syslog miner - please check rule syntax

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

syslog miner - please check rule syntax

L3 Networker

Hi,

 

I just cloned a syslog miner, following the guide here:

 

https://live.paloaltonetworks.com/t5/MineMeld-Articles/Using-the-syslog-Miner/ta-p/77262

 

I can see the syslog processed counter moving, so looks like syslog forwarding is working.  I'm trying to have any source IP that generates a "critical" TID to be added to the MineMeld EDL.  I created the following rule (based on an example on the MineMeld forum):

 

conditions:
- type == 'THREAT'
- severity == 'critical'
- src_zone == 'WAN'
fields: null
indicators:
- src_ip

 

Does this look OK for what I'm trying to accomplish?  And how do I know if the rule is actually hit?  

 

 

Luca
 

edit: oops I just noticed the "hits" column on the Rules page...

5 REPLIES 5

L7 Applicator

Hi @LucaMarchiori,

looks good to me. Have you tested it already ?

 

I would probably add "log_subtype" and "threat_name" as fields in the rule, to save more context of the original log.

 

Thanks,

luigi

Hi lmori,

 

Do you mean something like this:

 

conditions:
- type == 'THREAT'
- severity == 'critical'
- src_zone == 'WAN'
fields:

  - "log_subtype"

  - "threat_name"
indicators:
- src_ip

 

I had 2 "high" severity and one "critical" events in the threat log since yesterday, and the counter this morning is still at zero hits. 

 

This is the config currently (/opt/minemeld/local/config/syslog-miner_rules.yml):

 

- conditions: [type == 'THREAT', log_subtype == 'vulnerability', severity == 'high',
src_zone == 'WAN']
fields: null
indicators: [src_ip]
name: threats-ALL-high
- conditions: [type == 'THREAT', log_subtype == 'vulnerability', severity == 'critical',
src_zone == 'WAN']
fields: null
indicators: [src_ip]
name: threats-ALL-critical

** edit 2:

 

Got a few pages of "high" severity threat this morning (TID 40007).  No hits on the syslog miner node.

 

 

Hi @LucaMarchiori,

which PAN-OS version are you running ?

 

Thanks,

luigi

Hi Luigi,

 

I'm using 7.1.11

Hi lmori,

 

Any ideas why the miner node is not getting any hits?  Is there a MineMeld rule help doc that I should be looking at instead?

 

 

Luca

 

 

 

  • 6095 Views
  • 5 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!