Bulk submission support using Web GUI? and CLI access to minemeld hosted in Autofocus?

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Bulk submission support using Web GUI? and CLI access to minemeld hosted in Autofocus?

L2 Linker

I cannot see a way to do bulk submissions from the Web GUI that I know of so are there plans on having that capability in a future Minemeld release?

 

how to get CLI access to Minemeld hosted in Autofocus?

14 REPLIES 14

L3 Networker

What do you mean by bulk submissions?

IP addresses, URL's, domains into a Minor.

Put the list into a file on a web server and point a miner to it.

An alternative is defining 3 local Miners and push indicators to the Miner using MineMeld API.

I was looking for this same information. I need to add 632 IP addresses to my current running IPv4 Blacklist feed and doing this 1 at a time via the GUI is a PITA.  I like to put comments on my submissions so I will know what they are down the road. 

Hi @Kyle_Buffington,

I have created as script that can be used to synchronize a local list of IPs with a local Miner in MineMeld:

https://gist.github.com/jtschichold/95f3906566b18b50cf2e3e1a44f1e785

 

The script reads a list of IPs/URLs/domains from a local file and uses the MineMeld API to push or remove indicators from a remote stdlib.local* Miner in a MineMeld instances.

Thank you for the script @lmori. Asking a peer for help because that is way out of my realm of how to use.  I basicaly login via the web gui and add a manual IP to our blacklist is the extent of my knowledge of MineMeld and scripting. 🙂 

Awesome! Thank you!

 Being able to add a Comment field in the script would be much appreciated Luigi.  I like to mark why I am blacklisting an IP and have record of what it was weeks later when I am looking at the IP Addresses as a reminder. Possible?

 

I am doing 632 comments manually right now in the GUI after running the script to add all those IP addresses to my Miner. 

Hi @Kyle_Buffington,

absolutely, that's something I wanted to add. About the syntax, would something like this work ?

# comment for indicator1
indicator1
# comment for indicator2
indicator2
...

Example

# Google Public DNS 1
8.8.8.8
# Google Public DNS 2
8.8.4.4

@lmori Yes that works well I believe. 

Hi lmori

Palo Alto told me that it was impossible to push anything to MineMeld hosted in Autofocus by using MineMeld API

It could only be done with your own MineMeld instance hosted anywhere else, that's what they added... is that the case?

Cheers

Hello lmori.

Where does your script install ?  on the minemeld host ? if yes, I need access to the CLI of minemeld which I don't have

Thanks

 

HJ

  • 9480 Views
  • 14 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!