O365 URL rewrite

[Sec101]

@lmori

Can you reply to this thread once this is updated, or do you suggest we monitor github?  

[ckemp]

This thread. I do not monitor github.

[ckemp]

The rewrite rule is not working for top level domains, but it is for subdomains. I would expect to see 

*.skype.com

skype.com

It is working for *.broadcast.skype.com.

[lmori]

Hi @ckemp,

just tested this and I can see the doubled entries for skype.com. I am about to release the binary packages for the updates. Which version are you running on?

[ckemp]

I am on 0.9.52.

ubuntu@minemeld:~$ sudo /usr/sbin/minemeld-auto-update
2019-01-11 13:06:45,572 INFO:0.9.11 Current status:
2019-01-11 13:06:45,572 INFO:0.9.11 minemeld-engine: current: 0.9.52 latest: 0.9.52
2019-01-11 13:06:45,573 INFO:0.9.11 minemeld-webui: current: 0.9.52 latest: 0.9.52
2019-01-11 13:06:45,573 INFO:0.9.11 minemeld-prototypes: current: 0.9.52 latest: 0.9.52
2019-01-11 13:06:45,739 DEBUG:0.9.11 curl output:
2019-01-11 13:06:45,773 DEBUG:0.9.11 curl output:
2019-01-11 13:06:45,773 DEBUG:0.9.11 gpgv: /usr/bin/gpgv --ignore-time-conflict --keyring /etc/apt/trusted.gpg --keyring /etc/apt/trusted.gpg.d/minemeld.gpg /tmp/mmaupackagesgpgDWAPvd /tmp/mmaupackagesQUUdhl
2019-01-11 13:06:45,778 INFO:0.9.11 gpgv output: gpgv: Signature made Fri 07 Dec 2018 09:32:50 AM UTC using RSA key ID 7B630999
gpgv: Good signature from "Palo Alto Networks, MineMeld Team <minemeld@paloaltonetworks.com>"
gpgv: aka "[invalid image]"

2019-01-11 13:06:45,783 INFO:0.9.11 No package to deploy, exit
ubuntu@minemeld:~$

[lmori]

Hi @ckemp,

you need 0.9.52.post1, not available yet on the binary update channel. I will publish it tomorrow.

Luigi

[lmori]

@ckemp @Sec101, I have just published the binary package of 0.9.52.post1 to the update channel. This contains the improvement to the output feed to cope with PAN-OS limitation.

[ckemp]

Updated Minemeld.

Restart Minemeld engine and force import on PA. Not showing up in EDL.

[lmori]

Could you check directly the MineMeld feed with the browser?

luigi

[ckemp]

Pulled the file into Notepad++