About BRosenba

  After enabling the --verbose command line, I can see the CIF parameters of --reporttime and --reporttimeend with the values being about 60 minutes apart.   Essentially, I'm trying to understand the logic of the CIF miner to figure out how to properly configure a miner to receive the appropriate # of indicators from the feeds that we have access to while working within the limitations of the external block lists for the firewall model we utilize.   How does the last_seen value get calculated? Does minemeld store the indicators after each run and set the last_seen value for each indicator and compare regularly. Thanks for your help - Bill ... View more

The CIF miner. We're experiencing some behavior that is different than we expected with the number of indicators that persist after setting sudden_death:true, and not sure if indicators are dropping from the feed that is pulled from the source or if there is other logic in the miner that is contributing to the behavior. When running a standard cif query, the number of indicators is consistent. ... View more

Bumping this thread in hopes that someone with more detailed knowledge, may see and be able to help. ... View more

@BPry Thanks, that seems logical. That moves me on to my next troubleshooting step.   I created a separate thread for this[1], but are you aware of any way to debug a specific miner?   I'd like to see the command that is running when a particular miner is connecting so that I can verify that it isn't the miner that is contributing to what appears to be a much smaller number of indicators than expected the miner with sudden_death:true.   [1] - https://live.paloaltonetworks.com/t5/General-Topics/MineMeld-debugging-miner/m-p/166625   ... View more

As a follow up to this can anyone comment on best practices as far as integrating PAN into the data center ? Is the bridging between VLANs mode as described above recommended? Does anyone have experience allowing the PAN to participate as an L3 device in the data center? I understand that there are some caveats to each method regarding particularly when considering multicast support and zone based rule sets/policy configurations. We've recently purchased an HA pair of PA 5050s. We are planning to utilize the devices in cooperation with some Cisco core switching hardware and VRF lite to segment/secure internal traffic as well as traffic to the Internet. We've had conversations with our local SE and some other customers about how best to integrate. We plan on testing each of the different options, but I'm curious how other folks have accomplished similar data center/core firewall implementations. Thanks in advance for your feedback - Bill ... View more