MineMeld + Palo Alto Networks on Dynamic Block List

[dkoh]

Is there anyone able to share on how to configure minemeld nodes to automate resolving/capturing the “*.google.com.*” dynamic IP address, so I could integrate with palo alto networks dynamic Block list feature to identify most of the google.com IP addresses.

I saw google.GCENetblocks and google.netBlocks in minemeld, but wondering if this cover “*.google.com.*”. I will wish to know how to add a customize minemeld node on youtude if possible. For example on http/https “*.youtube.com.*”.

 

Your help is very much appreciated. Thanks a lot.

[lmori]

Hi,

google.netBlocks and google.GCENetBlocks retrieve the list of IP addresses used by Google services and Google GCE using DNS queries. Ref:

https://support.google.com/a/answer/60764?hl=en

https://cloud.google.com/compute/docs/faq#where_can_i_find_short_product_name_ip_ranges

Is this your goal ?

Thanks,

luigi

[dkoh]

Hi luigi,

Thanks for the information, yes this is on google. But how about Youtube.com, anyway we can set up a node on Youtube.com global list in the ProtoType?

Please let me know if this is possible in the minemeld. 

Thanks

Darren Koh

+65 91790713

[lmori]

Hi Darren,

I haven't found a way to obtain all the IPs used by Youtube. Wouldn't be better to control access using App-ID ? Or you need IPs ?

[dkoh]

Hi Luigi,

Customer would want to use PBF policy to route all Youtube Taffic to direct traffic to a specific Egress interface on the firewall.

The problem is our PBF policy dont have all APP-ID signature in it, such as Youtube, Facebook and etc.

Thanks

Darren Koh

[lmori]

Hi Darren,

understood. The problem is I can't find a good way to isolate the IPs used by Youtube from those used by other Google Services. 

Do you have an idea on how to do that ?

Thanks,

Luigi

[dkoh]

Hi Luigi,

I got a solution on this but it is a bit of work to do, we were need to create a new miner and proyotype as shown below:

https://github.com/PaloAltoNetworks/minemeld/wiki/How-To-Write-a-Simple-Miner#the-prototype

Hope this make sense to you. 

Thanks

Darren koh

[lmori]

Hi Darren,

writing a Miner would be definitely possible, but the example shown in the github doc is for retrieving a list of URLs associated with a YouTube channel. You can't use those in a PBF. Would a list of URLs be enough ?

Luigi

[dkoh]

Hi Luigi,

URLs will not be enough i was thinking of creating a miner/prototype to indicate all the youtube.com IP address in the miner to to make the Dynamic list works better. you have any insight on how this can works?

Thanks

Darren koh