Create a miner to mine from Autofocus MineMeld

[yctan]

Hi, with the release of PANOS 8.0, Autofocus will have a minemeld build in.

May I know if we can have a on premise minemeld to fetch the feeds from the Autofocus Minemeld?

I tried to grab the minemeld feeds but it shows me unauthorized access.

Do we need to have a api keys for this? Would there be plugin for this?

Thanks

[lmori]

Hi @yctan,

this will be improved in the next release of the on-prem MineMeld, but you can access the feeds from MineMeld on Autofocus via a STIX/TAXII Miner.

The unauthorized access is returned because on the MineMeld for Autofocus access to feeds is authenticated. You should create users under Admins > Feeds and give them the access tags. Please check this thread for details: https://live.paloaltonetworks.com/t5/MineMeld-Discussions/Minemeld-Feed-Password-OR-api-security/m-p...

[yctan]

Thanks Imori.

As I am exploring the Autofocus minemeld, i can get the feed to work when set to annoymous. When set with a password, it seems not working even though i used 1 of the prototype that allows me to key in username and password. Im using the openphish prototype that allows me to key in username and password. It still fails.

I am also trying to explore to use the STIX/TAXII. I have created the output to TAXII in Autofocus minemeld. How can i receive this feed from local minemeld? There is no reference link for me to point to.

Thanks

[lmori]

Hi @yctan,

I will work on a document about this.

Luigi