topic Minemeld not pulling low and medium confidence feeds? in General Topics

Minemeld not pulling low and medium confidence feeds?

BobHarrison — Tue, 27 Dec 2016 22:21:56 GMT

Hello,

My firewall is able to pull several feeds from our minemeld server. However, it is not pulling our Low and Medium Confidence inbound feeds. Worked with PA support and they said there must be something wrong with our Minemeld server and suggested I post a question here.

thanks!

Re: Minemeld not pulling low and medium confidence feeds?

lmori — Wed, 28 Dec 2016 18:07:02 GMT

Hi @BobHarrison,

could you share some more details like a screenshot of the NODES view ? Are there indicators in the MC and HC feeds ? What kind of indicators are we talking about ?

Thanks !

luigi

Re: Minemeld not pulling low and medium confidence feeds?

BobHarrison — Wed, 28 Dec 2016 19:45:29 GMT

thanks for your reply! Here is a screenshot. Note that the high confidence feed is working fine, but the mc and lc are not.

Re: Minemeld not pulling low and medium confidence feeds?

lmori — Wed, 28 Dec 2016 19:49:53 GMT

Hi @BobHarrison,

the reason is that both inboundfeedlc and inboundfeedmc are empty, see the first column where you see 0 on both rows.

If you could attach the full graph I could give you a better suggestion, but if you are using the default configs all the indicators are marked High Confidence - i.e. with the default configinboundfeedlc and inboundfeedmc feeds are never populated.

If you add new Miners you should indicators fall in those feeds as well, check the tags associated to each Miner to see what kind of confidence is associated to the indicators.

Re: Minemeld not pulling low and medium confidence feeds?

BobHarrison — Wed, 28 Dec 2016 20:34:09 GMT

Here is the full graph, is this what you were asking for? Not really sure how to add new miners.

Re: Minemeld not pulling low and medium confidence feeds?

BobHarrison — Wed, 28 Dec 2016 20:46:06 GMT

Didn't show up last time, trying again with graph:

Re: Minemeld not pulling low and medium confidence feeds?

lmori — Thu, 29 Dec 2016 15:01:01 GMT

Hi @BobHarrison,

could we have a screenshot of the graph ? Go to NODES, select one of the nodes and then click on the graph tab on the left.

Thanks !

luigi

Re: Minemeld not pulling low and medium confidence feeds?

BobHarrison — Thu, 29 Dec 2016 18:38:32 GMT

Thanks for all your help! Sorry, didn't get what graphs you meant at first. Here is one from the low confidence feed:

Re: Minemeld not pulling low and medium confidence feeds?

lmori — Sun, 01 Jan 2017 08:02:14 GMT

Hi @BobHarrison,

I didn't make myself clear, sorry. I meant the node connection graph, one tab below the one you just posted (the tab with a sort of fat asterisk on it).

Thanks!

Re: Minemeld not pulling low and medium confidence feeds?

BobHarrison — Tue, 03 Jan 2017 23:22:49 GMT

Re: Minemeld not pulling low and medium confidence feeds?

lmori — Wed, 04 Jan 2017 06:16:59 GMT

Hi @BobHarrison,

the inboundfeecmc and inboundfeedhc are empty because all the Miners feeding those output nodes produce High Confidence indicators.

luigi

Re: Minemeld not pulling low and medium confidence feeds?

BobHarrison — Wed, 04 Jan 2017 16:29:58 GMT

Thanks, Luigi, how do I fix that? Or is that just how it operates?

Re: Minemeld not pulling low and medium confidence feeds?

lmori — Thu, 05 Jan 2017 10:10:23 GMT

Hi @BobHarrison,

this is expected:

- in your configuration all the Miners attached to the inboundaggregator feeding inboundfeedmc and inboundfeedlc are producing only High Confidence indicators

- as High Confidence indicators are collected per design only by inboundfeedhc, inboundfeedmc and inboundfeedlc are left empty

When you will attach more Miners to inboundfeedaggregator, you could see inboundfeedmc and inboundfeedlc populated if the new Miners produce also medium confidence and low confidence indicators.

Re: Minemeld not pulling low and medium confidence feeds?

BobHarrison — Thu, 05 Jan 2017 19:04:17 GMT

So I should just leave it this way?

Re: Minemeld not pulling low and medium confidence feeds?

lmori — Mon, 09 Jan 2017 19:36:05 GMT

Yes, it's working as expected.

Re: Minemeld not pulling low and medium confidence feeds?

BobHarrison — Mon, 09 Jan 2017 23:39:11 GMT

Thank you! One last question as you obviously know minemeld very well: how do i upgrade the server? Is there a way to do it from the web gui? I haven't been able to find the menu if that is an option.

thanks again for all your help, Luigi!

Re: Minemeld not pulling low and medium confidence feeds?

lmori — Tue, 10 Jan 2017 15:35:45 GMT

Hi @BobHarrison,

MineMeld has an auto-update mechanism in place, you can disable it and run it manually following this article here:

https://live.paloaltonetworks.com/t5/MineMeld-Articles/Updating-MineMeld/ta-p/72151

Which version of MM are you running ? You can check it by clicking on MINEMELD on the WebUI

luigi

Re: Minemeld not pulling low and medium confidence feeds?

BobHarrison — Tue, 10 Jan 2017 17:54:40 GMT

9.30. OK, as long as it's auto-updating, I'm not worried.