MS O365 Dynamic IP addresses/Urls of Endpoints Url for MineMeld

Reply
L0 Member

MS O365 Dynamic IP addresses/Urls of Endpoints Url for MineMeld

In effort to understand the processing of the Microsoft Office 365 MS O365 Dynamic IP addresses/Urls of Endpoints Url (see MS url below) by the MineMeld application, where is the configuration file with this MS Office 365 url stored for the Minemeld application?

 

https://support.content.office.net/en-us/static/O365IPAddresses.xml

 

The Minemeld YAML configuration file for MS O365 Miners referenced in the following Palo Alto web page did not contain it.

 

https://live.paloaltonetworks.com/t5/MineMeld-Articles/How-to-Safely-Enable-access-to-Office-365-usi...

 

P.S. The MS Office url was found hardcoded in a python file. Is this location of the MS O365 url that is used? I would think that Microsoft does not change the url very often, but the information about this configuration would be needed if the url did change in the future.

 

Code snippet from /opt/minemeld/engine/0.9.40/lib/python2.7/site-packages/minemeld/ft/o365.py:

import requests

import lxml.etree

 

from . import basepoller

 

LOG = logging.getLogger(__name__)

 

O365_URL = \

    'https://support.content.office.net/en-us/static/O365IPAddresses.xml'

XPATH_FUNS_NS = 'http://minemeld.panw.io/o365functions'

XPATH_FUNS_PREFIX = 'o365f'

XPATH_PRODUCTS = "/products/product/@name"

BASE_XPATH = "/products/product[" + XPATH_FUNS_PREFIX + ":lower-case(@name)='%s']"

    def _build_request(self, now):

        r = requests.Request(

            'GET',

            O365_URL

        )

 

        return r.prepare()

L7 Applicator

Re: MS O365 Dynamic IP addresses/Urls of Endpoints Url for MineMeld

In the next release this URL will be made configurable, but the on in the Python file will be the default.

 

Luigi

L0 Member

Re: MS O365 Dynamic IP addresses/Urls of Endpoints Url for MineMeld

Imori...thanks for the info.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!