Windows Update feed in minemeld

[scott.jones]

I'm trying to find out if there's already a miner that someone's created for windows update URLs/IPs.  I am using the O365 one with reasonable success, so I'd like to incorporate the windows updates into minemeld and take advantage of the dynamic list functionality for some of my rules.

Thanks!

[tlamonta]

Same here. I am looking for a stable URL/IP feed or file for Microsoft Updates. We also tried policy based on the 'ms-update' app-ID but finding its hit or miss.

[BPry]

@tlamonta,

You won't find an IP list from Microsoft that they officially publish. You need to use the published URLs (and their wildcards) that haven't really changed in years at this point.