Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Live
- ›
- About Hugh.Kelley
About Hugh.Kelley
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
yesterday
16Posts
1Like
0Solutions
Jun 05, 2020Last Visited
User
Activity
User
Profile
Latest posts by Hugh.Kelley
| Subject | Views | Posted |
|---|---|---|
| 26 | yesterday | |
| 212 | 3 weeks ago | |
| 311 | 02-19-2020 11:09 AM | |
| 985 | 03-20-2019 07:25 AM | |
| 1856 | 02-13-2019 11:26 AM |
My Liked Posts
| Subject | Likes | Posted |
|---|---|---|
| 1 | 02-13-2019 11:26 AM |
Posts I Liked
| Subject | Likes | Author | Latest Post |
|---|---|---|---|
| 4 | |||
| 3 |
User Badges
Public Statistics
| Date Registered | 12-23-2018 05:19 AM |
| Date Last Visited | yesterday |
| Total Messages Posted | 19 |
| Total Likes Received | 1 |
yesterday
I don't have that command on my installation at all, but since I'm already at VERSION: 0.9.52 I guess it isn't hurting me.
Someone has opened an issue for the message you described. https://github.com/PaloAltoNetworks/minemeld-node-prototypes/issues/123
... View more
3 weeks ago
Is updating Minemeld as simple as git cloning the latest?
git clone https://github.com/PaloAltoNetworks/minemeld-core.git git clone https://github.com/PaloAltoNetworks/minemeld-webui.git git clone https://github.com/PaloAltoNetworks/minemeld-node-prototypes.git
... View more
02-19-2020
11:09 AM
This will probably require some massaging to work for your particular monitoring tool but the approach has been solid for us.
https://gist.github.com/hkelley/8a37ec06d3f17ad7117f7d79c233f709
Minemeld itself has been very solid for us - when we get an alarm its generally because of the feed we're consuming.
... View more
03-20-2019
07:25 AM
When you say " show them that the threat intel we can pull down is actually being used to make changes. ", do you mean:
prove that MineMeld's miners and feeds work to redistribute data, or
prove that the incoming indicators are reliable?
... View more
02-13-2019
11:26 AM
1 Kudo
Just in case anybody else needs to monitor node health (and happens to use a PowerShell-based monitoring system), this may help:
https://gist.github.com/hkelley/8a37ec06d3f17ad7117f7d79c233f709
... View more
01-24-2019
05:34 AM
SAML is best for me because we have the supporting infrastructure already in place. Our SaaS apps still seem to use SAML more than other protocols like OIDC.
Thanks for the pointer about the /flask files. I'm new to Flask but am thinking that a file like this (link below) could drop into MineMeld pretty easily and sit alongside the /login route (it uses /loginsso).
flask/loginsso.py # Full transparency - I have not tested this at all, just a mock up
I'll try to test some over the coming days.
... View more
01-23-2019
05:02 AM
Saw this mentioned in another thread. https://github.com/PaloAltoNetworks/minemeld-core/issues/166 Posting it here for reference.
... View more
01-23-2019
04:56 AM
SAML would be ideal for us. Is there any early code we can test and/or contribute to?
... View more
12-30-2018
06:28 AM
Has anyone explored creating a separate "Sso Controller " for the UI? I'm thinking it could run in parallel to the basic auth system, which would still be used for API access (and cases where SSO was broken).
... View more
12-25-2018
08:31 PM
For sites (to be whitelisted) that are behind ever-changing IP ranges (e.g. Amazon load balancer), has anybody used a services like these?
https://dns.google.com/resolve?name=www.netflix.com
https://dns-api.org/A/www.netflix.com
Is there an existing miner that does DNS lookups?
I saw this recommend in another thread but I'm hoping to avoid another VM:
https://github.com/PaloAltoNetworks/fqdn-service
This is the prototype I'm using
prototypes:
dnsLookup:www_netflix_com:
class: minemeld.ft.json.SimpleJSON
config:
age_out:
default: null
interval: 3600
sudden_death: true
attributes:
confidence: 100
share_level: green
type: IPv4
extractor: Answer[?type == `1`]
fields:
- name
indicator: data
prefix: dns
source_name: dns.netflix
url: https://dns.google.com/resolve?name=www.netflix.com
development_status: STABLE
indicator_types:
- IPv4
node_type: miner
tags:
- ConfidenceHigh
- ShareLevelGreen
... View more
12-25-2018
03:16 PM
Is the MM_CONFIG_DIR pre-set? I used my admittedly limited Ubuntu knowledge to check inside the engine process and it doesn't appear to be there. I see the variable used in many/all miners for storage of password and client certificates.
os.environ['MM_CONFIG_DIR'],
Is /opt/minemeld/local/config/ the appropriate place to store these files (side-loaded yml and cert/key files)?
$ sudo cat /proc/6633/environ
LANG=en_US.UTF-8
MM_CA_BUNDLE=/opt/minemeld/local/certs/bundle.crt
SHELL=/usr/sbin/nologin
MINEMELD_PROTOTYPE_PATH=/opt/minemeld/local/prototypes:/opt/minemeld/prototypes/current
SUPERVISOR_ENABLED=1
SUPERVISOR_PROCESS_NAME=minemeld-engine
SUPERVISOR_SERVER_URL=unix:///var/run/minemeld/minemeld.sock
LOGNAME=minemeld
USER=minemeld
PATH=/opt/minemeld/engine/current/bin
HOME=/opt/minemeld/local/data
SUPERVISOR_GROUP_NAME=minemeld-engine
... View more
12-25-2018
02:53 PM
Thank you. I had imported the extension but didn't realize that "taxiing.phishtank" was the prototype name I should use. Now that you mention it, I see it in taxiing/prototypes/taxiing.yml, but it would be helpful to mention it in the GitHub readme too.
... View more
12-23-2018
09:38 PM
Two additional learnings:
- The file being referred to here was minemeld.json (I had a dangling comma )
ValueError: Expecting property name: line 11 column 9 (char 425)
- I hadn't actually removed the library folder (though I thought I had). Once I deleted that (with the bad file), I was able to clear the error and reimport the Git project.
... View more
12-23-2018
08:39 PM
I worked on my first extension today (based on the structure and files of youtube-miner).
As soon as I imported it into MineMeld I got the ERROR RETRIEVING EXTENSIONS LIST: INTERNAL SERVER ERROR red box of shame.
What log should I be looking in for clues? I've searched a bit and I know this was the path of the local folder. I removed it but that hasn't helped.
/opt/minemeld/local/library/3238b8cf-ecb2-4d32-b5e8-afa8d0f68b91/
I found this in minemeld-web.log,
[2018-12-23 23:21:18 EST] [29663] [ERROR] Exception on /extensions [GET]
Traceback (most recent call last):
File "/opt/minemeld/engine/current/local/lib/python2.7/site-packages/flask/app.py", line 1982, in wsgi_app
response = self.full_dispatch_request()
File "/opt/minemeld/engine/current/local/lib/python2.7/site-packages/flask/app.py", line 1614, in full_dispatch_request
rv = self.handle_user_exception(e)
File "/opt/minemeld/engine/current/local/lib/python2.7/site-packages/flask/app.py", line 1517, in handle_user_exception
reraise(exc_type, exc_value, tb)
File "/opt/minemeld/engine/current/local/lib/python2.7/site-packages/flask/app.py", line 1612, in full_dispatch_request
rv = self.dispatch_request()
File "/opt/minemeld/engine/current/local/lib/python2.7/site-packages/flask/app.py", line 1598, in dispatch_request
return self.view_functions[rule.endpoint](**req.view_args)
File "/opt/minemeld/engine/core/minemeld/flask/aaa.py", line 125, in decorated_view
return f(*args, **kwargs)
File "/opt/minemeld/engine/core/minemeld/flask/aaa.py", line 135, in decorated_view
return f(*args, **kwargs)
File "/opt/minemeld/engine/core/minemeld/flask/extensionsapi.py", line 168, in list_extensions
extensions = _get_extensions()
File "/opt/minemeld/engine/core/minemeld/flask/extensionsapi.py", line 54, in _get_extensions
return minemeld.extensions.extensions(library_directory)
File "/opt/minemeld/engine/core/minemeld/extensions/manager.py", line 284, in extensions
_installed = installed_extensions(installation_dir)
File "/opt/minemeld/engine/core/minemeld/extensions/manager.py", line 265, in installed_extensions
installed_extension = _load_metadata_from_dir(epath)
File "/opt/minemeld/engine/core/minemeld/extensions/manager.py", line 206, in _load_metadata_from_dir
metadata = json.load(f)
File "/usr/lib/python2.7/json/__init__.py", line 291, in load
**kw)
File "/usr/lib/python2.7/json/__init__.py", line 339, in loads
return _default_decoder.decode(s)
File "/usr/lib/python2.7/json/decoder.py", line 364, in decode
obj, end = self.raw_decode(s, idx=_w(s, 0).end())
File "/usr/lib/python2.7/json/decoder.py", line 380, in raw_decode
obj, end = self.scan_once(s, idx)
ValueError: Expecting property name: line 11 column 9 (char 425)
127.0.0.1 - - [23/Dec/2018:23:21:18 -0500] "GET /extensions?_=1545625278 HTTP/1.0" 500 291 "https://localhost/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko/20100101 Firefox/64.0"
[2018-12-23 23:21:37 EST] [29663] [DEBUG] redis session connection pool: in use: 0 available: 1
... View more
12-23-2018
08:17 PM
I didn't find anything so I built an extension.
https://github.com/hkelley/splunksearch-miner
... View more
12-23-2018
06:37 AM
I have several Splunk searches that I use as indicator lists. Has someone already built a miner/prototype to retrieve these?
The generic API examples don't seem sufficient for Splunk's two-step routine (search then retrieve results).
https://docs.splunk.com/Documentation/Splunk/latest/Search/ExportdatausingRESTAPI
... View more
Latest Blogs
Latest Posts
Copyright 2007 - 2020 - Palo Alto Networks
