Replacing office 365 from XML and RSS with Restful API

[chtoh82]

Hi all, 

In view of the changes Microsoft is going to make in future as describe in the following link, would the current miner for O365 still works?

https://support.office.com/en-gb/article/managing-office-365-endpoints-99cab9d4-ef59-4207-9f2b-3728e...

[lmori · Accepted solution]

Hi @chtoh82,

the new MSFT API is not production-ready yet. But we have already implemented the Miner for it:

https://github.com/PaloAltoNetworks/minemeld-core/issues/267

We will include it in a new release early next week.

luigi

[chtoh82]

Thanks! Looking forward to it!

[KengSeng]

Hi Luigi, as i can see the prototype for those miners based on China, Gemany, US and worldwide are still in experimental. May I know whether we already mined and feeding those IP and domains to the O365 output? Thanks.

[Fille01]

I tested the O365-API worldwide miner on the AF hosted minemeld:

# HTTPError: 400 Client Error: Bad Request

2018-08-16T11:00:52 (12932)basepoller.hup INFO: O365-Worldwide-Any-Service - hup received, force polling
2018-08-16T11:00:52 (12932)basepoller._huppable_wait INFO: hup is clear: False
2018-08-16T11:00:52 (12932)basepoller._actor_loop INFO: O365-Worldwide-Any-Service - command: 1534417252635 poll
2018-08-16T11:00:52 (12932)basepoller._polling_loop INFO: Polling O365-Worldwide-Any-Service
2018-08-16T11:00:52 (12932)connectionpool._new_conn INFO: Starting new HTTPS connection (1): endpoints.office.com
2018-08-16T11:00:52 (12932)basepoller._poll ERROR: Exception in polling loop for O365-Worldwide-Any-Service: 400 Client Error: Bad Request
Traceback (most recent call last):
File "/opt/minemeld/engine/0.9.46/local/lib/python2.7/site-packages/minemeld/ft/basepoller.py", line 721, in _poll
performed = self._polling_loop()
File "/opt/minemeld/engine/0.9.46/local/lib/python2.7/site-packages/minemeld/ft/basepoller.py", line 571, in _polling_loop
iterator = self._build_iterator(now)
File "/opt/minemeld/engine/0.9.46/local/lib/python2.7/site-packages/minemeld/ft/o365.py", line 352, in _build_iterator
latest_version = self._check_version()
File "/opt/minemeld/engine/0.9.46/local/lib/python2.7/site-packages/minemeld/ft/o365.py", line 252, in _check_version
r.raise_for_status()
File "/opt/minemeld/engine/0.9.46/local/lib/python2.7/site-packages/requests/models.py", line 851, in raise_for_status
raise HTTPError(http_error_msg, response=self)
HTTPError: 400 Client Error: Bad Request
2018-08-16T11:00:55 (12932)basepoller._polling_loop INFO: Polling O365-Worldwide-Any-Service
2018-08-16T11:00:55 (12932)connectionpool._new_conn INFO: Starting new HTTPS connection (1): endpoints.office.com
2018-08-16T11:00:55 (12932)basepoller._poll ERROR: Exception in polling loop for O365-Worldwide-Any-Service: 400 Client Error: Bad Request

Before posting this I tried China too, no difference. They all error out on the same thing.

[fwmike]

Same behavior on my MM.

[xhoms]

Hi @Fille01,

new O365 API Miners were officialy released with MineMeld version 0.9.50. Please, update your MineMeld instance before using the provided configuration files.

[xhoms]

Hi @fwmike,

( see https://live.paloaltonetworks.com/t5/MineMeld-Discussions/Replacing-office-365-from-XML-and-RSS-with... )

[Fille01]

Hello,

I used the AF hosted minemeld. However I changed to hosting one myself and that was updated, works OK.

[RamBalaji]

I also caught up with this 400 client error:bad request after replacing the scripts. I couldn't find version upgrade option in autofocus minemeld, can you share the link.

[Fille01]

---

@RamBalaji wrote:

I also caught up with this 400 client error:bad request after replacing the scripts. I couldn't find version upgrade option in autofocus minemeld, can you share the link.

---

I am pretty sure there is none.

[lmori]

Hi @RamBalaji,

which version of MineMeld for Autofocus are you running? Is it possible that you are running on version 0.9.46?

If that's the case you can upgrade MineMeld by going to Apps, stop MineMeld and restart it. DO NOT RESET!!

It's always better to do a full backup of MineMeld before doing a restart (under the tab SYSTEM).

[Fille01]

I can confirm that this solution works! It upgraded to 0.9.50 and o365 miner works.