What's new in MineMeld 0.9.7

[lmori]

Release Date: 2016-03-24

How to update: Updating MineMeld

Nodes

- Miner for ProofPoint ET Pro feeds

- Miner for PAN-OS syslog messages, let you extract indicators from PAN-OS logs according to a set of rules

UI

- now you can add a new static indicator directly from the NODES page or using the log-links feature of PAN-OS

[bartoq]

do you have the log link command to allow the firewall add static indicator directly to Minemeld ?

[lmori]

Hi bartoq,

you can use something like this:

set deviceconfig system log-link MineMeld.Src url https://<minemeld address>/#/indicator/add?indicator={src}&indicatorType=IPv4

set deviceconfig system log-link MineMeld.Dst url https://<minemeld address>/#/indicator/add?indicator={dst}&indicatorType=IPv4

luigi

[axel.bodart]

Hi Luigi,

Could you also please show how the definition of a rule should look like ?

Axel.

[lmori]

Hi Axel,

I am working on the documentation of the syslog miner, it should happen early next week.

Thanks,

luigi

[bartoq]

hi Luigi,

where do I use the miner in the log link ? I only see the indicator type and IP address. shouldnt we configure the miner in the log link as well ?

[lmori]

Hi bartoq,

the link will redirect to a MineMeld page where you can specify the Miners you want to add the indicator to.

 

[bartoq]

Revision on the log link commands, missing the double quotes.

set deviceconfig system log-link MineMeld.Src url "https://x.x.x.x/#/indicator/add?indicator={src}&indicatorType=IPv4"

set deviceconfig system log-link MineMeld.Dst url "https://x.x.x.x/#/indicator/add?indicator={dst}&indicatorType=IPv4"