panos_syslog IP indicator - withdraw

rchilukuri — Wed, 15 Feb 2017 23:30:50 GMT

I am trying to create an IPv4 indicator list based on PAN-OS threat logs.

Below is the rule code attached to the syslogminer class stdlib.syslogMiner.

RULE:

age_out:
default: last_seen+30d
interval: 1800
sudden_death: false
attributes:
confidence: 50
type: IPv4
conditions:
- type == 'THREAT'
config:
share_level: green
fields: null
indicators:
- src_ip

Unfortunately all the IP addresses are withdrawn.

15/2/2017 08:07:04 -0500 ThreatFeedMCGreen ACCEPT_WITHDRAW 192.168.1.61-192.168.1.61 confidence: 50sources: ["panos.syslog"]first_seen: 1487158094651panossyslog_devices: ["001606041772"]type: IPv4last_seen: 1487160033901 source_node: inboundaggregator

15/2/2017 08:07:04 -0500 ThreatFeedMCGreen RECVD_WITHDRAW 192.168.1.61-192.168.1.61 confidence: 50sources: ["panos.syslog"]first_seen: 1487158094651panossyslog_devices: ["001606041772"]type: IPv4last_seen: 1487160033901 source_node: inboundaggregator

15/2/2017 08:07:04 -0500 ThreatFeedMCRedWithValue ACCEPT_WITHDRAW 192.168.1.61-192.168.1.61 confidence: 50sources: ["panos.syslog"]first_seen: 1487158094651panossyslog_devices: ["001606041772"]type: IPv4last_seen: 1487160033901 source_node: inboundaggregator

15/2/2017 08:07:04 -0500 ThreatFeedMCRedWithValue RECVD_WITHDRAW 192.168.1.61-192.168.1.61 confidence: 50sources: ["panos.syslog"]first_seen: 1487158094651panossyslog_devices: ["001606041772"]type: IPv4last_seen: 1487160033901 source_node: inboundaggregator

15/2/2017 08:07:04 -0500 inboundaggregator EMIT_WITHDRAW 192.168.1.61-192.168.1.61 _updated: 1487160033902confidence: 50panossyslog_devices: ["001606041772"]_added: 1487158094654sources: ["panos.syslog"]first_seen: 1487158094651_id: 35c6d7da-0715-42db-8b7a-b873cbb07ff2type: IPv4last_seen: 1487160033901

15/2/2017 08:07:04 -0500 inboundaggregator ACCEPT_WITHDRAW 192.168.1.61 confidence: 50sources: ["panos.syslog"]first_seen: 1487158094651panossyslog_devices: ["001606041772"]type: IPv4last_seen: 1487160033901 source_node: panos-syslog-miner

15/2/2017 08:07:04 -0500 inboundaggregator RECVD_WITHDRAW 192.168.1.61 confidence: 50sources: ["panos.syslog"]first_seen: 1487158094651panossyslog_devices: ["001606041772"]type: IPv4last_seen: 1487160033901 source_node: panos-syslog-miner

15/2/2017 08:07:04 -0500 panos-syslog-miner EMIT_WITHDRAW 192.168.1.61 _age_out: 1487163633901confidence: 50sources: ["panos.syslog"]first_seen: 1487158094651panossyslog_devices: ["001606041772"]type: IPv4last_seen: 1487160033901

15/2/2017 07:58:52 -0500 ThreatFeedMCRedWithValue DROP_UPDATE 213.211.198.62-213.211.198.62 confidence: 50sources: ["panos.syslog"]first_seen: 1487159482831panossyslog_devices: ["001606041772"]type: IPv4last_seen: 1487163532361 source_node: inboundaggregator

15/2/2017 07:58:52 -0500 ThreatFeedMCRedWithValue RECVD_UPDATE 213.211.198.62-213.211.198.62 confidence: 50sources: ["panos.syslog"]first_seen: 1487159482831panossyslog_devices: ["001606041772"]type: I

Re: panos_syslog IP indicator - withdraw

lmori — Fri, 17 Feb 2017 13:56:36 GMT

Hi @rchilukuri,

I think you have mixed prototype attributes and rule attributes, that's the reason age_out policy is ignored. The following setting should be in the syslog Miner prototype:

age_out:
   default: last_seen+30d
   interval: 1800
   sudden_death: false
attributes:
   confidence: 50
   type: IPv4
config:
   share_level: green

Re: panos_syslog IP indicator - withdraw

rchilukuri — Sun, 26 Feb 2017 15:16:44 GMT

Getting, Error validating, no "conditions" in rule

Not able to apply the rule with out any conditions.

Need a rule to list and keep the IP indicators for 30 days or more.

topic Re: panos_syslog IP indicator - withdraw in General Topics

panos_syslog IP indicator - withdraw

Re: panos_syslog IP indicator - withdraw

Re: panos_syslog IP indicator - withdraw