About Paul_Stinson

I have since found one of the commands shows more info around unassigned.   ".pancache" : { "shards" : { "2" : [ { "state" : "STARTED", "primary" : true, "node" : "Kpu5WVqMSLSQWzCSV42-dg", "relocating_node" : null, "shard" : 2, "index" : ".pancache", "allocation_id" : { "id" : "Z5XfmB_CRNavbcLzpT2Xlw" } }, { "state" : "UNASSIGNED", "primary" : false, "node" : null, "relocating_node" : null, "shard" : 2, "index" : ".pancache", "recovery_source" : { "type" : "PEER" }, "unassigned_info" : { "reason" : "CLUSTER_RECOVERED", "at" : "2023-09-13T05:18:17.409Z", "delayed" : false, "allocation_status" : "no_attempt" } } ], "1" : [ { "state" : "STARTED", "primary" : true, "node" : "Kpu5WVqMSLSQWzCSV42-dg", "relocating_node" : null, "shard" : 1, "index" : ".pancache", "allocation_id" : { "id" : "cZkPb8isTiSH-H4hHo8ojw" } }, { "state" : "UNASSIGNED", "primary" : false, "node" : null, "relocating_node" : null, "shard" : 1, "index" : ".pancache", "recovery_source" : { "type" : "PEER" }, "unassigned_info" : { "reason" : "CLUSTER_RECOVERED", "at" : "2023-09-13T05:18:17.409Z", "delayed" : false, "allocation_status" : "no_attempt" } } ], "3" : [ { "state" : "STARTED", "primary" : true, "node" : "Kpu5WVqMSLSQWzCSV42-dg", "relocating_node" : null, "shard" : 3, "index" : ".pancache", "allocation_id" : { "id" : "4BBrampGQL--XQbqQYiUCQ" } }, { "state" : "UNASSIGNED", "primary" : false, "node" : null, "relocating_node" : null, "shard" : 3, "index" : ".pancache", "recovery_source" : { "type" : "PEER" }, "unassigned_info" : { "reason" : "CLUSTER_RECOVERED", "at" : "2023-09-13T05:18:17.409Z", "delayed" : false, "allocation_status" : "no_attempt" } } ],   ... View more

Yeah they turfed it a while back....older posts are in the general live community if you search for minemeld. We posted a few things a while back and someone fixed up the github page to have some correct links and info as it was just totally chopped one day.... They promote their commercial product on site now rather than minemeld which also hasn't really had any changes to it since 2years ago. I personally run the docker version as this is then containerized and isolated on my network (to prevent vulnerabilities being exploited from local network) and does the job we want for the moment. A lot of EDL's are up on their site now that you can consume direct for free but it doesn't allow for de-aggregation for example if you have several threat feeds or some custom intelligence that you want to scrape. Their commercial product = https://www.paloaltonetworks.com/cortex/threat-intel-management Looks good but would need to convince some people that ROI is worth it over our current needs..... ... View more

Fix for our situation with the new Software NGFW credits and Deployment profiles and active license message (once Palo fixed restoring serials in backend - with matching UUID and CPUID and we attached again to another deployment profile that was active) was to run the software check from the CLI not from the GUI. This fixed up the state that Panorama was in despite license showing as ok after license update and GUI throwing the non active license message in the software tab. Hope this helps someone.....try CLI update first post license checks and then GUI post this if the CLI looks ok. ... View more

currently have a call logged for this. accidently deleted a profile for  "Software NGFW Credits" that had our Panorama and log collectors on it. Have been able to get support to reattach serials (with cpuid and uuid to be able to be migrated). we migrated all serials to another deployment profile for management and everything took except our primary panorama. Same message as above. Shows as licensed ok and yes can get app updates etc just not panOS updates. Awaiting what fix might be needed.....running 10.1.6 here.... ... View more

ahh looks like i had to have the very latest signature....was running 8590-7462 before updating to 8592-7467 on Panorama and i can see the category now in URL filtering profile. ... View more

any update on two questions above? can't see the category either and would like to know if related to advanced URL subscription. We have that license but can't see it on panorama to edit policies......some advice on this matter would be helpful! Thanks. ... View more

@jdelio  Looks like the open source route is pretty much dead for Minemeld as well. Wiki Page has links back to palo Alto site within it and doesn't mention docker path for getting software running (from what i could see)   We use the Docker method here as I had issues with the Ansible path after only a few months use with package dependencies issues when patching for security vulnerabilities,  but know that docker image has numerous security vulnerabilities in it (that do not appear to be getting addressed).   Noted on Github Projects though, comments in each project indicate project been basically abandoned?   If following the ansible route you have the following https://github.com/PaloAltoNetworks/minemeld-ansible/issues https://github.com/PaloAltoNetworks/minemeld-ansible/issues/85 (this one specifically calls out some of the issues with current build especially the python2 and not keeping current with certain packages).   Docker Project also shows no real change in months and mentions the vulnerabilities around ubuntu base OS and config issues.     Since there is no main page on Palo Alto LIVECommunity site anymore or any of the historical data, people would be missing the wealth of information that was posted here along with solutions to common problems that have been seen. It would have been nice to leave it up at least as an Archive with clear notes that they project is NO longer being maintained and direct people to your paid products as this is where work is actively being done.    This application will keep working obviously for the moment but people will need to look to alternatives for EDL threat collation and publish options or roll something themselves to solve the issue if they do not have budget for something like Cortex XSOAR.   I doubt many small to medium business places will be placing more budget on the Cortex XSOAR as a replacement unless they already have an investment in other Palo Alto Cloud offerings. I know our company has just removed Cortex Traps for example as a budget saving option ( despite the numerous improvements we have noted over the past 2-3years).    @jdelio many thanks though for updating my original post. I've bookmarked the github projects for now and will keep an eye on any progress there if it is still being worked on.    ** I would also like to say I'm not a developer so I have not personally contributed to the github project but I did keep an eye on the LIVEcommunity landing page and posts that was placed here in the past. I am appreciative of what was a god send to us engineers to collate easily numerous sources of information whether for block or allow lists while de-duping and outputting data in format we wanted it to be ingested in.   ... View more

Many thanks! @jdelio  ... View more

awesome..... I just discovered that this minemeld community page been canned when landing here.   The Option 3 links above show old link (https://live.paloaltonetworks.com/t5/minemeld/ct-p/MineMeld) and contrary to what is being said it looks absolutely chopped and redirecting. Disappointing.    I guess their Github page would be the only details on open source projects that palo supporting and repositories relating to minemeld? (https://github.com/orgs/PaloAltoNetworks/repositories?q=minemeld&type=all&language=&sort=).   No updates to minemeld-docker though since Feb 2020 though? I assume if no further updates to the docker image ( thinking of all the lovely vulnerabilities possibly building up there ) that you need to move to a build from source code option instead.   Only main core looks reasonably updated however....so suspecting this project will eventually die without more community dev efforts.       ... View more

Hi team, Love the work you have been doing with this tool, just wondering with Docker Image about plans around a move from base Ubuntu 16.04LTS (to say 18 or 20) and move to python3 timeline? ( as support for Ubuntu patching this version is EOL for patching come end of April this year).   Also wondering would you have any instructions to build from a container image direct rather than the following command if you wanted to muck around building from source and try to make own container?  sudo docker pull paloaltonetworks/minemeld  ** sorry if last question a noob question but not really a dev mindset and just learning docker ropes.   Would be nice to include in doco above for fellow noobs around cleaning up old containers etc ( as our vuln scanning tools pick these up it is good to clean up the old containers) i.e sudo docker images ( to list images on your docker instance ) and sudo docker rmi [image name] (to remove the old image) ... View more

@lmori this appears to have cleared up the vulnerabilities being reported. Awesome. I had just tried the pull of latest build just before i posted so amazing timing on getting update out after my post! universe in sync, check! Am looking forward to python 3 upgrade for Minemeld and any future enhancements planned. Thanks for all the good work the team put into the product! 🙂 ... View more

excuse a docker noob....but is there anyway to patch some of the vulnerabilities in this container like the linux host? Looks like we have 17 vulns listed with potential patches? Also wondering how work is going migrating to a python3 stack? Love the product....but moved to docker due to ansible build having dependancy hell breaks relating to the python. I imagine that fixes probably won't be too available until a migration to Python3 happens. In meantime i have been checking and upgrading docker image as per instructions above. Screengrab of the Vulnerabilities listed:   ... View more

No Problems @Carlos_Gomes. I ran the docker instructions from the following URI: https://live.paloaltonetworks.com/t5/MineMeld-Articles/Running-MineMeld-using-Docker/ta-p/289062 Installed it on Centos 7.7 no problems at all. Haven't used the particular miner that your using so not sure if same issue is still there for that particular agent. Would love to see Application updated to support Python3 though as who knows what kind of security bugs might eventual turn up in the container itself if still using all old python packages in the container. Will keep an eye on developments and might move back to Ansible version of Minemeld later, however docker version working pretty good at this stage. I'll just export config and import on Ansible Version once its determined as no longer broken or at least trial it again once we know Python 3 work has been done. ... View more

Thanks @EdwardMarshall @Carlos_Gomes for your work on getting Ubuntu 18.04.3 working somewhat..... As i was setting this up to show work i didn't have the time to investigate further so went the 'Docker' route which just worked fine! It would be nice to have some comment from Palo Minemeld Devs on what future plans are for the product especially a migration to a supported python version? I'm not a developer and can't work on contributions myself so thanks so far for all the great work done on providing a nice product for extending security on our firewalls and other security devices to ingest, de-dupe/aggregate and output data for those products.....looking forward to what plans are happening to extend this great product. ... View more