Bulk submission support using Web GUI? and CLI access to minemeld hosted in Autofocus?

[lgiancaterini]

I cannot see a way to do bulk submissions from the Web GUI that I know of so are there plans on having that capability in a future Minemeld release?

how to get CLI access to Minemeld hosted in Autofocus?

[chirss]

What do you mean by bulk submissions?

[lgiancaterini]

IP addresses, URL's, domains into a Minor.

[chirss]

Put the list into a file on a web server and point a miner to it.

[lmori]

An alternative is defining 3 local Miners and push indicators to the Miner using MineMeld API.

[Kyle_Buffington]

I was looking for this same information. I need to add 632 IP addresses to my current running IPv4 Blacklist feed and doing this 1 at a time via the GUI is a PITA.  I like to put comments on my submissions so I will know what they are down the road. 

[lmori]

Hi @Kyle_Buffington,

I have created as script that can be used to synchronize a local list of IPs with a local Miner in MineMeld:

https://gist.github.com/jtschichold/95f3906566b18b50cf2e3e1a44f1e785

The script reads a list of IPs/URLs/domains from a local file and uses the MineMeld API to push or remove indicators from a remote stdlib.local* Miner in a MineMeld instances.

[Kyle_Buffington]

Thank you for the script @lmori. Asking a peer for help because that is way out of my realm of how to use.  I basicaly login via the web gui and add a manual IP to our blacklist is the extent of my knowledge of MineMeld and scripting. 🙂 

[lmori]

Hi @Kyle_Buffington,

I just published an article about using the script:

https://live.paloaltonetworks.com/t5/MineMeld-Articles/Uploading-list-of-indicators-to-MineMeld/ta-p...

[Kyle_Buffington]

Awesome! Thank you!

[Kyle_Buffington]

 Being able to add a Comment field in the script would be much appreciated Luigi.  I like to mark why I am blacklisting an IP and have record of what it was weeks later when I am looking at the IP Addresses as a reminder. Possible?

I am doing 632 comments manually right now in the GUI after running the script to add all those IP addresses to my Miner. 

[lmori]

Hi @Kyle_Buffington,

absolutely, that's something I wanted to add. About the syntax, would something like this work ?

# comment for indicator1
indicator1
# comment for indicator2
indicator2
...

Example

# Google Public DNS 1
8.8.8.8
# Google Public DNS 2
8.8.4.4

[Kyle_Buffington]

@lmori Yes that works well I believe. 

[sbayrak]

Hi lmori, 

Palo Alto told me that it was impossible to push anything to MineMeld hosted in Autofocus by using MineMeld API? 

It could only be done with your own MineMeld instance hosted anywhere else, that's what they added... is that the case?

Cheers

[Hongji.Guo]

Hello lmori.

Where does your script install ?  on the minemeld host ? if yes, I need access to the CLI of minemeld which I don't have

Thanks

HJ