Reply
Highlighted
L3 Networker
Posts: 41
Registered: ‎04-03-2017
Accepted Solution

Autofocus Mindmeld whitelist microsoft

I'm running into an issue where I can pull in indicators from autofocus by creating a minemeld miner, the only problem is that I am getting a lot of windows.com and microsoft.com domains in the list.  I've had the search from autofocus entered as malicious/grayware/phishing, but still the miner is pulling in microsoft domains and windowsupadate.com domains that I want to  ensure are always whitelisted.  I have whitelist local miners that i can manually add these to, but how do I *.windowsupdate.com or *.microsoft.com  these so I never see these in the list.   These miners are useless to me if I can't more granularly control what is coming in on the list...

L7 Applicator
Posts: 951
Registered: ‎03-03-2011

Re: Autofocus Mindmeld whitelist microsoft

Hi @Sec101,

are you selecting only High Confidence indicators from AF? The microsoft.com, ... should all have low confidence.

L3 Networker
Posts: 41
Registered: ‎04-03-2017

Re: Autofocus Mindmeld whitelist microsoft

[ Edited ]

 

I think that was it.  Thank you.

 

Found it on one of your other posts:

https://live.paloaltonetworks.com/t5/MineMeld-Discussions/Confidence-level-in-logs/td-p/219849 

 

 

 

I was using the below ouput:

stdlib.feedRedWithValue

 

Your saying that if I filter by output node, with confidence greater than 75 I should be good to go and not have to worry about these?  Do you suggest specifying a Wildfire verdict in the search, or is that something that AF takes care of with confidence levels?

 

 

 

 

 

 

L7 Applicator
Posts: 951
Registered: ‎03-03-2011

Re: Autofocus Mindmeld whitelist microsoft

I would specify it to avoid processing useless samples, but AF also takes care of it in the IOC confidence level.

L3 Networker
Posts: 41
Registered: ‎04-03-2017

Re: Autofocus Mindmeld whitelist microsoft

Thank you.  This is the perfect answer for this.  Hopefully this helps someone else out as well.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!