MS O365 Dynamic IP addresses/Urls of Endpoints Url for MineMeld

[Trek333]

In effort to understand the processing of the Microsoft Office 365 MS O365 Dynamic IP addresses/Urls of Endpoints Url (see MS url below) by the MineMeld application, where is the configuration file with this MS Office 365 url stored for the Minemeld application?

https://support.content.office.net/en-us/static/O365IPAddresses.xml

The Minemeld YAML configuration file for MS O365 Miners referenced in the following Palo Alto web page did not contain it.

https://live.paloaltonetworks.com/t5/MineMeld-Articles/How-to-Safely-Enable-access-to-Office-365-usi...

P.S. The MS Office url was found hardcoded in a python file. Is this location of the MS O365 url that is used? I would think that Microsoft does not change the url very often, but the information about this configuration would be needed if the url did change in the future.

Code snippet from /opt/minemeld/engine/0.9.40/lib/python2.7/site-packages/minemeld/ft/o365.py:

import requests

import lxml.etree

from . import basepoller

LOG = logging.getLogger(__name__)

O365_URL = \

    'https://support.content.office.net/en-us/static/O365IPAddresses.xml'

XPATH_FUNS_NS = 'http://minemeld.panw.io/o365functions'

XPATH_FUNS_PREFIX = 'o365f'

XPATH_PRODUCTS = "/products/product/@name"

BASE_XPATH = "/products/product[" + XPATH_FUNS_PREFIX + ":lower-case(@name)='%s']"

…

    def _build_request(self, now):

        r = requests.Request(

            'GET',

            O365_URL

        )

        return r.prepare()

[lmori · Accepted solution]

In the next release this URL will be made configurable, but the on in the Python file will be the default.

Luigi

[Trek333]

Imori...thanks for the info.