About lmori

Hi @c_cong, from FS-ISAC you should retrieve the following data: - URL of the TAXII discovery service - name of the feed - client certificate for authentication   On MineMeld: - click on CONFIG and then on the hamburger icon to list the Prototypes - click on hailataxii.guest_Abuse_ch and click on NEW - modify the name of the new prototype - under config copy & paste the following and change the feed name and the URL with the values you get from FS-ISAC: age_out: default: last_seen+30d sudden_death: false attributes: confidence: 30 share_level: red collection: <feedname> discovery_service: <fs-isac discovery service> source_name: fs-isac.<feedname> client_cert_required: true - press OK and then create a new node from the new prototype - COMMIT - after the engine has started, go in NODES click on the new NODE and upload the client certificate ... View more

Hi @PF, most probably you have a process working on the apt database. See here: https://askubuntu.com/questions/335794/could-not-get-lock-var-lib-apt-lists-lock   Thanks, luigi  ... View more

Hi @c_cong, please, could you open a discussion under MineMeld Discussions about this ? Will be happy to help you. ... View more

Hi @PF, if you have installed MM from binaries (via OVA, CFN, AFM, ISO, apt repos, ...) you should subscribe your MM instance to the beta channel. Change the file /etc/minemeld-auto-updates.conf to this (basically change the value of "channel"): { "minemeld-updates": { "baseurl": "http://minemeld-updates.panw.io/stage2", "channel": ["0_9", "beta0_9"] } } After that, force an update: $ sudo -u minemeld /usr/sbin/minemeld-auto-update ... View more

Hi @jchitsaz, we have plans for SAML (https://github.com/PaloAltoNetworks/minemeld-core/issues/166), would that work ?  ... View more

If the file is compressed by the HTTP Server on the fly (https://en.wikipedia.org/wiki/HTTP_compression) in gzip, the python library used by the CSV and HTTP Miner (that is python requests) should automatically take care of decompressing the file. If instead the feed is contained in a gzip file you need a new Miner subclassing the HTTP or CSV Miner to decmpress gzip on the fly. This is possible and easy to do but it requires some coding. ... View more

Hi @NaoyaToida, you can dump the contents using "redis-cli" and inspecting the keys. ... View more

Hi @vb0398, you could have success using minemeld.ft.csv.CSVFT class to parse the CSV file and skip the comment using the ignore_regex parameter. See the docs about the parameters accepted by that Miner class here: https://github.com/PaloAltoNetworks/minemeld-core/blob/master/docs/nodeconfig.rst   And you can use bambenekconsulting. c2_ipmasterlist as a starting prototype for your experiments. ... View more

Hi @vb0398, for a simple text file feed over HTTP you don't need a new class of Miner as there is already one implementing that protocol and format (minemeld.ft.http.HttpFT). Suggestion, do this: - in CONFIG click on the hamburger icon (bottom right) and search the prototype openbl.base - click on the prototype and then click NEW, this will create a local copy of the prototype and you can change name and config - in the config section of the new prototype modify the URL to point to your feed, the source_name, the confidence - using the ignore_regex field you can specify regular expression to filter out the comments. The one in openbl.base will ignore all the lines starting with # - you can then click OK to save the prototype and use it for a new Miner   If the engine does not start when you commit, just check the minemeld-engine.logs file to see the error in the prototype. You can then create a new version of the prototype with the fixes and use it for another Miner.   luigi ... View more

Hi @vb0398, what is the protocol and format of the IP address list you want to pull ? Chances you just a need a prototype for it.   Looking at you nodes.json you still have a dot instead of a colon in the  minemeld.ft.ytexample.YTExample entrypoint between minemeld.ft.ytexample and YTExample, it should look like this: "minemeld.ft.ytexample.YTExample": { "class": "minemeld.ft.ytexample:YTExample" } after fixing this you should run: sudo -u minemeld /opt/minemeld/engine/current/bin/pip install -e /opt/minemeled/engine/core/ ... View more

Hi @PF, this is a bug, and I have already a fix for it. Would you be interested in testing the beta with the fix ?   luigi ... View more