topic Re: MineMeld and Office 365 in General Topics

MineMeld and Office 365

GregWasHere — Mon, 16 Apr 2018 12:46:45 GMT

I've used MineMeld in the past and I've been very happy with all of it's functions. Recently, I've started a new job and I've recommended MineMeld as a solution to get O365 IP's into the firewall for writing policy. Microsoft announced on April 2nd that it will be retiring the HTML/XML/RSS feed. I've included the announcement and link below. With Microsoft switching the way that they provide their URL list, are there plans to accommodate this inside of MineMeld?

https://techcommunity.microsoft.com/t5/Office-365-Blog/Announcing-Office-365-endpoint-categories-and-Office-365-IP/ba-p/177638

Re: MineMeld and Office 365

lmori — Mon, 16 Apr 2018 12:56:04 GMT

Hi @GregWasHere,

yes, we are aware of the change. We have just coded the Miners for the new API. They are only available in the development version of MineMeld but soon they will be available in the official release.

Thanks for the heads up!

luigi

Re: MineMeld and Office 365

GregWasHere — Mon, 16 Apr 2018 14:05:50 GMT

Hi luigi,

Thanks for the reply and thank you!

Re: MineMeld and Office 365

alterioc — Wed, 11 Jul 2018 17:16:16 GMT

Have the Miners for the new API been made available yet? If not, when are they expected to be available? Please provide the latest status. Thanks.

Re: MineMeld and Office 365

xhoms — Wed, 11 Jul 2018 20:02:19 GMT

Hi @alterioc,

the new miners were commited to the master branch in May. So they're available for consumption since 0.9.46

Re: MineMeld and Office 365

alterioc — Thu, 12 Jul 2018 04:53:24 GMT

Thank you @xhoms! I found https://live.paloaltonetworks.com/t5/MineMeld-Discussions/Stable-MineMeld-version-and-new-Office-365-API/td-p/215441 which explains what I need to do. I appreciate the quick reply.

Re: MineMeld and Office 365

alterioc — Wed, 18 Jul 2018 15:36:51 GMT

I'm hoping someone can help me figure out if I have a problem or not ....I upgraded minemeld using ansible and all seems ok except when I ssh to the device I always get the "Initializing minemeld. It could take some minutes, please wait ....". I have to do ctl-c to escape. The /var/log/minemeld-auto-update.log shows the following. I am able to get into the UI and I am able to a run-now on the miners successfully but the log shows no update since yesterday. On the Nodes screen everything in the ADD/REM/AO, the UPDATES and WITHDRAWS columns are 0. There are non-zero values in the INDICATORS column. Do I have an issue with the upgrade, or not? Is there something more I need to do so the log updates and I don't get the "Initializing minemeld" line upon ssh to the device?

2018-07-18 06:40:49,562 INFO:0.9.11 Package minemeld-engine current version set to 0.9.48.post1
2018-07-18 06:40:49,564 INFO:0.9.11 Package minemeld-webui current version set to 0.9.48
2018-07-18 06:40:49,565 INFO:0.9.11 Package minemeld-prototypes current version set to 0.9.48
* Starting: minemeld
...done.

Thank you.

Re: MineMeld and Office 365

DanielNeto — Sun, 29 Jul 2018 05:36:51 GMT

Hi @xhoms and @lmori

Thanks for support this big change of Microsoft.

After upgrading Minemeld, there is new prototypes or does it change existing ones?

Is there any guide/words on how to migrate?

Regards,

Re: MineMeld and Office 365

Sec101 — Thu, 15 Nov 2018 16:58:03 GMT

@xhoms, I noticed in the official write up at the below link it states that it requires version 9.50.

https://live.paloaltonetworks.com/t5/MineMeld-Articles/How-to-Safely-Enable-access-to-Office-365-using-MineMeld-Updated/tac-p/240012#M268

But in your description below it shows they are available for consumption since 0.9.46. Is there a way to add these new miners, using .9.46? or do you suggest upgrading to 9.50

Re: MineMeld and Office 365

‎07-11-2018 01:02 PM

Hi @alterioc,

the new miners were commited to the master branch in May. So they're available for consumption since 0.9.46

Re: MineMeld and Office 365

xhoms — Thu, 15 Nov 2018 17:24:44 GMT

Hi @Sec101,

miners for the new API were first released with MineMeld 0.9.46. But Microsoft made some changes in the API after that. The current Microsoft API is implemented in MineMeld 0.9.50