I can't get IPs from output of minemeld in autofocus.

[KiCheonLee]

Hello,

I can't get IPs from output of minemeld in autofocus.

Please refer to the follwoing message and then give me any assistance.

I can see IPs when I enter the follwoing url on a browser.

https://0b2b72a3.paloaltonetworks-app.com/feeds/feedMCWithValue-Malware-IP

vsys1/ActiveCampaignsIPv4:
        Next update at        : Mon Jan 29 12:03:25 2018
        Source                : https://0b2b72a3.paloaltonetworks-app.com/feeds/feedMCWithValue-Malware-IP
        Referenced            : Yes
        Valid                 : Yes
        Auth-Valid            : Yes
        Total invalid entries : 1
        Valid ips:

        Invalid ips:
                Unauthorizedweb

$//g' /opt/pancfg/mgmt/devices/localhost.localdomain/vsys1_ActiveCampaignsIPv4.ebl.tmpxx 2>/dev/null > /opt/pancfg/mgmt/devices/localhost.localdomain/vsys1_ActiveCampaignsIPv4.ebl.tmpCampaignsIPv4, 1, 1 ip) calling /bin/sed -e  's/
2018-01-29 11:58:57.816 +0900 EDL entry(0x160e000, 0x182c6800, 0x7100400 vsys1/ActiveCampaignsIPv4, 1, 1 ip) Downloaded EDL file size(1036)
2018-01-29 11:58:57.880 +0900 EDL entry(0x160e000, 0x182c6800, 0x7100400 vsys1/ActiveCampaignsIPv4, 1, 1 ip) Valid entries(0) lines skipped(1)
2018-01-29 11:58:57.890 +0900 EDL entry(0x160e000, 0x182c6800, 0x7100400 vsys1/ActiveCampaignsIPv4, 1, 1 ip) No valid ips found in list file
2018-01-29 11:59:07.988 +0900 client device reported Phase 1 was SUCCESSFUL
2018-01-29 11:59:08.139 +0900 EDL entry(0x160e000, 0x182c6800, 0x7100400 vsys1/ActiveCampaignsIPv4, 1, 1 ip) Refresh job success
2018-01-29 11:59:08.189 +0900 EDL FREE EDL Refresh timer job (0x9df6d00, 2096)
2018-01-29 12:00:00.178 +0900 Checking to purge appstatdb logtype

[xhoms · Accepted solution]

Hi @KiCheonLee,

it looks like an authentication missconfiguration in the PANOS device. Could you, please, check you've followed the steps highlined in the article article Connecting PAN-OS to MineMeld using External Dynamic Lists ?

[KiCheonLee]

Hi @xhoms

Thanks for your reply and advise.

I saw the document and checked it before you wrote the link. But it didn't work.

But I checked it again from step 1 after all configuration was removed. It works well.

Have a good day.