topic Re: Minemeld missing new O365 web in General Topics

Minemeld missing new O365 web

soporteseguridad — Mon, 04 Dec 2017 11:47:41 GMT

Hi,

We have installed PA with Minemeld. Everything is working fine but sometimes we can not access to any function in O365 online (for example "to create a new word cocument"), so we go to PA and we see that in URL logs that PA is blocking this web. So we go to minemeld and we dont see ths new web. So we have to add this web in "allow list" in Minemeld.

Why Minemeld is not updating new O365 webs???? how could we solve this problem??

Thanks

Re: Minemeld missing new O365 web

xhoms — Mon, 04 Dec 2017 13:02:14 GMT

@soporteseguridad : Can you, please, share the URL that you are missing?

Re: Minemeld missing new O365 web

soporteseguridad — Mon, 04 Dec 2017 13:49:30 GMT

Hola Xavi!!

So i attach all the webs that we have been adding manually because Minemeld didnt update them.

Last week, customer cant create OneNote document online so in order to solve this issue we added this URL "euc-onenote.officeappslive.com". They had the similar problem with Excel and words online docs in the past.

From time to time customer opens an incident because any function in O365 online does not work. So we would like to know why Minemeld is not refreshing the feed properly.

If you need more info just let me know

Re: Minemeld missing new O365 web

lmori — Mon, 04 Dec 2017 13:56:39 GMT

Hi @soporteseguridad,

- which O365 miners are you using ?

- in the configuration of the EDL on PAN-OS are you adding the "?v=panosurl" parameter to the EDL URL ?

Like: https://minemeld/feeds/o365urls?v=panosurl

Thanks,

luigi

Re: Minemeld missing new O365 web

soporteseguridad — Mon, 04 Dec 2017 14:15:26 GMT

I attach config:

Re: Minemeld missing new O365 web

xhoms — Mon, 04 Dec 2017 14:53:42 GMT

@soporteseguridad : MineMeld does not "create" any URL. It just processes the ones published by Microsoft at https://support.content.office.net/en-us/static/O365IPAddresses.xml (https://support.office.com/en-us/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US)

the "euc-" URL's that you're missing are not published by MS. You should contat his support to inform of such an incident.

Re: Minemeld missing new O365 web

soporteseguridad — Mon, 04 Dec 2017 15:03:35 GMT

Yes, you are right, "euc-" webs are not included in O365 feed. Thats weird.....

Anyway we will try to contact to MS for this purpose...

Re: Minemeld missing new O365 web

lmori — Mon, 04 Dec 2017 15:10:22 GMT

In the feed there is one entry that covers it:

*onenote.officeapps.live.com

That is invalid for PAN-OS EDLs because URL components can be wildcard or strings That's why you should add the "?v=panosurl" parameter to the feed URL inside the EDL config, to convert that entry into a valid EDL entry:

*.officeapps.live.com

Re: Minemeld missing new O365 web

soporteseguridad — Mon, 04 Dec 2017 15:38:50 GMT

Ye, you are right. There is a wilcard for all these webs:

<address>*broadcast.officeapps.live.com</address>

<address>*excel.officeapps.live.com</address>

<address>*onenote.officeapps.live.com</address>

<address>*powerpoint.officeapps.live.com</address>

I just added it:

I will let you know the result.

Thanks a lot 🙂