About Farouk.Kahoul

Hi all,   I recently heard from a PANW source that development has ceased on MineMeld, and they want users to migrate to Cortex XSOAR TIM.  While I applaud the decision because it means more features, it ain't gonna happen without a plan.   There is no plan now.  With the price of the new product, existing and even new users will still spin up MineMeld for years and years to come.  The phasing out of community support will only add more frustration, but not enough to make the move.   A good plan would be as follows:   Lift the restrictions on Cortex XSOAR Community Edition with regard to active feeds and indicators per feed so that all current MineMeld users will get an equivalent (as much as possible) free product.  https://start.paloaltonetworks.com/rs/531-OCS-018/images/Cortex_XSOAR_Community_Edition_FAQ.pdf Make the strategy clear on the current MineMeld URLs and link then to the Cortex XSOAR community page.  https://live.paloaltonetworks.com/t5/cortex-xsoar/ct-p/Cortex_XSOAR Promote easy, free migration tools to move users from MineMeld to XSOAR TIM. Hopefully, all the MineMeld users will move to XSOAR TIM.  Some customers will be very happy to use the community edition.  Others will make the move to the paid version for additional features.  The XSOAR TIM user base will increase.  I see this as a win/win.   Thanks,   Tom ... View more

hi Luigi   thx for your answer.   im using the VERSION: 0.9.66. i have found a way to filter using the syntax: contains(xxxxx_list, 'yyyyyyy') == true ... View more

Merci milles Dpurton !   my experience:   - use combinations of filters as conditions: contains(xxxxxx_xxxx_list, 'lowercasename') == true   note the lowercase !   also, if you want to filter on a field that contains a "." like name or id, it seems it doesn't work, you will have to use others fields like region+service for example.     this is my prototype based on stdlib.feedHCWithValue :   infilters: - actions: - accept conditions: - __method == 'withdraw' name: accept withdraws - actions: - accept conditions: - contains(azure_system_service_list, 'azureappservice') == true name: accept AzureAppService - actions: - accept conditions: - contains(azure_region_list, 'northeurope') == true - contains(azure_system_service_list, '') == true name: accept northeurope_system_service_empty - actions: - accept conditions: - contains(azure_region_list, 'westeurope') == true - contains(azure_system_service_list, '') == true name: accept westeurope_system_service_empty - actions: - accept conditions: - contains(azure_system_service_list, 'azuread') == true name: accept azuread - actions: - accept conditions: - contains(azure_system_service_list, 'azureadvancedthreatprotection') == true name: accept AzureAdvancedThreatProtection - actions: - accept conditions: - contains(azure_system_service_list, 'azureappservicemanagement') == true name: accept AzureAppServiceManagement - actions: - drop name: drop all store_value: true         ... View more