This website uses cookies essential to its operation, for analytics, and for personalized content. By continuing to browse this site, you acknowledge the use of cookies.
For details on cookie usage on our site, read our Privacy Policy
For details on cookie usage on our site, read our Privacy Policy
About Hugh.Kelley
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- LIVEcommunity
- About Hugh.Kelley
07-15-2022
24Posts
1Like
0Solutions
Jul 15, 2022Last Visited
User
Activity
User
Profile
Latest posts by Hugh.Kelley
| Subject | Views | Posted |
|---|---|---|
| 1497 | 07-14-2022 06:18 PM | |
| 999 | 05-06-2021 03:33 AM | |
| 1053 | 03-19-2021 07:24 AM | |
| 2796 | 06-09-2020 06:30 AM | |
| 1241 | 06-08-2020 11:48 AM |
My Liked Posts
| Subject | Likes | Posted |
|---|---|---|
| 1 Like | 02-13-2019 11:26 AM |
Posts I Liked
| Subject | Likes | Author | Latest Post |
|---|---|---|---|
| 8 Likes | |||
| 3 Likes |
User Badges
Community Statistics
| Member Since | 12-23-2018 05:19 AM |
| Date Last Visited | 07-15-2022 12:26 AM |
| Posts | 24 |
| Total Likes Received | 1 |
07-14-2022
06:18 PM
@Joel_Fostano , it has been a few years so I've forgotten the details, but my prototype looks like yours:
It pulls the search_name setting the same way it gets the time settings (line 21 at URL below)
splunksearchminer/node.py
If you look in the _internal index of Splunk, do you see any evidence of a search?
... View more
05-06-2021
03:33 AM
I used taxiing.exampleDataFeed as my prototype in MM. The stdlib.taxiiDataFeed may work too, I didn't try it. Then, in Splunk ES, I was able to set up a threat intelligence feed with the following:
URL: <MM_SERVER>/taxii-poll-service
POST arguments: collection="<NAME_OF_MM_OUTPUT_NODE>"
At least in my experience, URL can be an IP address, even if you use HTTPS in the URL. This is handy if you want to share over the internet but don't want to publish a DNS record for "mythreatintelplatform.abc.xyz".
... View more
03-19-2021
07:24 AM
We have an aggregator for domain indicators that includes a "wl" miner.
We are trying to use wildcards in the whitelist so that if:
primary node contains a.b.xyz.com
WL node contains *.xyz.com
then a.b.xyz.com will be suppressed.
Is this already possible?
If not, would it be done in the aggregator (not the output)?
I'm looking around in class AggregateFT of https://github.com/PaloAltoNetworks/minemeld-core/blob/2f11ab7c73a7bb98f16fcffbe31d9707a32382d4/minemeld/ft/op.py Is that the right place?
... View more
06-09-2020
06:30 AM
This does not seem to stop the miner polling (and throwing errors if the remote TAXII server is temporarily offline). Is there a way to pause polling?
... View more
06-08-2020
11:48 AM
Has anybody built a script to push the STIX files from this site into MineMeld?
https://www.us-cert.gov/ncas/analysis-reports
The stdlib.localDB prototype and HTTP API seem purpose built to solve this issue. The "Annex 2" section of this document shows the way, https://live.paloaltonetworks.com/t5/minemeld-articles/using-minemeld-as-an-incident-response-platform/ta-p/174690
If you've already done this and have words of wisdom (or a sample script or a better way?), please chime in.
... View more
LEGAL NOTICES
Copyright 2007 - 2023 - Palo Alto Networks