About lmori

I am also working on a tracing function, to let the admin trace the flow of indicators across the graph. Should happen in a week or two. ... View more

Dear mr.linus, malwaredomainlist.ip generates IPv4 addresses only, that's the reason domain aggregator does not accept any of the generated indicators. If you check the prototype for stdlib.aggregatorDomain you will see the inbound filters applied to all the indicators. These filters accept WITHDRAWS and indicators with type domain. Evertyhing else is dropped.    The IPv4 aggregator instead should accept, but again it depends on the prototype you used to create the aggregator. malwaredomainlist.ip provides C2 IPs, and the indictors are marked as "outbound". Please, could you check that the IPv4 aggregator accepts "outbound" indicators ? You can look at the inbound filters inside the prototype.   It would be a good idea to add a new miner to poll the CSV file provided by malwaredomainlist instead of the IP list. I have created an ER (#8) to track this. ... View more

Hi bartoq, the link will redirect to a MineMeld page where you can specify the Miners you want to add the indicator to.     ... View more

Hi AlexZ, great ! I will start working on documenting the layout of the VM with the different files involved. ... View more

Hi AlexZ, it is definitely possible to install MineMeld on CentOS but packages are not there yet. Currently on Ubuntu native packages are only used to create the directory layout of the VM and provide a simple basic config for the services required for MineMeld, like nginx, rabbitmq and redis. If your time would be interested, I can share all the details about the Ubuntu packages this way they can create their own CentOS pacakges.   luigi ... View more

Hi Axel, I am working on the documentation of the syslog miner, it should happen early next week.   Thanks, luigi ... View more

Hi netmaster_UC3M, I am glad you are liking MM !   IPv4 Aggregator and URL/domains aggregator are different: - IPv4 Aggregator understand the semantic of the IPv4 indicators and can be used to whitelist ranges, CIDR or unicast IPs. This means that if you send it an indicator like "10.0.0.0/8" as whitelist, the range 10.0.0.0-10.255.255.255 will be whitelisted. If a malicious indicator is partially overlapping that range, like 10.255.255.255-11.0.0.0, the overlapping part will be whitelisted and only the non-overlapping part will be send downstream - in this case 11.0.0.0. - URL/domains aggregators are simpler and currently support only perfect match for whitelist and aggregation. I have plans to support wildcard or better regexs, but this is still in planning.   Hope this helps.   luigi ... View more

Hi bartoq, you can use something like this: set deviceconfig system log-link MineMeld.Src url https://<minemeld address>/#/indicator/add?indicator={src}&indicatorType=IPv4 set deviceconfig system log-link MineMeld.Dst url https:// <minemeld address> /#/indicator/add?indicator={dst}&indicatorType=IPv4   luigi ... View more

Hi Linus, there is not a IPv6 Aggregator with all the capabilities of the IPv4, that is something in roadmap. In the next release (0.9.8) I will add a simple IPv6 Aggregator prototype that can be used to aggregate identical IPv6 indicators.   Thanks, luigi ... View more

Here you are: https://live.paloaltonetworks.com/t5/MineMeld-Discussions/What-s-new-in-MineMeld-0-9-7/m-p/75357 ... View more

Thanks, we will take a look at those. ... View more

Thanks ! I have just added the prototype to the library. You will find a miner for it in the next release. It generates URL indicators. ... View more

Absolutely, you can also use Ubuntu mechanism to automatically install security updates: http://askubuntu.com/questions/194/how-can-i-install-just-security-updates-from-the-command-line ... View more

Thanks ! We are glad you like it !   1) cetificate and private key are stored in /etc/nginx/ minemeld.cer and  /etc/nginx/minemeld.pem. You can just replace them with your cert and private key and "sudo service nginx reload"   2) already supported. zeustracker.baddomains, autofocus.exportlist produce also domains. If you have a specific domain feed you are interested in, please let me know. If you look at the autofocus video, you can find instructions on how to add a new subgraph for handling domains (domain aggregator + output feeds) https://live.paloaltonetworks.com/t5/MineMeld-Discussions/Video-MineMeld-on-AWS-amp-Autofocus-Export-Lists/m-p/73245   3) 2 ways to do this: writing your own prototype with a configuration of an existing miner class or write your own full miner, if the protocol or format of the feed is not supported yet by one of the existing miner classes. We are working on the documentation for both options. Stay tuned, at least for the first option it will be just a matter of days. Some users have already started contributing prototypes, but with the docs it will be much easier for everyone 🙂   4) IPv6 is already supported to some extent, there are still some glitches we are working on. A full IPv6 aggregator is in roadmap.   Thanks again, Luigi ... View more