topic Re: Problem using URL-filterlists for PA in General Topics

Problem using URL-filterlists for PA

RalfBoehm — Fri, 29 Jul 2016 12:31:15 GMT

Hello,

I am very happy, that I can create dynamical lists for using it in the PA. So I use ransomwaretracker.RW_URLBL with stdlib-aggregatorURL as prozessor and stdlib.feedHCGreen as output to create a URL-list. So I got a list like:

...
http://217.64.197.138/~rivista_ipi/4kkmkfz
http://237travellin.com/92nwao23
http://237travellin.com/telo70
...

I have tested it as described in:

https://live.paloaltonetworks.com/t5/PAN-OS-7-1-Videos/PAN-OS-7-1-URL-Filtering-Dynamic-Block-List-External-Block-List/ta-p/74098

But it does not work. It's works only, if the entries in the list not have a leading "http://". It's ok, the sites can also have https, and for checking a URL, it is not important. What's wrong? Have I make a mistake? Or is this a issue (Minemeld or PaloAlto?)?

Thanks for your efforts

Re: Problem using URL-filterlists for PA

lmori — Fri, 29 Jul 2016 12:38:01 GMT

Hi Bohem,

you should append "?v=panosurl" to the URL of the feed inside the EDL configuration. Something like:

https://<minemeld>/feeds/ransomwarefeed?v=panosurl

This will instruct MineMeld to convert URL indicators into PAN-OS EDL format.

Luigi

Re: Problem using URL-filterlists for PA

RalfBoehm — Fri, 29 Jul 2016 12:53:56 GMT

Hi Luigi,

great (and very fast answer 😉 ) I have really search befor I ask this questions. 😉 Ok. Now it's works, and I will have a nice weekend. 🙂 Thank you very mutch.

Is there a list of options, which can used for fromatting the lists?

Ralf

Re: Problem using URL-filterlists for PA

lmori — Fri, 29 Jul 2016 13:06:14 GMT

Hi Ralf,

there is no much documentation about the format. Currently (0.9.18) you can use the following values for the v parameter:

<no v parameter> - output format is just a plain text list of indicators

json - output in JSON

json-seq - output in JSON SEQ format (RFC7464)

panosurl - for URL indicators, formatted in PAN-OS EDL compatible format

Note that for json and json-seq to show attributes of the indicators, the output node should be based on prototypes feed*WithValue. Example: if you use feedHCGreen you are only able to see the indicators in the output. If instead you use feedHCGreenWithValue, you are also able to see all the attributes of each indicator.

Thanks,

luigi

Re: Problem using URL-filterlists for PA

dkoh — Mon, 05 Sep 2016 02:17:10 GMT

Luigi, Thanks alot, i need this too, you never fail to impress us. 😃