Enhanced Security Measures in Place:   To ensure a safer experience, we’ve implemented additional, temporary security measures for all users.

Minemeld missing new O365 web

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements

Minemeld missing new O365 web

L4 Transporter

Hi,

 

We have installed PA with Minemeld. Everything is working fine but sometimes we can not access to any function in O365 online (for example "to create a new word cocument"), so we go to PA and we see that in URL logs that PA is blocking this web. So we go to minemeld and we dont see ths new web. So we have to add this web in "allow list" in Minemeld.

Why Minemeld is not updating new O365 webs???? how could we solve this problem??

 

Thanks

1 accepted solution

Accepted Solutions

@soporteseguridad : MineMeld does not "create" any URL. It just processes the ones published by Microsoft at https://support.content.office.net/en-us/static/O365IPAddresses.xml (https://support.office.com/en-us/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-ab...)

 

the "euc-" URL's that you're missing are not published by MS. You should contat his support to inform of such an incident.

 

View solution in original post

8 REPLIES 8

L5 Sessionator

@soporteseguridad : Can you, please, share the URL that you are missing?

Hola Xavi!!

 

So i attach all the webs that we have been adding manually because Minemeld didnt update them.

Last week, customer cant create OneNote document online so in order to solve this issue we added this URL "euc-onenote.officeappslive.com". They had the similar problem with Excel and words online docs in the past.

 

 

From time to time customer opens an incident because any function in O365 online does not work. So we would like to know why Minemeld is not refreshing the feed properly. 

 

 

Minemeld.JPG

If you need more info just let me know

Hi @soporteseguridad,

- which O365 miners are you using ?

- in the configuration of the EDL on PAN-OS are you adding the "?v=panosurl" parameter to the EDL URL ?

Like: https://minemeld/feeds/o365urls?v=panosurl

 

Thanks,

luigi

I attach config:

 

 

Miners.JPG

 

EDL.JPG

 

 

@soporteseguridad : MineMeld does not "create" any URL. It just processes the ones published by Microsoft at https://support.content.office.net/en-us/static/O365IPAddresses.xml (https://support.office.com/en-us/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-ab...)

 

the "euc-" URL's that you're missing are not published by MS. You should contat his support to inform of such an incident.

 

Yes, you are right, "euc-" webs are not included in O365 feed. Thats weird.....

Anyway we will try to contact to MS for this purpose...

In the feed there is one entry that covers it: 

*onenote.officeapps.live.com

That is invalid for PAN-OS EDLs because URL components can be wildcard or strings That's why you should add the "?v=panosurl" parameter to the feed URL inside the EDL config, to convert that entry into a valid EDL entry:

*.officeapps.live.com

 

Ye, you are right.  There is a wilcard for all these webs:

 

<address>*broadcast.officeapps.live.com</address>
<address>*excel.officeapps.live.com</address>
<address>*onenote.officeapps.live.com</address>
<address>*powerpoint.officeapps.live.com</address>
 
I just added it:
 
feed.JPG
I will let you know the result.
 
Thanks a lot 🙂
  • 1 accepted solution
  • 6581 Views
  • 8 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!