Minemeld missing new O365 web

[soporteseguridad]

Hi,

We have installed PA with Minemeld. Everything is working fine but sometimes we can not access to any function in O365 online (for example "to create a new word cocument"), so we go to PA and we see that in URL logs that PA is blocking this web. So we go to minemeld and we dont see ths new web. So we have to add this web in "allow list" in Minemeld.

Why Minemeld is not updating new O365 webs???? how could we solve this problem??

Thanks

[xhoms]

@soporteseguridad : Can you, please, share the URL that you are missing?

[soporteseguridad]

Hola Xavi!!

So i attach all the webs that we have been adding manually because Minemeld didnt update them.

Last week, customer cant create OneNote document online so in order to solve this issue we added this URL "euc-onenote.officeappslive.com". They had the similar problem with Excel and words online docs in the past.

From time to time customer opens an incident because any function in O365 online does not work. So we would like to know why Minemeld is not refreshing the feed properly. 

If you need more info just let me know

[lmori]

Hi @soporteseguridad,

- which O365 miners are you using ?

- in the configuration of the EDL on PAN-OS are you adding the "?v=panosurl" parameter to the EDL URL ?

Like: https://minemeld/feeds/o365urls?v=panosurl

Thanks,

luigi

[soporteseguridad]

I attach config:

[xhoms · Accepted solution]

@soporteseguridad : MineMeld does not "create" any URL. It just processes the ones published by Microsoft at https://support.content.office.net/en-us/static/O365IPAddresses.xml (https://support.office.com/en-us/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-ab...)

the "euc-" URL's that you're missing are not published by MS. You should contat his support to inform of such an incident.

[soporteseguridad]

Yes, you are right, "euc-" webs are not included in O365 feed. Thats weird.....

Anyway we will try to contact to MS for this purpose...

[lmori]

In the feed there is one entry that covers it: 

*onenote.officeapps.live.com

That is invalid for PAN-OS EDLs because URL components can be wildcard or strings That's why you should add the "?v=panosurl" parameter to the feed URL inside the EDL config, to convert that entry into a valid EDL entry:

*.officeapps.live.com

[soporteseguridad]

Ye, you are right.  There is a wilcard for all these webs:

<address>*broadcast.officeapps.live.com</address>

<address>*excel.officeapps.live.com</address>

<address>*onenote.officeapps.live.com</address>

<address>*powerpoint.officeapps.live.com</address>

I just added it:

I will let you know the result.

Thanks a lot 🙂