Minemeld missing new O365 web

Reply
L4 Transporter

Minemeld missing new O365 web

Hi,

 

We have installed PA with Minemeld. Everything is working fine but sometimes we can not access to any function in O365 online (for example "to create a new word cocument"), so we go to PA and we see that in URL logs that PA is blocking this web. So we go to minemeld and we dont see ths new web. So we have to add this web in "allow list" in Minemeld.

Why Minemeld is not updating new O365 webs???? how could we solve this problem??

 

Thanks

L5 Sessionator

Re: Minemeld missing new O365 web

@soporteseguridad : Can you, please, share the URL that you are missing?

L4 Transporter

Re: Minemeld missing new O365 web

Hola Xavi!!

 

So i attach all the webs that we have been adding manually because Minemeld didnt update them.

Last week, customer cant create OneNote document online so in order to solve this issue we added this URL "euc-onenote.officeappslive.com". They had the similar problem with Excel and words online docs in the past.

 

 

From time to time customer opens an incident because any function in O365 online does not work. So we would like to know why Minemeld is not refreshing the feed properly. 

 

 

Minemeld.JPG

If you need more info just let me know

L7 Applicator

Re: Minemeld missing new O365 web

Hi @soporteseguridad,

- which O365 miners are you using ?

- in the configuration of the EDL on PAN-OS are you adding the "?v=panosurl" parameter to the EDL URL ?

Like: https://minemeld/feeds/o365urls?v=panosurl

 

Thanks,

luigi

L4 Transporter

Re: Minemeld missing new O365 web

I attach config:

 

 

Miners.JPG

 

EDL.JPG

 

 

L5 Sessionator

Re: Minemeld missing new O365 web

@soporteseguridad : MineMeld does not "create" any URL. It just processes the ones published by Microsoft at https://support.content.office.net/en-us/static/O365IPAddresses.xml (https://support.office.com/en-us/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-ab...)

 

the "euc-" URL's that you're missing are not published by MS. You should contat his support to inform of such an incident.

 

L4 Transporter

Re: Minemeld missing new O365 web

Yes, you are right, "euc-" webs are not included in O365 feed. Thats weird.....

Anyway we will try to contact to MS for this purpose...

L7 Applicator

Re: Minemeld missing new O365 web

In the feed there is one entry that covers it: 

*onenote.officeapps.live.com

That is invalid for PAN-OS EDLs because URL components can be wildcard or strings That's why you should add the "?v=panosurl" parameter to the feed URL inside the EDL config, to convert that entry into a valid EDL entry:

*.officeapps.live.com

 

L4 Transporter

Re: Minemeld missing new O365 web

Ye, you are right.  There is a wilcard for all these webs:

 

<address>*broadcast.officeapps.live.com</address>
<address>*excel.officeapps.live.com</address>
<address>*onenote.officeapps.live.com</address>
<address>*powerpoint.officeapps.live.com</address>
 
I just added it:
 
feed.JPG
I will let you know the result.
 
Thanks a lot :)
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!