topic syslog miner - please check rule syntax in General Topics

syslog miner - please check rule syntax

LucaMarchiori — Tue, 01 Aug 2017 21:55:49 GMT

Hi,

I just cloned a syslog miner, following the guide here:

https://live.paloaltonetworks.com/t5/MineMeld-Articles/Using-the-syslog-Miner/ta-p/77262

I can see the syslog processed counter moving, so looks like syslog forwarding is working. I'm trying to have any source IP that generates a "critical" TID to be added to the MineMeld EDL. I created the following rule (based on an example on the MineMeld forum):

conditions:
- type == 'THREAT'
- severity == 'critical'
- src_zone == 'WAN'
fields: null
indicators:
- src_ip

Does this look OK for what I'm trying to accomplish? ~~And how do I know if the rule is actually hit?~~

Luca

edit: oops I just noticed the "hits" column on the Rules page...

Re: syslog miner - please check rule syntax

lmori — Fri, 04 Aug 2017 12:30:07 GMT

Hi @LucaMarchiori,

looks good to me. Have you tested it already ?

I would probably add "log_subtype" and "threat_name" as fields in the rule, to save more context of the original log.

Thanks,

luigi

Re: syslog miner - please check rule syntax

LucaMarchiori — Fri, 04 Aug 2017 19:47:20 GMT

Hi lmori,

Do you mean something like this:

conditions:
- type == 'THREAT'
- severity == 'critical'
- src_zone == 'WAN'
fields:

- "log_subtype"

- "threat_name"
indicators:
- src_ip

I had 2 "high" severity and one "critical" events in the threat log since yesterday, and the counter this morning is still at zero hits.

This is the config currently (/opt/minemeld/local/config/syslog-miner_rules.yml):

- conditions: [type == 'THREAT', log_subtype == 'vulnerability', severity == 'high',
src_zone == 'WAN']
fields: null
indicators: [src_ip]
name: threats-ALL-high
- conditions: [type == 'THREAT', log_subtype == 'vulnerability', severity == 'critical',
src_zone == 'WAN']
fields: null
indicators: [src_ip]
name: threats-ALL-critical

** edit 2:

Got a few pages of "high" severity threat this morning (TID 40007). No hits on the syslog miner node.

Re: syslog miner - please check rule syntax

lmori — Mon, 07 Aug 2017 07:31:57 GMT

Hi @LucaMarchiori,

which PAN-OS version are you running ?

Thanks,

luigi

Re: syslog miner - please check rule syntax

LucaMarchiori — Tue, 08 Aug 2017 14:52:24 GMT

Hi Luigi,

I'm using 7.1.11

Re: syslog miner - please check rule syntax

LucaMarchiori — Tue, 15 Aug 2017 15:38:46 GMT

Hi lmori,

Any ideas why the miner node is not getting any hits? Is there a MineMeld rule help doc that I should be looking at instead?

Luca