About Paul_Stinson

ahh looks like i had to have the very latest signature....was running 8590-7462 before updating to 8592-7467 on Panorama and i can see the category now in URL filtering profile. ... View more

any update on two questions above? can't see the category either and would like to know if related to advanced URL subscription. We have that license but can't see it on panorama to edit policies......some advice on this matter would be helpful! Thanks. ... View more

@jdelio  Looks like the open source route is pretty much dead for Minemeld as well. Wiki Page has links back to palo Alto site within it and doesn't mention docker path for getting software running (from what i could see)   We use the Docker method here as I had issues with the Ansible path after only a few months use with package dependencies issues when patching for security vulnerabilities,  but know that docker image has numerous security vulnerabilities in it (that do not appear to be getting addressed).   Noted on Github Projects though, comments in each project indicate project been basically abandoned?   If following the ansible route you have the following https://github.com/PaloAltoNetworks/minemeld-ansible/issues https://github.com/PaloAltoNetworks/minemeld-ansible/issues/85 (this one specifically calls out some of the issues with current build especially the python2 and not keeping current with certain packages).   Docker Project also shows no real change in months and mentions the vulnerabilities around ubuntu base OS and config issues.     Since there is no main page on Palo Alto LIVECommunity site anymore or any of the historical data, people would be missing the wealth of information that was posted here along with solutions to common problems that have been seen. It would have been nice to leave it up at least as an Archive with clear notes that they project is NO longer being maintained and direct people to your paid products as this is where work is actively being done.    This application will keep working obviously for the moment but people will need to look to alternatives for EDL threat collation and publish options or roll something themselves to solve the issue if they do not have budget for something like Cortex XSOAR.   I doubt many small to medium business places will be placing more budget on the Cortex XSOAR as a replacement unless they already have an investment in other Palo Alto Cloud offerings. I know our company has just removed Cortex Traps for example as a budget saving option ( despite the numerous improvements we have noted over the past 2-3years).    @jdelio many thanks though for updating my original post. I've bookmarked the github projects for now and will keep an eye on any progress there if it is still being worked on.    ** I would also like to say I'm not a developer so I have not personally contributed to the github project but I did keep an eye on the LIVEcommunity landing page and posts that was placed here in the past. I am appreciative of what was a god send to us engineers to collate easily numerous sources of information whether for block or allow lists while de-duping and outputting data in format we wanted it to be ingested in.   ... View more

Many thanks! @jdelio  ... View more

awesome..... I just discovered that this minemeld community page been canned when landing here.   The Option 3 links above show old link (https://live.paloaltonetworks.com/t5/minemeld/ct-p/MineMeld) and contrary to what is being said it looks absolutely chopped and redirecting. Disappointing.    I guess their Github page would be the only details on open source projects that palo supporting and repositories relating to minemeld? (https://github.com/orgs/PaloAltoNetworks/repositories?q=minemeld&type=all&language=&sort=).   No updates to minemeld-docker though since Feb 2020 though? I assume if no further updates to the docker image ( thinking of all the lovely vulnerabilities possibly building up there ) that you need to move to a build from source code option instead.   Only main core looks reasonably updated however....so suspecting this project will eventually die without more community dev efforts.       ... View more

Hi team, Love the work you have been doing with this tool, just wondering with Docker Image about plans around a move from base Ubuntu 16.04LTS (to say 18 or 20) and move to python3 timeline? ( as support for Ubuntu patching this version is EOL for patching come end of April this year).   Also wondering would you have any instructions to build from a container image direct rather than the following command if you wanted to muck around building from source and try to make own container?  sudo docker pull paloaltonetworks/minemeld  ** sorry if last question a noob question but not really a dev mindset and just learning docker ropes.   Would be nice to include in doco above for fellow noobs around cleaning up old containers etc ( as our vuln scanning tools pick these up it is good to clean up the old containers) i.e sudo docker images ( to list images on your docker instance ) and sudo docker rmi [image name] (to remove the old image) ... View more

@lmori this appears to have cleared up the vulnerabilities being reported. Awesome. I had just tried the pull of latest build just before i posted so amazing timing on getting update out after my post! universe in sync, check! Am looking forward to python 3 upgrade for Minemeld and any future enhancements planned. Thanks for all the good work the team put into the product! 🙂 ... View more

excuse a docker noob....but is there anyway to patch some of the vulnerabilities in this container like the linux host? Looks like we have 17 vulns listed with potential patches? Also wondering how work is going migrating to a python3 stack? Love the product....but moved to docker due to ansible build having dependancy hell breaks relating to the python. I imagine that fixes probably won't be too available until a migration to Python3 happens. In meantime i have been checking and upgrading docker image as per instructions above. Screengrab of the Vulnerabilities listed:   ... View more

No Problems @Carlos_Gomes. I ran the docker instructions from the following URI: https://live.paloaltonetworks.com/t5/MineMeld-Articles/Running-MineMeld-using-Docker/ta-p/289062 Installed it on Centos 7.7 no problems at all. Haven't used the particular miner that your using so not sure if same issue is still there for that particular agent. Would love to see Application updated to support Python3 though as who knows what kind of security bugs might eventual turn up in the container itself if still using all old python packages in the container. Will keep an eye on developments and might move back to Ansible version of Minemeld later, however docker version working pretty good at this stage. I'll just export config and import on Ansible Version once its determined as no longer broken or at least trial it again once we know Python 3 work has been done. ... View more

Thanks @EdwardMarshall @Carlos_Gomes for your work on getting Ubuntu 18.04.3 working somewhat..... As i was setting this up to show work i didn't have the time to investigate further so went the 'Docker' route which just worked fine! It would be nice to have some comment from Palo Minemeld Devs on what future plans are for the product especially a migration to a supported python version? I'm not a developer and can't work on contributions myself so thanks so far for all the great work done on providing a nice product for extending security on our firewalls and other security devices to ingest, de-dupe/aggregate and output data for those products.....looking forward to what plans are happening to extend this great product. ... View more

Seeing similar issues on fresh 18.04 Ubuntu Server LTS install here too ( using Ansible method which usually works great! thanks!) I have another 18.04 Ubuntu Server LTS image for home (18.04.2) that seems to be working ok but not updated recently. But doing a brand new Ubuntu Server LTS build at work does not fire up minemeld. I am guessing some package update has broken something or something is out of date with newer package dependancy as i have updated the Ubuntu base OS before doing any minemeld Ansible work. Current version on Non-Working version is 18.04.3. There is concern with the build also around use of Python 2.7 due to depreciation just now in Jan2020. "DEPRECATION: Python 2.7 will reach the end of its life on January 1st, 2020. Please upgrade your Python as Python 2.7 won't be maintained after that date. A future version of pip will drop support for Python 2.7. More details about Python 2 support in pip, can be found at https://pip.pypa.io/en/latest/development/release-process/#python-2-support" Will there be a python 3 build of Minemeld in the future?   Status shows a buffer overflow with this minemeld status command.   user@server:~/minemeld-ansible$ sudo -u minemeld /opt/minemeld/engine/current/bin/supervisorctl -c /opt/minemeld/supervisor/config/supervisord.conf maintail ent buffer overflowed, discarding event 18 2020-01-12 23:09:58,557 INFO exited: minemeld-web (exit status 3; not expected) 2020-01-12 23:09:58,557 ERRO pool minemeld-supervisord-listener event buffer overflowed, discarding event 19 2020-01-12 23:09:58,557 INFO gave up: minemeld-web entered FATAL state, too many start retries too quickly 2020-01-12 23:09:58,580 ERRO pool minemeld-supervisord-listener event buffer overflowed, discarding event 20 2020-01-12 23:09:58,580 INFO exited: minemeld-supervisord-listener (exit status 1; not expected) 2020-01-12 23:09:58,581 ERRO pool minemeld-supervisord-listener event buffer overflowed, discarding event 21 2020-01-12 23:09:58,581 INFO gave up: minemeld-supervisord-listener entered FATAL state, too many start retries too quickly 2020-01-12 23:09:58,581 ERRO pool minemeld-supervisord-listener event buffer overflowed, discarding event 22 2020-01-12 23:09:58,581 INFO exited: minemeld-traced (exit status 1; not expected) 2020-01-12 23:09:58,600 ERRO pool minemeld-supervisord-listener event buffer overflowed, discarding event 23 2020-01-12 23:09:58,601 INFO gave up: minemeld-traced entered FATAL state, too many start retries too quickly 2020-01-12 23:09:58,617 ERRO pool minemeld-supervisord-listener event buffer overflowed, discarding event 24 2020-01-12 23:09:58,617 INFO exited: minemeld-engine (exit status 1; not expected) 2020-01-12 23:09:59,618 ERRO pool minemeld-supervisord-listener event buffer overflowed, discarding event 25 2020-01-12 23:09:59,618 INFO gave up: minemeld-engine entered FATAL state, too many start retries too quickly   Checking supervisor Log shows more errors in packaging.   user@server :/opt/minemeld/engine/current/local/lib/python2.7/site-packages/pkg_resources$ tail -200 /opt/minemeld/log/minemeld-supervisord-listener.log module = __import__(self.module_name, fromlist=['__name__'], level=0) File "/opt/minemeld/engine/core/minemeld/supervisord/listener.py", line 7, in import ujson ImportError: /opt/minemeld/engine/current/local/lib/python2.7/site-packages/ujson.so: undefined symbol: Buffer_AppendShortHexUnchecked Traceback (most recent call last): File "/opt/minemeld/engine/current/bin/mm-supervisord-listener", line 11, in load_entry_point('minemeld-core', 'console_scripts', 'mm-supervisord-listener')() File "/opt/minemeld/engine/current/local/lib/python2.7/site-packages/pkg_resources/__init__.py", line 489, in load_entry_point return get_distribution(dist).load_entry_point(group, name) File "/opt/minemeld/engine/current/local/lib/python2.7/site-packages/pkg_resources/__init__.py", line 2852, in load_entry_point return ep.load() File "/opt/minemeld/engine/current/local/lib/python2.7/site-packages/pkg_resources/__init__.py", line 2443, in load return self.resolve() File "/opt/minemeld/engine/current/local/lib/python2.7/site-packages/pkg_resources/__init__.py", line 2449, in resolve module = __import__(self.module_name, fromlist=['__name__'], level=0) File "/opt/minemeld/engine/core/minemeld/supervisord/listener.py", line 7, in import ujson ImportError: /opt/minemeld/engine/current/local/lib/python2.7/site-packages/ujson.so: undefined symbol: Buffer_AppendShortHexUnchecked   The two packages i think might be at fault are (IMO I'm no python guru). ujson load_entry_point   Any clues on getting Minemeld to work on latest 18.04.3+ using manual work around? And to maintainers of minemeld what are the plans for migration to Python 3?   Thanks for providing a great product that helps us to automate black and whitelists with ease. ... View more