topic Re: O365: No Indicators, Miner not working in General Topics

O365: No Indicators, Miner not working

${userLoginName} — Thu, 02 Mar 2017 08:15:20 GMT

Hi,

we use Minemeld for grabbing the Microsoft Office 365 IP's and URL's.

It run's on a VMWare Server, build with the "Full" .ova with Ubuntu & Minemeld.

The installation works fine. After importing the config "office365-config.yml" no indicators are shown.

I tried to import every single Miner with saving and restarting the engine.

This works so far, until it runs for a week. Then the miners doesn't work anymore.

At this time in the engine-Log only appears: "2017-03-02T08:43:36 (1487)mgmtbus._status_loop ERROR: timeout in waiting for status updates from nodes".

Since this error the engine is very slow in restarting, up to 20 min.

In our PA-Firewall i see the traffic of this machine, nothing is blocked.

The Minemeld-Version is up to date.

Anybody a clue?

Greets

Re: O365: No Indicators, Miner not working

lmori — Thu, 02 Mar 2017 15:31:15 GMT

Hi @${userLoginName},

there is a bug in the current release with O365 Miners that will be fixed in the next release (early next week).

In the meantime if you are interested in all the IPs and URLs of O365 you can use this config that doesn't trigger the bug:

https://paloaltonetworks.box.com/s/gndwe5rzheg1ekwplxb4m3mrpcf5k41f

Luigi

Re: O365: No Indicators, Miner not working

lmori — Tue, 07 Mar 2017 05:30:10 GMT

Fixed in MM 0.9.34.