- Access exclusive content
- Connect with peers
- Share your expertise
- Find support resources
03-30-2020 03:55 PM
I'm trying to create a custom prototype to get the CIDRs from https://help.webex.com/en-us/WBX000028782/Network-Requirements-for-Webex-Teams-Services#Spark%20IP%2.../
I used the examples in https://live.paloaltonetworks.com/t5/MineMeld-Articles/MineMeld-to-Extract-Indicators-From-generic-A... and I'm using the minemeld.ft.http.HttpFT class, type IPv4, but it isn't working.
I wanted to use:
ignore_regex: ^(?!<li>)
indicator:
regex: '<li>(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(?:\/\d{2})) \(CIDR\).*<\/li>
transform: \1
This gets me nothing. If I remove the \(CIDR\).*<\/li> from the indicator I get just the first CIDR and no others. What am I doing wrong?
04-08-2020 10:14 AM
I could not do it in Minemeld so I just wrote a powershell script which is scheduled in Task Scheduler. I had to make the location of the list accessible with anonymous authentication. fyi
# Set the location of the EDL
$FileName="D:\inetpub\wwwroot\WebEx\webex-cidrlist.txt"
#
# Overwrite any existing data an empty file
write-output "" | out-file -FilePath $FileName -Encoding ASCII
#
# Grab the contents of the webpage and put in variable
$results = Invoke-WebRequest -Uri 'https://help.webex.com/en-us/WBX000028782/Network-Requirements-for-Webex-Teams-Services#Spark%20IP%2...' -UseBasicParsing
#
# Extract the CIDRs from the page and write them to the EDL
$cidrs = ([regex]::Matches($results.rawcontent,'(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(?:\/\d{2}))') | select value)
if ($cidrs.Length -gt 0) {
write-output $cidrs.value | Out-File -FilePath $FileName -Encoding ascii
}
exit
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!