topic Create a miner to mine from Autofocus MineMeld in General Topics

Create a miner to mine from Autofocus MineMeld

Retired Member — Wed, 15 Feb 2017 08:42:48 GMT

Hi, with the release of PANOS 8.0, Autofocus will have a minemeld build in.

May I know if we can have a on premise minemeld to fetch the feeds from the Autofocus Minemeld?

I tried to grab the minemeld feeds but it shows me unauthorized access.

Do we need to have a api keys for this? Would there be plugin for this?

Thanks

Re: Create a miner to mine from Autofocus MineMeld

lmori — Wed, 15 Feb 2017 10:50:08 GMT

Hi @Retired Member,

this will be improved in the next release of the on-prem MineMeld, but you can access the feeds from MineMeld on Autofocus via a STIX/TAXII Miner.

The unauthorized access is returned because on the MineMeld for Autofocus access to feeds is authenticated. You should create users under Admins > Feeds and give them the access tags. Please check this thread for details: https://live.paloaltonetworks.com/t5/MineMeld-Discussions/Minemeld-Feed-Password-OR-api-security/m-p/131716/highlight/true#M633

Re: Create a miner to mine from Autofocus MineMeld

Retired Member — Thu, 16 Feb 2017 03:50:08 GMT

Thanks Imori.

As I am exploring the Autofocus minemeld, i can get the feed to work when set to annoymous. When set with a password, it seems not working even though i used 1 of the prototype that allows me to key in username and password. Im using the openphish prototype that allows me to key in username and password. It still fails.

I am also trying to explore to use the STIX/TAXII. I have created the output to TAXII in Autofocus minemeld. How can i receive this feed from local minemeld? There is no reference link for me to point to.

Thanks

Re: Create a miner to mine from Autofocus MineMeld

lmori — Thu, 16 Feb 2017 17:03:22 GMT

Hi @Retired Member,

I will work on a document about this.

Luigi