topic What's new in MineMeld 0.9.7 in General Topics

What's new in MineMeld 0.9.7

lmori — Tue, 29 Mar 2016 09:05:16 GMT

Release Date: 2016-03-24

How to update: Updating MineMeld

Nodes

- Miner for ProofPoint ET Pro feeds

- Miner for PAN-OS syslog messages, let you extract indicators from PAN-OS logs according to a set of rules

- now you can add a new static indicator directly from the NODES page or using the log-links feature of PAN-OS

Retired Member — Tue, 05 Apr 2016 12:00:13 GMT

do you have the log link command to allow the firewall add static indicator directly to Minemeld ?

lmori — Tue, 05 Apr 2016 14:20:22 GMT

Hi bartoq,

you can use something like this:

set deviceconfig system log-link MineMeld.Src url https://<minemeld address>/#/indicator/add?indicator={src}&indicatorType=IPv4

set deviceconfig system log-link MineMeld.Dst url https://<minemeld address>/#/indicator/add?indicator={dst}&indicatorType=IPv4

luigi

axel.bodart — Wed, 06 Apr 2016 08:46:06 GMT

Hi Luigi,

Could you also please show how the definition of a rule should look like ?

Axel.

lmori — Wed, 06 Apr 2016 23:09:23 GMT

Hi Axel,

I am working on the documentation of the syslog miner, it should happen early next week.

Thanks,

luigi

Retired Member — Mon, 18 Apr 2016 04:28:44 GMT

hi Luigi,

where do I use the miner in the log link ? I only see the indicator type and IP address. shouldnt we configure the miner in the log link as well ?

lmori — Mon, 18 Apr 2016 07:34:25 GMT

Hi bartoq,

the link will redirect to a MineMeld page where you can specify the Miners you want to add the indicator to.

Retired Member — Mon, 18 Apr 2016 12:51:36 GMT

Revision on the log link commands, missing the double quotes.