About Hugh.Kelley

Hugh.Kelley · ‎07-14-2022

@Joel_Fostano , it has been a few years so I've forgotten the details, but my prototype looks like yours: It pulls the search_name setting the same way it gets the time settings (line 21 at URL below) splunksearchminer/node.py If you look in the _internal index of Splunk, do you see any evidence of a search?

Hugh.Kelley · ‎05-06-2021

I used taxiing.exampleDataFeed as my prototype in MM. The stdlib.taxiiDataFeed may work too, I didn't try it. Then, in Splunk ES, I was able to set up a threat intelligence feed with the following: URL: <MM_SERVER>/taxii-poll-service POST arguments: collection="<NAME_OF_MM_OUTPUT_NODE>" At least in my experience, URL can be an IP address, even if you use HTTPS in the URL. This is handy if you want to share over the internet but don't want to publish a DNS record for "mythreatintelplatform.abc.xyz".

Hugh.Kelley · ‎03-19-2021

We have an aggregator for domain indicators that includes a "wl" miner. We are trying to use wildcards in the whitelist so that if: primary node contains a.b.xyz.com WL node contains *.xyz.com then a.b.xyz.com will be suppressed. Is this already possible? If not, would it be done in the aggregator (not the output)? I'm looking around in class AggregateFT of https://github.com/PaloAltoNetworks/minemeld-core/blob/2f11ab7c73a7bb98f16fcffbe31d9707a32382d4/minemeld/ft/op.py Is that the right place?

Hugh.Kelley · ‎06-09-2020

This does not seem to stop the miner polling (and throwing errors if the remote TAXII server is temporarily offline). Is there a way to pause polling?

Hugh.Kelley · ‎06-08-2020

Has anybody built a script to push the STIX files from this site into MineMeld? https://www.us-cert.gov/ncas/analysis-reports The stdlib.localDB prototype and HTTP API seem purpose built to solve this issue. The "Annex 2" section of this document shows the way, https://live.paloaltonetworks.com/t5/minemeld-articles/using-minemeld-as-an-incident-response-platform/ta-p/174690 If you've already done this and have words of wisdom (or a sample script or a better way?), please chime in.

Hugh.Kelley · ‎06-05-2020

I don't have that command on my installation at all, but since I'm already at VERSION: 0.9.52 I guess it isn't hurting me. Someone has opened an issue for the message you described. https://github.com/PaloAltoNetworks/minemeld-node-prototypes/issues/123

Hugh.Kelley · ‎05-18-2020

Is updating Minemeld as simple as git cloning the latest? git clone https://github.com/PaloAltoNetworks/minemeld-core.git git clone https://github.com/PaloAltoNetworks/minemeld-webui.git git clone https://github.com/PaloAltoNetworks/minemeld-node-prototypes.git

Hugh.Kelley · ‎02-19-2020

This will probably require some massaging to work for your particular monitoring tool but the approach has been solid for us. https://gist.github.com/hkelley/8a37ec06d3f17ad7117f7d79c233f709 Minemeld itself has been very solid for us - when we get an alarm its generally because of the feed we're consuming.

Hugh.Kelley · ‎03-20-2019

When you say "show them that the threat intel we can pull down is actually being used to make changes.", do you mean: prove that MineMeld's miners and feeds work to redistribute data, or prove that the incoming indicators are reliable?

Hugh.Kelley · ‎02-13-2019

Just in case anybody else needs to monitor node health (and happens to use a PowerShell-based monitoring system), this may help: https://gist.github.com/hkelley/8a37ec06d3f17ad7117f7d79c233f709

Hugh.Kelley · ‎01-24-2019

SAML is best for me because we have the supporting infrastructure already in place. Our SaaS apps still seem to use SAML more than other protocols like OIDC. Thanks for the pointer about the /flask files. I'm new to Flask but am thinking that a file like this (link below) could drop into MineMeld pretty easily and sit alongside the /login route (it uses /loginsso). flask/loginsso.py # Full transparency - I have not tested this at all, just a mock up I'll try to test some over the coming days.

Hugh.Kelley · ‎01-23-2019

Saw this mentioned in another thread. https://github.com/PaloAltoNetworks/minemeld-core/issues/166 Posting it here for reference.

Hugh.Kelley · ‎01-23-2019

SAML would be ideal for us. Is there any early code we can test and/or contribute to?

Hugh.Kelley · ‎12-30-2018

Has anyone explored creating a separate "SsoController" for the UI? I'm thinking it could run in parallel to the basic auth system, which would still be used for API access (and cases where SSO was broken).

Hugh.Kelley · ‎12-25-2018

For sites (to be whitelisted) that are behind ever-changing IP ranges (e.g. Amazon load balancer), has anybody used a services like these? https://dns.google.com/resolve?name=www.netflix.com https://dns-api.org/A/www.netflix.com Is there an existing miner that does DNS lookups? I saw this recommend in another thread but I'm hoping to avoid another VM: https://github.com/PaloAltoNetworks/fqdn-service This is the prototype I'm using prototypes: dnsLookup:www_netflix_com: class: minemeld.ft.json.SimpleJSON config: age_out: default: null interval: 3600 sudden_death: true attributes: confidence: 100 share_level: green type: IPv4 extractor: Answer[?type == `1`] fields: - name indicator: data prefix: dns source_name: dns.netflix url: https://dns.google.com/resolve?name=www.netflix.com development_status: STABLE indicator_types: - IPv4 node_type: miner tags: - ConfidenceHigh - ShareLevelGreen

Member Since	‎12-23-2018 05:19 AM
Date Last Visited	‎07-15-2022 12:26 AM
Posts	24
Total Likes Received	1

Online Status	Offline
Date Last Visited	‎07-15-2022 12:26 AM

About Hugh.Kelley

Re: Suggestions for Splunk Search/Report

Re: TAXII feed for SIEM

wl whitelist domain indicators via wildcard

Re: MineMeld - Office 365 - How can I disable miners?

Ingesting CISA Malware Analysis Reports STIX into MineMeld

Re: Upgrade steps (version 0.9.52 to current) - just git clone?

Upgrade steps (version 0.9.52 to current) - just git clone?

Re: Monitoring Minemeld

Re: Minemeld - New Install - Advice

Monitoring Input Miner Health via API

Monitoring Input Miner Health via API

MineMeld Python3 support?

Minemeld TAXII ISAC

Re: Suggestions for Splunk Search/Report

Re: TAXII feed for SIEM

wl whitelist domain indicators via wildcard

Re: MineMeld - Office 365 - How can I disable miners?

Ingesting CISA Malware Analysis Reports STIX into MineMeld

Re: Upgrade steps (version 0.9.52 to current) - just git clone?

Upgrade steps (version 0.9.52 to current) - just git clone?

Re: Monitoring Minemeld

Re: Minemeld - New Install - Advice

Monitoring Input Miner Health via API

Re: admin auth

Re: MineMeld - SSO via SAML, OAUTH, etc.

Re: admin auth

MineMeld - SSO via SAML, OAUTH, etc.

Whitelisting Load-Balanced Sites - Fetch DNS records as JSON

Unlock your full community experience!

About Hugh.Kelley