This website uses cookies essential to its operation, for analytics, and for personalized content. By continuing to browse this site, you acknowledge the use of cookies.
For details on cookie usage on our site, read our Privacy Policy
For details on cookie usage on our site, read our Privacy Policy
About Hugh.Kelley
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- LIVEcommunity
- About Hugh.Kelley
07-15-2022
24Posts
1Like
0Solutions
Jul 15, 2022Last Visited
User
Activity
User
Profile
Latest posts by Hugh.Kelley
| Subject | Views | Posted |
|---|---|---|
| 1768 | 07-14-2022 06:18 PM | |
| 1249 | 05-06-2021 03:33 AM | |
| 1282 | 03-19-2021 07:24 AM | |
| 3082 | 06-09-2020 06:30 AM | |
| 1431 | 06-08-2020 11:48 AM | |
| 3756 | 06-05-2020 09:05 AM | |
| 3944 | 05-18-2020 02:02 PM | |
| 2219 | 02-19-2020 11:09 AM | |
| 2429 | 03-20-2019 07:25 AM | |
| 4196 | 02-13-2019 11:26 AM |
My Liked Posts
| Subject | Likes | Posted |
|---|---|---|
| 1 Like | 02-13-2019 11:26 AM |
Posts I Liked
| Subject | Likes | Author | Latest Post |
|---|---|---|---|
| 8 Likes | |||
| 3 Likes |
User Badges
Community Statistics
| Member Since | 12-23-2018 05:19 AM |
| Date Last Visited | 07-15-2022 12:26 AM |
| Posts | 24 |
| Total Likes Received | 1 |
07-14-2022
06:18 PM
@Joel_Fostano , it has been a few years so I've forgotten the details, but my prototype looks like yours:
It pulls the search_name setting the same way it gets the time settings (line 21 at URL below)
splunksearchminer/node.py
If you look in the _internal index of Splunk, do you see any evidence of a search?
... View more
05-06-2021
03:33 AM
I used taxiing.exampleDataFeed as my prototype in MM. The stdlib.taxiiDataFeed may work too, I didn't try it. Then, in Splunk ES, I was able to set up a threat intelligence feed with the following:
URL: <MM_SERVER>/taxii-poll-service
POST arguments: collection="<NAME_OF_MM_OUTPUT_NODE>"
At least in my experience, URL can be an IP address, even if you use HTTPS in the URL. This is handy if you want to share over the internet but don't want to publish a DNS record for "mythreatintelplatform.abc.xyz".
... View more
03-19-2021
07:24 AM
We have an aggregator for domain indicators that includes a "wl" miner.
We are trying to use wildcards in the whitelist so that if:
primary node contains a.b.xyz.com
WL node contains *.xyz.com
then a.b.xyz.com will be suppressed.
Is this already possible?
If not, would it be done in the aggregator (not the output)?
I'm looking around in class AggregateFT of https://github.com/PaloAltoNetworks/minemeld-core/blob/2f11ab7c73a7bb98f16fcffbe31d9707a32382d4/minemeld/ft/op.py Is that the right place?
... View more
06-09-2020
06:30 AM
This does not seem to stop the miner polling (and throwing errors if the remote TAXII server is temporarily offline). Is there a way to pause polling?
... View more
06-08-2020
11:48 AM
Has anybody built a script to push the STIX files from this site into MineMeld?
https://www.us-cert.gov/ncas/analysis-reports
The stdlib.localDB prototype and HTTP API seem purpose built to solve this issue. The "Annex 2" section of this document shows the way, https://live.paloaltonetworks.com/t5/minemeld-articles/using-minemeld-as-an-incident-response-platform/ta-p/174690
If you've already done this and have words of wisdom (or a sample script or a better way?), please chime in.
... View more
06-05-2020
09:05 AM
I don't have that command on my installation at all, but since I'm already at VERSION: 0.9.52 I guess it isn't hurting me.
Someone has opened an issue for the message you described. https://github.com/PaloAltoNetworks/minemeld-node-prototypes/issues/123
... View more
05-18-2020
02:02 PM
Is updating Minemeld as simple as git cloning the latest?
git clone https://github.com/PaloAltoNetworks/minemeld-core.git git clone https://github.com/PaloAltoNetworks/minemeld-webui.git git clone https://github.com/PaloAltoNetworks/minemeld-node-prototypes.git
... View more
02-19-2020
11:09 AM
This will probably require some massaging to work for your particular monitoring tool but the approach has been solid for us.
https://gist.github.com/hkelley/8a37ec06d3f17ad7117f7d79c233f709
Minemeld itself has been very solid for us - when we get an alarm its generally because of the feed we're consuming.
... View more
03-20-2019
07:25 AM
When you say " show them that the threat intel we can pull down is actually being used to make changes. ", do you mean:
prove that MineMeld's miners and feeds work to redistribute data, or
prove that the incoming indicators are reliable?
... View more
02-13-2019
11:26 AM
1 Kudo
Just in case anybody else needs to monitor node health (and happens to use a PowerShell-based monitoring system), this may help:
https://gist.github.com/hkelley/8a37ec06d3f17ad7117f7d79c233f709
... View more
01-24-2019
05:34 AM
SAML is best for me because we have the supporting infrastructure already in place. Our SaaS apps still seem to use SAML more than other protocols like OIDC.
Thanks for the pointer about the /flask files. I'm new to Flask but am thinking that a file like this (link below) could drop into MineMeld pretty easily and sit alongside the /login route (it uses /loginsso).
flask/loginsso.py # Full transparency - I have not tested this at all, just a mock up
I'll try to test some over the coming days.
... View more
01-23-2019
05:02 AM
Saw this mentioned in another thread. https://github.com/PaloAltoNetworks/minemeld-core/issues/166 Posting it here for reference.
... View more
01-23-2019
04:56 AM
SAML would be ideal for us. Is there any early code we can test and/or contribute to?
... View more
12-30-2018
06:28 AM
Has anyone explored creating a separate "Sso Controller " for the UI? I'm thinking it could run in parallel to the basic auth system, which would still be used for API access (and cases where SSO was broken).
... View more
12-25-2018
08:31 PM
For sites (to be whitelisted) that are behind ever-changing IP ranges (e.g. Amazon load balancer), has anybody used a services like these?
https://dns.google.com/resolve?name=www.netflix.com
https://dns-api.org/A/www.netflix.com
Is there an existing miner that does DNS lookups?
I saw this recommend in another thread but I'm hoping to avoid another VM:
https://github.com/PaloAltoNetworks/fqdn-service
This is the prototype I'm using
prototypes:
dnsLookup:www_netflix_com:
class: minemeld.ft.json.SimpleJSON
config:
age_out:
default: null
interval: 3600
sudden_death: true
attributes:
confidence: 100
share_level: green
type: IPv4
extractor: Answer[?type == `1`]
fields:
- name
indicator: data
prefix: dns
source_name: dns.netflix
url: https://dns.google.com/resolve?name=www.netflix.com
development_status: STABLE
indicator_types:
- IPv4
node_type: miner
tags:
- ConfidenceHigh
- ShareLevelGreen
... View more
LEGAL NOTICES
Copyright 2007 - 2023 - Palo Alto Networks