230873#M97370</link>
      <description>&lt;P&gt;Hi &lt;a href="https://live.paloaltonetworks.com/t5/user/viewprofilepage/user-id/25609"&gt;@igarcia&lt;/a&gt;,&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;some companies like &lt;A href="https://ipinfo.io/pricing" target="_self"&gt;https://ipinfo.io/pricing&lt;/A&gt; provide subscriptions plans to extract IP data programmatically using a lot of different search criterias being the AS number of of them. Their API is compatible with the MineMeld &lt;STRONG&gt;SimpleJSON&lt;/STRONG&gt; &lt;STRONG&gt;class&lt;/STRONG&gt; so only a single prototype would be needed for paid accounts.&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;If you're looking for a &lt;EM&gt;free&lt;/EM&gt; way to get that information then you could create a &lt;STRONG&gt;HttpFT&lt;/STRONG&gt; &lt;STRONG&gt;class&lt;/STRONG&gt; prototype to parse the content of the pages they generate when you call their &lt;A href="https://ipinfo.io/AS&amp;lt;xxxxx" target="_blank"&gt;https://ipinfo.io/AS&amp;lt;xxxxx&lt;/A&gt;&amp;gt; entry point. This method is not as reliable as the paid one because any change in the page layout might crash the HTML parsing process.&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;The following pair of HttpFT class prototypes (one for IPv4 / one for IPv6) are successfully extracting the Google prefixes (AS15169) as of now in my lab.&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;For IPv4 prefixes:&lt;/P&gt;
&lt;PRE&gt;age_out:
    default: null
    interval: 3600
    sudden_death: true
attributes:
    confidence: 100
    share_level: green
    type: IPv4
indicator:
    regex: AS15169\/(([0-9]{1,3}\.){3}[0-9]{1,3}\/[0-9]{1,2})
    transform: \1
interval: 3600
source_name: google.ipv4
url: https://ipinfo.io/AS15169&lt;/PRE&gt;
&lt;P&gt;For IPv6 prefixes:&lt;/P&gt;
&lt;PRE&gt;age_out:
    default: null
    interval: 3600
    sudden_death: true
attributes:
    confidence: 100
    share_level: green
    type: IPv4
indicator:
    regex: AS15169\/([0-9a-f]{1,4}:[0-9a-f:]+\/[0-9]{1,3})
    transform: \1
interval: 3600
source_name: google.ipv4
url: https://ipinfo.io/AS15169&lt;/PRE&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Fri, 14 Sep 2018 18:34:53 GMT</pubDate>
      <guid>https://live.paloaltonetworks.com/t5/general-topics/miner-for-google-asn/m-p/230873#M97370</guid>
      <dc:creator>xhoms</dc:creator>
      <dc:date>2018-09-14T18:34:53Z</dc:date>
    </item>
    <item>
      <title>Re: Miner for google ASN</title>
      <link>https://live.paloaltonetworks.com/t5/general-topics/miner-for-google-asn/m-p/240844#M97371</link>
      <description>&lt;P&gt;Hi &lt;a href="https://live.paloaltonetworks.com/t5/user/viewprofilepage/user-id/6710"&gt;@xhoms&lt;/a&gt;&lt;A id="link_8" class="lia-link-navigation lia-page-link lia-user-name-link" href="https://live.paloaltonetworks.com/t5/user/viewprofilepage/user-id/6710" target="_self"&gt;&lt;/A&gt;&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;&lt;SPAN class="UserName lia-user-name lia-user-rank-L5-Sessionator"&gt;&lt;SPAN class=""&gt;Your method worked perfectly.&lt;/SPAN&gt;&lt;/SPAN&gt;&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;&lt;SPAN class="UserName lia-user-name lia-user-rank-L5-Sessionator"&gt;&lt;SPAN class=""&gt;we have a paid subscription with ipinfo.io, but without API,&amp;nbsp; we tried to do the same as the "free" option but it seems to not be working. I think we have problems adding the personal token to the entry point.&lt;/SPAN&gt;&lt;/SPAN&gt;&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;&lt;SPAN class="UserName lia-user-name lia-user-rank-L5-Sessionator"&gt;&lt;SPAN class=""&gt;can you help us out?&lt;/SPAN&gt;&lt;/SPAN&gt;&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;&lt;SPAN class="UserName lia-user-name lia-user-rank-L5-Sessionator"&gt;&lt;SPAN class=""&gt;Regards&lt;/SPAN&gt;&lt;/SPAN&gt;&lt;/P&gt;</description>
      <pubDate>Thu, 22 Nov 2018 12:36:47 GMT</pubDate>
      <guid>https://live.paloaltonetworks.com/t5/general-topics/miner-for-google-asn/m-p/240844#M97371</guid>
      <dc:creator>SOCGC</dc:creator>
      <dc:date>2018-11-22T12:36:47Z</dc:date>
    </item>
    <item>
      <title>Re: Miner for google ASN</title>
      <link>https://live.paloaltonetworks.com/t5/general-topics/miner-for-google-asn/m-p/242002#M97372</link>
      <description>&lt;P&gt;Hi &lt;a href="https://live.paloaltonetworks.com/t5/user/viewprofilepage/user-id/60444"&gt;@SOCGC&lt;/a&gt;,&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;let me know how could I help you.&lt;/P&gt;</description>
      <pubDate>Tue, 04 Dec 2018 10:13:39 GMT</pubDate>
      <guid>https://live.paloaltonetworks.com/t5/general-topics/miner-for-google-asn/m-p/242002#M97372</guid>
      <dc:creator>xhoms</dc:creator>
      <dc:date>2018-12-04T10:13:39Z</dc:date>
    </item>
  </channel>
</rss>

