About ksteves1

Update: DagPusher node now handles IPv6 indicators. ... View more

you can use QUERY_STRING on feed URL of s=start, n=num as discussed here:   https://live.paloaltonetworks.com/t5/MineMeld-Discussions/Confused-over-EBL-size-limit/m-p/104038/ ... View more

1 more: you can now use api_key in the minemeld.ft.dag.DagPusher device list, instead of api_username/api_password. ... View more

This may be helpful:   http://api-lab.paloaltonetworks.com/user-ip.html ... View more

You would need to have at least this version:   2012-08-30 - PAN::XAPI, bin/panxapi: add support for updating dynamic objects in PAN-OS 5.0 (type=user-id). ... View more

Also see the commit message for more info: https://github.com/PaloAltoNetworks/minemeld-core/commit/db8ba28b29107c72d1f3f56232aac018ba1a8974 Connect nodes with prototype ers_sgt to sgt_dag, for example: nodes: ers_sgt-1477772195510: inputs: [] output: true prototype: ciscoise.ers_sgt sgt_dag-1477848600338: inputs: - ers_sgt-1477772195510 node_type: output output: false prototype: ciscoise.sgt_dag You need a device list file with the PAN-OS API configuration: minemeld@minemeld:/opt/minemeld/local/config$ cat sgt_dag-1477848600338_device_list.yml - hostname: 192.168.1.101 api_username: admin api_password: admin - hostname: 192.168.1.102 api_username: admin api_password: admin Then you can create DAGs with match criteria using the registered-ips. admin@PA-200-2> show object registered-ip all registered IP Tags ---------------------------------------- ----------------- 192.168.1.1 "mmld_ise_sgt_Guests" "mmld_pushed" 192.168.1.2 "mmld_ise_sgt_Quarantined_Systems" "mmld_pushed" 172.25.1.1 "mmld_ise_sgt_Contractors" "mmld_pushed" 10.0.0.1 "mmld_ise_sgt_BYOD" "mmld_ise_sgt_Developers" "mmld_ise_sgt_Employees" "mmld_pushed" Total: 4 registered addresses *: received from user-id agent #: persistent ... View more

Hi,   1) no need to specify api_username and api_password when api_key is specified   2) should handle exceptions   3) to see request XML response use for example:       https://github.com/kevinsteves/pan-python/blob/master/doc/pan.xapi.rst#xml_result ... View more

Is there a download file link in the analysis report for the sample on the wildfire portal?   suggest you log a case for this as it should work if you submitted the sample and its verdict is malware. ... View more

I tested cloud and get/sample works for me.  What is the sample verdict?  get/sample will not return benign samples. ... View more

on 6.1 there is an error but not on 7.0 or 7.1:   6.1.12: admin@PA-200> test vpn ipsec-sa tunnel foo Server error : foo is invalid tunnel.Current target-vsys is none test -> vpn -> ipsec-sa -> tunnel is invalid   7.0.8 and 7.1.3: admin@PA-200-2> test vpn ipsec-sa tunnel foo Initiate 0 IPSec SA for tunnel foo.   type=op request using API have same results.  seems like it may be a bug, as I would expect an error and behavior to be unchanged in 7.x  suggest to log a case. ... View more

curl doesn't URL-encode your GET QUERY_STRING. also, you want to remove the outer <entry> container on your cmd= XML. Suggest you use POST and try something like this: $ curl -k -d "type=report&reporttype=dynamic&reportname=custom-dynamic-report&key=$KEY" --data-urlencode "cmd=<type><panorama-trsum><sortby>sessions</sortby><aggregate-by><member>app</member><member>srcuser</member></aggregate-by><values><member>sessions</member><member>bytes</member></values></panorama-trsum></type><period>last-24-hrs</period><topn>50</topn><topm>10</topm><caption>office-user-report</caption><query>(addr in '192.168.1.0/24') and (app neq dns) and (app neq ntp)</query>" https://172.25.1.251/api/ ... View more