- Access exclusive content
- Connect with peers
- Share your expertise
- Find support resources
Enhanced Security Measures in Place: To ensure a safer experience, we’ve implemented additional, temporary security measures for all users.
08-01-2017 02:13 PM - edited 08-01-2017 02:55 PM
Hi,
I just cloned a syslog miner, following the guide here:
https://live.paloaltonetworks.com/t5/MineMeld-Articles/Using-the-syslog-Miner/ta-p/77262
I can see the syslog processed counter moving, so looks like syslog forwarding is working. I'm trying to have any source IP that generates a "critical" TID to be added to the MineMeld EDL. I created the following rule (based on an example on the MineMeld forum):
conditions:
- type == 'THREAT'
- severity == 'critical'
- src_zone == 'WAN'
fields: null
indicators:
- src_ip
Does this look OK for what I'm trying to accomplish? And how do I know if the rule is actually hit?
Luca
edit: oops I just noticed the "hits" column on the Rules page...
08-04-2017 05:29 AM - edited 08-04-2017 05:30 AM
Hi @LucaMarchiori,
looks good to me. Have you tested it already ?
I would probably add "log_subtype" and "threat_name" as fields in the rule, to save more context of the original log.
Thanks,
luigi
08-04-2017 07:32 AM - edited 08-04-2017 12:47 PM
Hi lmori,
Do you mean something like this:
conditions:
- type == 'THREAT'
- severity == 'critical'
- src_zone == 'WAN'
fields:
- "log_subtype"
- "threat_name"
indicators:
- src_ip
I had 2 "high" severity and one "critical" events in the threat log since yesterday, and the counter this morning is still at zero hits.
This is the config currently (/opt/minemeld/local/config/syslog-miner_rules.yml):
- conditions: [type == 'THREAT', log_subtype == 'vulnerability', severity == 'high',
src_zone == 'WAN']
fields: null
indicators: [src_ip]
name: threats-ALL-high
- conditions: [type == 'THREAT', log_subtype == 'vulnerability', severity == 'critical',
src_zone == 'WAN']
fields: null
indicators: [src_ip]
name: threats-ALL-critical
** edit 2:
Got a few pages of "high" severity threat this morning (TID 40007). No hits on the syslog miner node.
08-08-2017 07:52 AM
Hi Luigi,
I'm using 7.1.11
08-15-2017 08:38 AM
Hi lmori,
Any ideas why the miner node is not getting any hits? Is there a MineMeld rule help doc that I should be looking at instead?
Luca
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!