Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Live
- ›
- About Hugh.Kelley
About Hugh.Kelley
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
06-09-2020
18Posts
1Like
0Solutions
Jun 09, 2020Last Visited
User
Activity
User
Profile
Latest posts by Hugh.Kelley
| Subject | Views | Posted |
|---|---|---|
| 1069 | 06-09-2020 06:30 AM | |
| 448 | 06-08-2020 11:48 AM | |
| 1585 | 06-05-2020 09:05 AM | |
| 1772 | 05-18-2020 02:02 PM | |
| 677 | 02-19-2020 11:09 AM |
My Liked Posts
| Subject | Likes | Posted |
|---|---|---|
| 1 | 02-13-2019 11:26 AM |
Posts I Liked
| Subject | Likes | Author | Latest Post |
|---|---|---|---|
| 7 | |||
| 3 |
User Badges
Public Statistics
| Date Registered | 12-23-2018 05:19 AM |
| Date Last Visited | 06-09-2020 09:53 AM |
| Total Messages Posted | 21 |
| Total Likes Received | 1 |
06-09-2020
06:30 AM
This does not seem to stop the miner polling (and throwing errors if the remote TAXII server is temporarily offline). Is there a way to pause polling?
... View more
06-08-2020
11:48 AM
Has anybody built a script to push the STIX files from this site into MineMeld?
https://www.us-cert.gov/ncas/analysis-reports
The stdlib.localDB prototype and HTTP API seem purpose built to solve this issue. The "Annex 2" section of this document shows the way, https://live.paloaltonetworks.com/t5/minemeld-articles/using-minemeld-as-an-incident-response-platform/ta-p/174690
If you've already done this and have words of wisdom (or a sample script or a better way?), please chime in.
... View more
06-05-2020
09:05 AM
I don't have that command on my installation at all, but since I'm already at VERSION: 0.9.52 I guess it isn't hurting me.
Someone has opened an issue for the message you described. https://github.com/PaloAltoNetworks/minemeld-node-prototypes/issues/123
... View more
05-18-2020
02:02 PM
Is updating Minemeld as simple as git cloning the latest?
git clone https://github.com/PaloAltoNetworks/minemeld-core.git git clone https://github.com/PaloAltoNetworks/minemeld-webui.git git clone https://github.com/PaloAltoNetworks/minemeld-node-prototypes.git
... View more
02-19-2020
11:09 AM
This will probably require some massaging to work for your particular monitoring tool but the approach has been solid for us.
https://gist.github.com/hkelley/8a37ec06d3f17ad7117f7d79c233f709
Minemeld itself has been very solid for us - when we get an alarm its generally because of the feed we're consuming.
... View more
03-20-2019
07:25 AM
When you say " show them that the threat intel we can pull down is actually being used to make changes. ", do you mean:
prove that MineMeld's miners and feeds work to redistribute data, or
prove that the incoming indicators are reliable?
... View more
02-13-2019
11:26 AM
1 Kudo
Just in case anybody else needs to monitor node health (and happens to use a PowerShell-based monitoring system), this may help:
https://gist.github.com/hkelley/8a37ec06d3f17ad7117f7d79c233f709
... View more
01-24-2019
05:34 AM
SAML is best for me because we have the supporting infrastructure already in place. Our SaaS apps still seem to use SAML more than other protocols like OIDC.
Thanks for the pointer about the /flask files. I'm new to Flask but am thinking that a file like this (link below) could drop into MineMeld pretty easily and sit alongside the /login route (it uses /loginsso).
flask/loginsso.py # Full transparency - I have not tested this at all, just a mock up
I'll try to test some over the coming days.
... View more
01-23-2019
05:02 AM
Saw this mentioned in another thread. https://github.com/PaloAltoNetworks/minemeld-core/issues/166 Posting it here for reference.
... View more
01-23-2019
04:56 AM
SAML would be ideal for us. Is there any early code we can test and/or contribute to?
... View more
12-30-2018
06:28 AM
Has anyone explored creating a separate "Sso Controller " for the UI? I'm thinking it could run in parallel to the basic auth system, which would still be used for API access (and cases where SSO was broken).
... View more
12-25-2018
08:31 PM
For sites (to be whitelisted) that are behind ever-changing IP ranges (e.g. Amazon load balancer), has anybody used a services like these?
https://dns.google.com/resolve?name=www.netflix.com
https://dns-api.org/A/www.netflix.com
Is there an existing miner that does DNS lookups?
I saw this recommend in another thread but I'm hoping to avoid another VM:
https://github.com/PaloAltoNetworks/fqdn-service
This is the prototype I'm using
prototypes:
dnsLookup:www_netflix_com:
class: minemeld.ft.json.SimpleJSON
config:
age_out:
default: null
interval: 3600
sudden_death: true
attributes:
confidence: 100
share_level: green
type: IPv4
extractor: Answer[?type == `1`]
fields:
- name
indicator: data
prefix: dns
source_name: dns.netflix
url: https://dns.google.com/resolve?name=www.netflix.com
development_status: STABLE
indicator_types:
- IPv4
node_type: miner
tags:
- ConfidenceHigh
- ShareLevelGreen
... View more
12-25-2018
03:16 PM
Is the MM_CONFIG_DIR pre-set? I used my admittedly limited Ubuntu knowledge to check inside the engine process and it doesn't appear to be there. I see the variable used in many/all miners for storage of password and client certificates.
os.environ['MM_CONFIG_DIR'],
Is /opt/minemeld/local/config/ the appropriate place to store these files (side-loaded yml and cert/key files)?
$ sudo cat /proc/6633/environ
LANG=en_US.UTF-8
MM_CA_BUNDLE=/opt/minemeld/local/certs/bundle.crt
SHELL=/usr/sbin/nologin
MINEMELD_PROTOTYPE_PATH=/opt/minemeld/local/prototypes:/opt/minemeld/prototypes/current
SUPERVISOR_ENABLED=1
SUPERVISOR_PROCESS_NAME=minemeld-engine
SUPERVISOR_SERVER_URL=unix:///var/run/minemeld/minemeld.sock
LOGNAME=minemeld
USER=minemeld
PATH=/opt/minemeld/engine/current/bin
HOME=/opt/minemeld/local/data
SUPERVISOR_GROUP_NAME=minemeld-engine
... View more
12-25-2018
02:53 PM
Thank you. I had imported the extension but didn't realize that "taxiing.phishtank" was the prototype name I should use. Now that you mention it, I see it in taxiing/prototypes/taxiing.yml, but it would be helpful to mention it in the GitHub readme too.
... View more
12-23-2018
09:38 PM
Two additional learnings:
- The file being referred to here was minemeld.json (I had a dangling comma )
ValueError: Expecting property name: line 11 column 9 (char 425)
- I hadn't actually removed the library folder (though I thought I had). Once I deleted that (with the bad file), I was able to clear the error and reimport the Git project.
... View more
Latest Blogs
Latest Posts
Copyright 2007 - 2021 - Palo Alto Networks
