- Access exclusive content
- Connect with peers
- Share your expertise
- Find support resources
11-15-2018 03:03 PM
I'm using minemeld to pull the O365 urls into my PAN. I get a list that has entries like
*.domain.com
sub.domain1.com
I need to import those entries and rewrite them so they look like
*.domain.com/
domain.com/
*.sub.domain1.com/
sub.domain1.com/
Any pointers would be appreciated.
01-13-2019 12:38 AM
Hi @ckemp,
you need 0.9.52.post1, not available yet on the binary update channel. I will publish it tomorrow.
Luigi
01-15-2019 08:32 AM
Updated Minemeld.
Restart Minemeld engine and force import on PA. Not showing up in EDL.
01-15-2019 08:35 AM
Could you check directly the MineMeld feed with the browser?
luigi
01-15-2019 09:05 AM
Pulled the file into Notepad++
01-16-2019 03:04 AM
Hi @ckemp,
are you adding ?v=panosurl at the end of your feed URL?
The link in the EDL config should have the form:
https://<minemeld>/feeds/<feedname>?v=panosurl
01-16-2019 06:13 AM
Adding "?v=panosurl" was the final piece. I am now seeing the correctly parsed url list. Thank you for your help.
01-16-2019 07:25 AM
Can you clarify the ?v=panosurl designation
We are using hosted version of minemeld, and does that affect this designation, or is this for internal hosted servers only?
01-16-2019 07:54 AM
It's an internal server.
01-16-2019 08:00 AM
Hi @Sec101,
this applies to both hosted and community version of MineMeld. Basically translates on the fly a list of URLs in a format that can be parsed by PAN-OS. More details about the different parameters here: https://live.paloaltonetworks.com/t5/MineMeld-Articles/Parameters-for-the-output-feeds/ta-p/146170
01-16-2019 08:10 AM
Ah, thank you. I see. I can see the value in the URL listing, as some of those tokens don't appear to match the correct format otherwise. It looks like our firewalls are using the x.x.x.x-x.x.x.x ranges correctly, but is it preffered to utilize the ?tr=1
CIDR option instead of the range?
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!