Syslog Miner -> DAG Output

[apackard]

Is it possible to chain a syslog input\miner to a DAG output?

Scenario is I'd like to forward critical Threats to MineMeld to block the source address permanently (or at least longer than the max 3,600 seconds available as a block-ip IPS action) by bouncing back a DAG update (or failing that by adding to an EDL source etc).

I have a way of doing this currently but it's a bit complex, so hoping I can do so within MM.

Thanks

[lmori · Accepted solution]

Hi @apackard,

check this article to do this via HTTP Log forwarding from PAN-OS:

https://live.paloaltonetworks.com/t5/MineMeld-Articles/Using-MineMeld-as-an-Incident-Response-Platfo...