topic Re: Where to mine all O365 endpoints in General Topics

Where to mine all O365 endpoints?

Oleksand1 — Thu, 22 Nov 2018 10:53:22 GMT

Hi dear community,

I just implemented MineMeld server and configured EDLs and test policies.

For the MineMeld I used "o365-api-any-any.txt" from https://paloaltonetworks.app.box.com/s/ywkh7rc2rj0kyl0qetr6m6ag3akxvvx6/folder/51988433336.

Does anybody know if it's enough for all O365 endpoints, or I'm missing something? i still see that some endpoints are missing (e.g. some MS Office activation servers; IP: 40.77.226.250, 40.69.153.67)

Thanks!

Re: Where to mine all O365 endpoints

lmori — Tue, 20 Nov 2018 13:28:30 GMT

Hi @Oleksand1,

thanks for reporting, do you have the URL associated to those IPs?

luigi

Re: Where to mine all O365 endpoints

Oleksand1 — Thu, 22 Nov 2018 08:48:45 GMT

Hello @lmori

"Resolve Hostname" results in co2.sls.microsoft.com.

Thanks!

Re: Where to mine all O365 endpoints

lmori — Thu, 06 Dec 2018 10:11:54 GMT

Hi @Oleksand1,

are you using both URL and IP in enabling policies? Both are needed.

In the microsoft endpoint list there is an endpoint for activation, but it is only specified as a URL:

activation.sls.microsoft.com