syslog miner - please check rule syntax

[LucaMarchiori]

Hi,

I just cloned a syslog miner, following the guide here:

https://live.paloaltonetworks.com/t5/MineMeld-Articles/Using-the-syslog-Miner/ta-p/77262

I can see the syslog processed counter moving, so looks like syslog forwarding is working.  I'm trying to have any source IP that generates a "critical" TID to be added to the MineMeld EDL.  I created the following rule (based on an example on the MineMeld forum):

conditions:
- type == 'THREAT'
- severity == 'critical'
- src_zone == 'WAN'
fields: null
indicators:
- src_ip

Does this look OK for what I'm trying to accomplish?  And how do I know if the rule is actually hit?  

Luca
 

edit: oops I just noticed the "hits" column on the Rules page...

[lmori]

Hi @LucaMarchiori,

looks good to me. Have you tested it already ?

I would probably add "log_subtype" and "threat_name" as fields in the rule, to save more context of the original log.

Thanks,

luigi

[LucaMarchiori]

Hi lmori,

Do you mean something like this:

conditions:
- type == 'THREAT'
- severity == 'critical'
- src_zone == 'WAN'
fields:

  - "log_subtype"

  - "threat_name"
indicators:
- src_ip

I had 2 "high" severity and one "critical" events in the threat log since yesterday, and the counter this morning is still at zero hits. 

This is the config currently (/opt/minemeld/local/config/syslog-miner_rules.yml):

- conditions: [type == 'THREAT', log_subtype == 'vulnerability', severity == 'high',
src_zone == 'WAN']
fields: null
indicators: [src_ip]
name: threats-ALL-high
- conditions: [type == 'THREAT', log_subtype == 'vulnerability', severity == 'critical',
src_zone == 'WAN']
fields: null
indicators: [src_ip]
name: threats-ALL-critical

** edit 2:

Got a few pages of "high" severity threat this morning (TID 40007).  No hits on the syslog miner node.

[lmori]

Hi @LucaMarchiori,

which PAN-OS version are you running ?

Thanks,

luigi

[LucaMarchiori]

Hi Luigi,

I'm using 7.1.11

[LucaMarchiori]

Hi lmori,

Any ideas why the miner node is not getting any hits?  Is there a MineMeld rule help doc that I should be looking at instead?

Luca