About niuk

niuk

I am trying to create authentication sequence to first try my SAML profile then local emergency account. But in authentication sequence I can only pick LDAP, RADIUS or local based profiles ? How I can include SAML (SSO) in my auth sequence ?

niuk · ‎12-11-2019

I did the same with MS Teams, see here 😉

niuk · ‎09-27-2019

Read it here

niuk · ‎09-17-2019

("*.ip_ranges[].{indicator:@}") doesnt pull any indicators for me , tried also (*.ip_ranges[].{indicator:@}), same thing I am using VERSION: 0.9.50 and 0.9.52

niuk · ‎04-17-2019

Is there an aggregator which can boost indicator confidence based on given criteria ? For example confidence is increased if indicator has more than one source or in case it reappears in two or more consecutive updates.

niuk · ‎04-17-2019

Do you have an URL to ingest indicators from ? I wrote a mine to scrpe Nessus cloud IPs from tenable.io https://github.com/IrekRomaniuk/tenablescanners-miner

niuk · ‎12-19-2018

Does anyone has issues with not being able to make template (config) changes ? Panorama shows 'in sync' for template to my Azure firewall, but it is not. I tried 'commit force' on firewall itself, didn't help too

niuk · ‎09-10-2018

But with mirgation tool, I can't remove objects in place ? Or is it possible to import objects to Migration tool, and remove unused dirrectly from Migration tool ?

niuk · ‎09-07-2018

Is there a way to quickly find (and remove) unused objects in policy ? I mean like address or service objects

niuk · ‎08-30-2017

Was it seen in Monitor/Traffic or Threats , like drops anything ?

niuk · ‎06-01-2017

Well, haven't noticed that it is not in security policy ...thnx

niuk · ‎06-01-2017

Anyone using captive portal (or web form) ? I can't find appropriate action i.e. 'web form' in the ruleset ? I am running 7.1.7

niuk · ‎05-25-2017

Is there a way to register IP address to dynamic address group thru API ? So far I use pandevice script dyn_address_group.py I am trying to tag existing IP 10.34.20.94 on firewall 10.43.34.34 (PANOS 7.1.7) with tag General , getting error below: $ python dyn_address_group.py 10.43.34.34 admin 'password' 10.34.20.94 General usage: dyn_address_group.py [-h] [-v] [-q] [-r REGISTER] [-u UNREGISTER] [-l] [-c] hostname username password ip dyn_address_group.py: error: unrecognized arguments: General I am using pandevice (0.3.5)

niuk · ‎04-14-2017

Yeah, makes sense. I also found excellent article about using multiple templates. Method 3 (Use template stacks) is the way to go for myself. The comment reads 'PAN-OS 7.0.X only' but I think it author meant 7+

niuk · ‎04-13-2017

If I have two devices in the same Template-Stack, will member template enforce same setting on both devices including i.e. same L3 addresses ? This is what I want to avoid

niuk · ‎03-30-2017

I released version 2 of my PAN sessioninfo plugin . This is plugin in Go for Intel SDI telemetry Snap framework (see my post here ). It allows to quickly create graphs i.e. in Grafana, see below. There are 33 metrics avail. Examples of PAN sessioninfo plugin metrics published to InfluxDb and pulled by Grafana

niuk · ‎03-22-2017

You can also use my tool pan-cli , see it described here. Just type 'C:\>pan-cli.exe load -f "address-sample.csv" -u your_login -p "your_password" -d "Panorama or firewall ip address here" -g "name of devicegroup in case target is Panorama' Format of csv file is pretty straighfroward You can skip address object description. If you skip group name, objects will not be added to group (but created). If you put group name and group doesn’t not exist it will be created for you and objects added to it. The above command was tested with PANOS versions 7 and 8. I included windows binary in the repo, I can upload Linux version, just let me know.

niuk · ‎03-06-2017

Same today, I thing S3 is fixed. I have static IP ubuntu@minemeld:~$ ip a .... 2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000 link/ether 00:50:56:b5:25:2b brd ff:ff:ff:ff:ff:ff inet 10.34.1.111/24 brd 10.34.1.255 scope global eth0 valid_lft forever preferred_lft forever

niuk · ‎03-04-2017

This is my old problem, now I am reinstalling MM and faced another issue

niuk · ‎03-02-2017

Now dns resolution is fine ubuntu@minemeld:~$ nslookup www.google.com Server: 8.8.8.8 Address: 8.8.8.8#53 Non-authoritative answer: Name: www.google.com Address: 172.217.7.132 but same thing in cloud-init-*.log with http://169.254.169.254/ and failed to fetch password from virtual router 10.73.21.215 which is my internal dns address

niuk · ‎03-02-2017

Yes, Internet is fine, I can ping 8.8.8.8. Regarding logs, see below. Address 10.73.21.215 is my dns, based on the ip 169.254.169.254 appearing in logs , it looks like some dns name was not resolved correctly . I added public dns to network interface config and rebooted , will see in a few ubuntu@minemeld:~$ tail /var/log//cloud-init.log Mar 1 21:49:28 minemeld [CLOUDINIT] util.py[DEBUG]: Read 14 bytes from /proc/uptime Mar 1 21:49:28 minemeld [CLOUDINIT] util.py[DEBUG]: Cloud-init v. 0.7.5 finished at Wed, 01 Mar 2017 21:49:28 +0000. Datasource DataSourceNone. Up 227.83 seconds Mar 1 21:49:28 minemeld [CLOUDINIT] util.py[DEBUG]: Writing to /var/lib/cloud/instance/boot-finished - wb: [420] 52 bytes Mar 1 21:49:28 minemeld [CLOUDINIT] cc_final_message.py[WARNING]: Used fallback datasource Mar 1 21:49:28 minemeld [CLOUDINIT] helpers.py[DEBUG]: config-power-state-change already ran (freq=once-per-instance) Mar 1 21:49:28 minemeld [CLOUDINIT] cloud-init[DEBUG]: Ran 11 modules with 0 failures Mar 1 21:49:28 minemeld [CLOUDINIT] util.py[DEBUG]: Creating symbolic link from '/run/cloud-init/result.json' => '../../var/lib/cloud/data/result.json' Mar 1 21:49:28 minemeld [CLOUDINIT] util.py[DEBUG]: Reading from /proc/uptime (quiet=False) Mar 1 21:49:28 minemeld [CLOUDINIT] util.py[DEBUG]: Read 14 bytes from /proc/uptime Mar 1 21:49:28 minemeld [CLOUDINIT] util.py[DEBUG]: cloud-init mode 'modules' took 0.076 seconds (0.08) ubuntu@minemeld:~$ tail /var/log//cloud-init-output.log 2017-03-01 21:45:45,199 - util.py[WARNING]: Failed accessing user data. 2017-03-01 21:47:15,313 - url_helper.py[WARNING]: Calling 'http://169.254.169.254/2009-04-04/meta-data/instance-id' failed [50/120s]: request error [(<urllib3.connectionpool.HTTPConnectionPool object at 0x7f3fd7394a90>, 'Connection to 169.254.169.254 timed out. (connect timeout=50.0)')] 2017-03-01 21:48:06,367 - url_helper.py[WARNING]: Calling 'http://169.254.169.254/2009-04-04/meta-data/instance-id' failed [101/120s]: request error [(<urllib3.connectionpool.HTTPConnectionPool object at 0x7f3fd7394bd0>, 'Connection to 169.254.169.254 timed out. (connect timeout=50.0)')] 2017-03-01 21:48:24,390 - url_helper.py[WARNING]: Calling 'http://169.254.169.254/2009-04-04/meta-data/instance-id' failed [119/120s]: request error [(<urllib3.connectionpool.HTTPConnectionPool object at 0x7f3fd7394a90>, 'Connection to 169.254.169.254 timed out. (connect timeout=17.0)')] 2017-03-01 21:48:25,391 - DataSourceEc2.py[CRITICAL]: Giving up on md from ['http://169.254.169.254/2009-04-04/meta-data/instance-id'] after 120 seconds 2017-03-01 21:49:28,426 - util.py[WARNING]: Failed to fetch password from virtual router 10.73.21.215 Cloud-init v. 0.7.5 running 'modules:config' at Wed, 01 Mar 2017 21:49:28 +0000. Up 227.45 seconds. Cloud-init v. 0.7.5 running 'modules:final' at Wed, 01 Mar 2017 21:49:28 +0000. Up 227.76 seconds. Cloud-init v. 0.7.5 finished at Wed, 01 Mar 2017 21:49:28 +0000. Datasource DataSourceNone. Up 227.83 seconds 2017-03-01 21:49:28,990 - cc_final_message.py[WARNING]: Used fallback datasource

niuk · ‎03-01-2017

I have installed minemeld from MineMeld cloud-init ISO , but waiting forever with: Initalizing minemeld. It could take some minutes, please wait ..|....... How can I complete installation ?

niuk · ‎02-06-2017

Is it possible to aggregate alerts ? So not to alert on single threats but on specific rate btw , I can't setup PAN-OS 8.0 VM on my ESXi 6.5.

niuk · ‎02-06-2017

I am trying to setup VM with PAN-OS 8.0 on ESXi 6.5 but after initial config it shows ('show interface management') mgmt link status and address unknow, can't ping default gateway ?

niuk · ‎02-05-2017

There is an option for syslog alerting by email in PAN-OS , but even if used only for threats , not traffic, results in way too many emails. I am collecting threat events through Logstash into time series database InfluxDB . My very small program is triggered by Logstash, when rate of metrics exceeds given threshold, to query InfluxDB and send result by email. See my post here

niuk · ‎02-03-2017

One more thing I've changed IP after booting from iso, can't connect to https . Looks like it is upstart , not systemctl . Where are minemeld startup files located so I can change IPs ? What is that command to display minemeld status ?

niuk · ‎02-03-2017

good point , cd was attached but not conencted ..

niuk · ‎02-03-2017

Credentials ubuntu/rsplizardspock doesnt work for minemeld-cloud-init-0.9.5.iso booted on trusty-server-cloudimg-amd64.ova ?

niuk · ‎12-15-2016

is there slack channel for minemeld ?

niuk · ‎12-05-2016

I got "[invalid image]" ? See below minemeld@minemeld:~$ sudo /usr/sbin/minemeld-auto-update [sudo] password for minemeld: 2016-12-05 11:00:51,381 INFO:0.9.7 Current status: 2016-12-05 11:00:51,381 INFO:0.9.7 minemeld-engine: current: 0.9.30 latest: 0.9.30 2016-12-05 11:00:51,381 INFO:0.9.7 minemeld-webui: current: 0.9.30 latest: 0.9.30 2016-12-05 11:00:51,381 INFO:0.9.7 minemeld-prototypes: current: 0.9.30 latest: 0.9.30 2016-12-05 11:00:51,568 DEBUG:0.9.7 curl output: 2016-12-05 11:00:51,612 DEBUG:0.9.7 curl output: 2016-12-05 11:00:51,612 DEBUG:0.9.7 gpgv: /usr/bin/gpgv --ignore-time-conflict --keyring /etc/apt/trusted.gpg /tmp/mmaupackagesgpgfGU_ps /tmp/mmaupackagesVCmHPn 2016-12-05 11:00:51,625 INFO:0.9.7 gpgv output: gpgv: Signature made Fri 02 Dec 2016 09:54:48 AM EST using RSA key ID 7B630999 gpgv: Good signature from "Palo Alto Networks, MineMeld Team <minemeld@paloaltonetworks.com>" gpgv: aka "[invalid image]" 2016-12-05 11:00:51,628 INFO:0.9.7 No package to deploy, exit

Date Registered	‎11-29-2014 11:38 AM
Date Last Visited	a week ago
Total Messages Posted	83
Total Likes Received	10

Online Status	Offline
Date Last Visited	a week ago

Strata

Prisma

Cortex

About niuk