topic Really good tool! in General Topics

Really good tool!

jochristian — Thu, 25 Feb 2016 14:30:27 GMT

Hi,

This is an really good tool for managing dynamic lists.
So far I have tested a basic setup and I have a few comments/suggestions.

* How do I change the ssl certificate for MineMeld.

* Will you also implement domain blocklists soons (currently running 7.1 beta).
* How about making our own miner. Information about this.
* Will you also support ipv6?

Just a few things that I thought of.

Thanks for this great tool. Looking forward to the development!

/Jo Christian

Re: Really good tool!

lmori — Thu, 25 Feb 2016 14:59:59 GMT

Thanks ! We are glad you like it !

1) cetificate and private key are stored in /etc/nginx/minemeld.cer and /etc/nginx/minemeld.pem. You can just replace them with your cert and private key and "sudo service nginx reload"

2) already supported. zeustracker.baddomains, autofocus.exportlist produce also domains. If you have a specific domain feed you are interested in, please let me know. If you look at the autofocus video, you can find instructions on how to add a new subgraph for handling domains (domain aggregator + output feeds)

https://live.paloaltonetworks.com/t5/MineMeld-Discussions/Video-MineMeld-on-AWS-amp-Autofocus-Export-Lists/m-p/73245

3) 2 ways to do this: writing your own prototype with a configuration of an existing miner class or write your own full miner, if the protocol or format of the feed is not supported yet by one of the existing miner classes. We are working on the documentation for both options. Stay tuned, at least for the first option it will be just a matter of days. Some users have already started contributing prototypes, but with the docs it will be much easier for everyone 🙂

4) IPv6 is already supported to some extent, there are still some glitches we are working on. A full IPv6 aggregator is in roadmap.

Thanks again,

Luigi

Re: Really good tool!

jochristian — Thu, 25 Feb 2016 15:17:32 GMT

Hi,

Thanks for your update.
I downloaded the ova file, and I noticed now that there are many updates for this Ubuntu image.
Could I get any problems updating the packages in Ubuntu outdated, with Minemeld?

/Jo Christian

Re: Really good tool!

lmori — Thu, 25 Feb 2016 15:27:40 GMT

Absolutely, you can also use Ubuntu mechanism to automatically install security updates:

http://askubuntu.com/questions/194/how-can-i-install-just-security-updates-from-the-command-line

Re: Really good tool!

jochristian — Thu, 25 Feb 2016 15:38:18 GMT

Perfect!

Regarding url/domain lists I have used this one in 7.1 beta. Looks good.

https://openphish.com/feed.txt <-- URL feed

Maybe something to add to Minemeld?

/Jo Christian

Re: Really good tool!

lmori — Thu, 25 Feb 2016 16:46:59 GMT

Thanks ! I have just added the prototype to the library.

You will find a miner for it in the next release. It generates URL indicators.

Re: Really good tool!

jochristian — Fri, 26 Feb 2016 11:50:46 GMT

Nice! 🙂

BTW, I found openphish, and a few other feeds that I am testing on this webpage:

https://zeltser.com/malicious-ip-blocklists/
A few of them could be quite interesting to add to Minemeld.

/Jo Christian

Re: Really good tool!

lmori — Fri, 26 Feb 2016 12:06:06 GMT

Thanks, we will take a look at those.