Link autofocus and minemeld

[Sarou22]

Hello,

Could you please explain me the link between autofocus and minemeld?

Thank you.

[LAYER_8]

Sure, Autofocus is being sunset in favor of Cortex XSOAR Threat Intel Management (TIM). 

Essentially, during a security incident, it's hard to investigate and operationalize data. To get questions answered like "is this a targeted attack, or generalized script? Who is the perpetrator, how do we stop them? What assets are at risk, where are attacks coming from and going to?" All that in a centralized place. Find that overview here.

Minemeld is a free tool that collects data and aggregates them into lists. For example, if you wanted to write a rule that allowed traffic using application "Facebook" only to known Facebook IPs, minemeld will be able to scrape those and output them into an EDL for the NGFW to ingest. 

[JimMcGrady]

Xsoar seems like a much bigger system than Minemeld or Autofocus.  Is there anything that simply does the threat list aggregation and formatting for Palo, without all the other functions?

[LAYER_8]

Minemeld is still community supported here on LiveCommunity, so you can use it to build your custom lists and import threat feeds, if you choose. 

We also maintain some of our own lists here. With threat prevention subscription we give you 4 different EDLs specific to threat, as well. 

[BPry]

Just as an FYI, the MineMeld image hasn't gotten updated in quite a long time. You could continue to utilize the Docker image and properly isolate it to become less of an issue, but it's still pretty outdated.

ENVOY is a potential solution you could look into along with EDL Manager depending on the feature set that you actually need to utilize.