topic MineMeld can not get O365 JSON format list in General Topics

MineMeld can not get O365 JSON format list

Security_Cat — Wed, 03 Oct 2018 08:28:37 GMT

[Failure event]
In the case of O365 's xml format, when MineMeld received traffic after ClientHello, I got a list but if I set config for JSON support I can not get a list.

[Prerequisites]
MineMeld will go through Paloalto and do Internet communication.

[Question]
I think that the packet flow that can be checked with Paloalto is incorrect.
We were able to get the list in xml format, but we can not get JSON format list.
Is there a relationship with the above? What is the cause if there is no relationship?

The following is an excerpt of minemeld's "minemeld-web.log". It is time when minemeld can not acquire the list.

"POST /login?_=1538387082 HTTP/1.0" 200 2 "https://172.16.2.20/#/login" "Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko"
[DEBUG] redis session connection pool: in use: 0 available: 5
[DEBUG] redis session connection pool: in use: 0 available: 5
[DEBUG] redis session connection pool: in use: 1 available: 4
[INFO] redis connection pool: in use: 0 available: 1

Re: MineMeld can not get O365 JSON format list

Security_Cat — Thu, 04 Oct 2018 00:52:56 GMT

OS is redhat ".
The version is 7.4.

Re: MineMeld can not get O365 JSON format list

ymiyashita — Fri, 05 Oct 2018 00:48:20 GMT

Hello Takagi-san,

My suggestion for now is to install MineMeld 0.9.50 or newer on Ubuntu. (I also heard from Takagi-san that it works fine with the version in his lab.)

References:
https://live.paloaltonetworks.com/t5/MineMeld-Articles/Running-MineMeld-on-VMWare-desktop/ta-p/72038
==> "Installation is not supported yet on RHEL. MineMeld runs on RHEL but there are no docs about it yet."

https://live.paloaltonetworks.com/t5/MineMeld-Articles/How-to-Safely-Enable-access-to-Office-365-using-MineMeld-Updated/ta-p/224148

Thanks,
Yasu