WebEx prototype

[alterioc]

I'm trying to create a custom prototype to get the CIDRs from https://help.webex.com/en-us/WBX000028782/Network-Requirements-for-Webex-Teams-Services#Spark%20IP%2.../  

I used the examples in https://live.paloaltonetworks.com/t5/MineMeld-Articles/MineMeld-to-Extract-Indicators-From-generic-A...  and I'm using the minemeld.ft.http.HttpFT class, type IPv4, but it isn't working.  

I wanted to use:

ignore_regex: ^(?!<li>)

indicator:

regex: '<li>(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(?:\/\d{2})) \(CIDR\).*<\/li>

transform: \1

This gets me nothing. If I remove the \(CIDR\).*<\/li> from the indicator I get just the first CIDR and no others. What am I doing wrong?

[alterioc]

I could not do it in Minemeld so I just wrote a powershell script which is scheduled in Task Scheduler. I had to make the location of the list accessible with anonymous authentication. fyi

# Set the location of the EDL
$FileName="D:\inetpub\wwwroot\WebEx\webex-cidrlist.txt"
#
# Overwrite any existing data an empty file
write-output "" | out-file -FilePath $FileName -Encoding ASCII
#
# Grab the contents of the webpage and put in variable
$results = Invoke-WebRequest -Uri 'https://help.webex.com/en-us/WBX000028782/Network-Requirements-for-Webex-Teams-Services#Spark%20IP%2...' -UseBasicParsing
#
# Extract the CIDRs from the page and write them to the EDL
$cidrs = ([regex]::Matches($results.rawcontent,'(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(?:\/\d{2}))') | select value)
if ($cidrs.Length -gt 0) {
write-output $cidrs.value | Out-File -FilePath $FileName -Encoding ascii
}

exit