O365 URL rewrite

[ckemp]

I'm using minemeld to pull the O365 urls into my PAN. I get a list that has entries like
*.domain.com
sub.domain1.com

I need to import those entries and rewrite them so they look like
*.domain.com/
domain.com/
*.sub.domain1.com/
sub.domain1.com/

Any pointers would be appreciated.

[lmori]

Hi @ckemp,

you need 0.9.52.post1, not available yet on the binary update channel. I will publish it tomorrow.

Luigi

[lmori]

@ckemp @Sec101, I have just published the binary package of 0.9.52.post1 to the update channel. This contains the improvement to the output feed to cope with PAN-OS limitation.

[ckemp]

Updated Minemeld.

Restart Minemeld engine and force import on PA. Not showing up in EDL.

[lmori]

Could you check directly the MineMeld feed with the browser?

luigi

[ckemp]

Pulled the file into Notepad++

[lmori · Accepted solution]

Hi @ckemp,

are you adding ?v=panosurl at the end of your feed URL?

The link in the EDL config should have the form:

https://<minemeld>/feeds/<feedname>?v=panosurl

[ckemp]

Adding "?v=panosurl" was the final piece. I am now seeing the correctly parsed url list. Thank you for your help.

[Sec101]

@lmori

Can you clarify the ?v=panosurl designation

We are using hosted version of minemeld, and does that affect this designation, or is this for internal hosted servers only? 

[ckemp]

It's an internal server.

[lmori]

Hi @Sec101,

this applies to both hosted and community version of MineMeld. Basically translates on the fly a list of URLs in a format that can be parsed by PAN-OS. More details about the different parameters here: https://live.paloaltonetworks.com/t5/MineMeld-Articles/Parameters-for-the-output-feeds/ta-p/146170

[Sec101]

Ah, thank you.  I see. I can see the value in the URL listing, as some of those tokens don't appear to match the correct format otherwise.  It looks like our firewalls are using the   x.x.x.x-x.x.x.x   ranges correctly, but is it preffered to utilize the ?tr=1 

CIDR option instead of the range?