Our team is having an issue when blocking a list of IOCs using the minemeld-sync.py script found at https://live.paloaltonetworks.com/t5/minemeld-articles/uploading-list-of-indicators-to-minemeld/ta-p....
We currently have around 10,000 domains blocked in MineMeld, and when we attempt to block more using the script, we get an error "HTTP Error 413: Request Entity Too Large". This message appears even when using the script to block just one domain. I am still able to block domains manually via the GUI, but as there are many thousands of domains we need to block, doing so without the script will be very cumbersome.
When using the script to block other IPv4 or URL IOCs, there appears to be no issues. We have about 3500 IPv4 and 900 URL IOCs blocked currently. This script was previously working with blocking domain IOCs when our total number of domains blocked was smaller, but when it reached the 10,000 mark, we began getting this error.
I'm speculating that there seems to be some sort of slow down because of the amount of IOCs that are currently blocked. Has anybody seen this issue and is able to help?
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!