- Access exclusive content
- Connect with peers
- Share your expertise
- Find support resources
Enhanced Security Measures in Place: To ensure a safer experience, we’ve implemented additional, temporary security measures for all users.
on 12-20-2018 11:26 AM - edited on 10-28-2019 08:44 AM by Retired Member
This article has been updated to reflect changes to the Azure AD Application registration process and to point users to a new MineMeld output node. The old node will be deprecated.
If you are not familiar with MineMeld, we recommend you start with a Quick Tour.
MineMeld can be used to aggregate multiple threat intelligence feeds and extend to your Windows Defender ATP tenant. Windows Defender ATP can ingest:
There are three steps to connecting MineMeld to Windows Defender ATP:
Create a name for this application. All of the alerts tied to the threat intelligence coming from MineMeld will be attributed to this application name. We recommend calling this "Palo Alto Networks MineMeld" to avoid any confusion.
NOTE: You do not need to set a redirect URI.
Click Add a Permission.
Click APIs my organization uses, type “Windows” in the search bar, and select WindowsDefendertATP.
Click New Client Secret.
Copy the client secret you created.
Click the GitHub icon in the lower, right-hand corner, then copy this link “https://github.com/PaloAltoNetworks/minemeld-wd-atp.git” and paste into the Repository URL field. Click the dropdown menu for Version and select “master” then click Install.
Click the checkmark to activate the extension.
The extension will activate shortly, and the empty square will signify the extension is active.
NOTE: After the restart completes, make sure you refresh the browser page.
NOTE: The “microsoft_wd_atp.output” node will be deprecated as it relies on an older API interface. Please do not use that node.
NOTE: To understand the concepts of input nodes and what to connect to this, refer to the MineMeld documentation on LIVEcommunity.
Click NODES on the top menu and search for the node you just created. Click the node to pull up the configuration.
In Azure AD, enter the Client ID (Application), Client Secret, and Tenant (Directory) ID you copied earlier when you created the MineMeld application.
NOTE: After this is done, your configuration will then be complete.
To validate this is hooked up correctly, you will need to verify that an event fires if you try to access a blocked website. We recommend you create an indicator that is tied to a known good website for this, so you are not actively going to a malicious website.
You can find out more information about this capability by reading Pushing custom Indicator of Compromise (IoCs) to Microsoft Defender ATP on the Microsoft website.
Does anyone have any ideas on how to troubleshoot this?
I have everything configured as it should be, I think and I'm not seeing any errors, I just don't see any alerts coming through into WDATP when I do my testing?
Anyone have any tips?
**EDIT** - Seems like this was user error, I'd configured the wrong output plugin 🙂
Update: ran pip install adal and then restarted Minemeld and it worked.
I get an error when it tries to load the API. I have no idea what this means:
microsoftWDATPWebui not loadable: adal not installed
Anyone come across this?
I am facing an issue with Setting Up the Output Node to Complete the Integration
After successfully cloning the git to minemeld,
restarted the API
refreshed browser
clicked on CONFIG, and clicked on the Browse Prototype icon.
searched 'windows' to find “microsoft_wd_atp.outputBatch” node but couldnt find it. only stdlib.aggregatorWindowsRegistryValue PROCESSOR is visible in search results.
I have the same issue as rakeshnarayanan1993, no prototype to select on step 2 of Setting Up the Output Node to Complete the Integration.
I only have this option when typing Windows into the search box :
If the extension is correctly installed and you don't see the OutputBatch node in the configuration, please try restarting minemeld from the CLI:
sudo systemctl restart minemeld
Also, please make sure you fully refresh the browser (Ctrl-F5 on Chrome)
Hello Fvigo,
Thanks for your contribution. But I have an issue about the IPs.
Currently I can sync the URL/Domain and SHA256 from Minemeld to MDATP. But only IP doesn't work. The IP list is a local custom IP list. MINER configuration is following:
I can successfully OUTPUT the list, but MDATP doesn't work. Both used same PROCESSOR.
Hi,
Just installed the extension from official Github repository but some reasons when I go to the nodes after cloning the batch output prototype, I don't see the fields to set the client ID, secret and Tenant ID.
Have you already encountered this "bug" ?