topic Re: What MM version is support currently recommending fo PAN OS 8.x.x version in General Topics

What MM version is support currently recommending fo PAN OS 8.x.x version

JeelaniGh — Mon, 12 Feb 2018 11:32:23 GMT

Currently there is a project to upgrade all Palo Alto's to a 8.x.x platform.

What MM version is support currently recommending fo PAN OS 8.x.x version?

Also need to consider Active directory integration as an option within the upgraded design. How we can acheive this?

Re: What MM version is support currently recommending fo PAN OS 8.x.x version

borising — Tue, 13 Feb 2018 18:34:37 GMT

I am not working for PAN, so I can't vouch for the recommendation, but at our company we have been using minemeld successfully since summer 2017, and just now starting to use minemeld together with other software stacks, like a SIEM and graylog.

Re: What MM version is support currently recommending fo PAN OS 8.x.x version

JeelaniGh — Wed, 14 Feb 2018 06:47:33 GMT

Thanks for reply, looking some suggestions from other folks here...

Re: What MM version is support currently recommending fo PAN OS 8.x.x version

michael.gabriel — Fri, 01 Jun 2018 17:45:07 GMT

Hello @borising,

Just wondering, what are you doing exactly with Graylog? Trying to find a good solution to monitor feeds and analyze them.

Thanks 🙂

Re: What MM version is support currently recommending fo PAN OS 8.x.x version

borising — Mon, 04 Jun 2018 05:58:10 GMT

Hi @michael.gabriel,

We were looking into this article:

https://live.paloaltonetworks.com/t5/MineMeld-Articles/Correlating-PAN-OS-syslog-with-indicators/ta-p/72078

And thought of using graylog for the receiving end, as this was a system we already use internally, nothing more special in that 🙂

Though I am having some issues getting it to work, as there are no correlations being sent out, so haven't looked more into it the last couple of months.

Re: What MM version is support currently recommending fo PAN OS 8.x.x version

michael.gabriel — Tue, 05 Jun 2018 12:54:00 GMT

Very interesting @borising!

I actually wound up doing something very similar to this by using MM and Splunk Free. MM sends LogStash info to Splunk, and NGFW sends syslogs to Splunk. Works pretty well! Here are the MM apps for Splunk:

https://github.com/gmellini/minemeld-analysis/

https://github.com/gmellini/TA-custom-minemeld_ioc

And for the NGFW syslog parsing, the PAN plugins for Splunk work perfectly.

Re: What MM version is support currently recommending fo PAN OS 8.x.x version

borising — Fri, 08 Jun 2018 08:20:02 GMT

Hi @michael.gabriel

That´s perfect! I was just looking at the same setup for my home lab, will try it out! Thank you for joining in with your valuable feedback, much appreciated!