topic Re: DAGPusher - Questions; API Key? How to specify what Dynamic address group object to apply IPs to in General Topics

DAGPusher - Questions; API Key? How to specify what Dynamic address group object to apply IPs to?

PA-User — Tue, 27 Feb 2018 20:44:05 GMT

Regarding DAGPusher Output node.

I don't mean to hit anyone with a firehose but I have several questions I'm having trouble finding the answers to regarding the DAGPusher Output node in MineMeld. It's my understanding this node will allow MineMeld to add IPs to a Dyanmic Address Group object on a PA.

Is there any documentation for this module?

How is the desired Dyanmic Address Group object on the target PA specified?

How is the vsys specified? When adding a new "handled device" vsys isn't listed but after adding there is a column for it.

Is there a minimum PA software version for this to work?

Can the a PA API key be utilized instead of user password?

I'm doing some testing and can see where to add "handled devices"; however, as of yet I'm not seeing entries being pushed to my lab pa after providing the ssh credentials. I'm interested the expected behavior of this module.

*EDIT*

After switching from FQDN for hostname to IPv4 address, I'm now seeing entries being pushed looks like it's pushing the IPs to the following tags by default;

"mmld_confidence_high"
"mmld_direction_unknown"
"mmld_pushed"

I'm assuming then I will need to modify the prototype to specifcy a different tag. Any info on what 'config/variables' I would need to set to change or add a different tag?

Re: DAGPusher - Questions; API Key? How to specify what Dynamic address group object to apply IPs to

xhoms — Wed, 28 Feb 2018 17:55:59 GMT

Hi @PA-User, I'm working on a new article describing all hidden secrets of the DAGPusher node. It will contain answers to all your questions.

Re: DAGPusher - Questions; API Key? How to specify what Dynamic address group object to apply IPs to

PA-User — Wed, 28 Feb 2018 18:41:52 GMT

I was hoping you'd chime in; you've been immensly helpful!

Is that something you were hoping to publish this week yet or is it still a work in progress?

Re: DAGPusher - Questions; API Key? How to specify what Dynamic address group object to apply IPs to

xhoms — Wed, 28 Feb 2018 18:43:26 GMT

I'm finishing it. It should be published this week.

Re: DAGPusher - Questions; API Key? How to specify what Dynamic address group object to apply IPs to

PA-User — Wed, 28 Feb 2018 18:52:18 GMT

Awesome! Looking forward to that. I've been managing DAG (Dynamic Address Group) objects in PA with some homebrew scripting up to now. Hoping to let minemeld take over some of that.

I've got one more question to add if it's not too much trouble -- maybe you were already addressing this. Does the DAGPusher node remove IPs registered to a DAG that are no longer present because they have been removed from the list?

My experience has been that adding IPs to DAGs via API is super easy but then the care and feeding of syncing the lists takes a bit more scripting and verification. I'curious whether DAGPusher removes IPs that have been removed from it's list.

Re: DAGPusher - Questions; API Key? How to specify what Dynamic address group object to apply IPs to

xhoms — Thu, 01 Mar 2018 19:37:51 GMT

@PA-User, here it is https://live.paloaltonetworks.com/t5/MineMeld-Articles/Using-MineMeld-to-implement-a-poor-man-s-NAC-application/ta-p/203006

Appreciate any feedback.