About r_buchwalder

r_buchwalder · ‎12-13-2021

Hello Is Minemeld affected by Log4j? I see Palo's Security Advisories about Log4j (https://security.paloaltonetworks.com/CVE-2021-44228) - but there is no Minemeld in it. Is anybody out there, who can answer this? thanks roger

r_buchwalder · ‎09-02-2021

I do have here an example: There is no "no specific threat" written, even no inidcator what Hybrid Analysis found - only 2nd party verdicts... Task Results tab: Task outputs tab: DBotScore { "Indicator": "http://daniele.alfano.mytripmyroom.com/", "Score": 1, "Type": "URL", "Vendor": "Hybrid Analysis" } HybridAnalysis.URL { "Finished": true, "SHA256": "a60cde1373f99eb9e794f59922ab11d0f00dc4ec957041c65f6f1fa24ea45879", "ScanID": "6130c90541b51d7bb72f9be1", "Scanner": [ { "Name": "VirusTotal", "Positives": null, "Status": "no-result" }, { "Name": "urlscan.io", "Positives": null, "Status": "no-classification" } ] } URL { "Data": "http://daniele.alfano.mytripmyroom.com/" } If you visit Hybrid Analysis Website, you'll see: where is Hybrid Analysis' Verdict in that Task? thanks roger

r_buchwalder · ‎09-02-2021

Hi Alejandro Just found it out. If you email it with mail-sender-new: AttachedID is <id>@<ticketnumber> -> 31@1234 attachNames is the name of the attachment, you would like to see in the Mail Attachment -> "picture.png" attachCIDs is the name in the war room, in the "command"-Part of the entry 31 -> "picture" You need all three entries. You may put more than one attachment, just put a coma in between -> "31@1234,45@1234" etc Finally I've got it working 🙂 greets roger

r_buchwalder · ‎08-31-2021

Hi I do see you problem, you need first to donwload the file to continue the work/tasks. I did a little test on my side and saw following: The download link is cutted in different sections... first part is https://<demisto machine name> second part is /entry/download/ and third part is File.EntryID so the url is like this, if you would use it in an other task: https://demisto/entry/Download/${File.EntryID} Be carefull, you migth not use the URL above if you send it in an E-Mail, because you need to login first into demisto... Could you please try it out? regards roger

r_buchwalder · ‎08-31-2021

Hello When I request a Wildfire request then I do not get a lot of Information in the "Output" to work with other tasks. To get more infos, I do in the Demisto CLI this: !wildfire-report format=xml hash=<sha256-Hash> verbose=true raw-response="true" extend-context=contextKey=JsonOutputPath But then all infos are in the "Resuls"-"Tab" instead in the output-"Tab". I know, I can do it with Advanced->Extend context - but to be honest, I get about 100 lines of output... Is there no way to say "put all results into output"? Do I really do a root.0.result.email::root.0.result.verdict::... 100 times? thanks roger

r_buchwalder · ‎08-31-2021

Hello Did you tried to use ExportToCsv task? https://xsoar.pan.dev/docs/reference/scripts/export-to-csv regards roger

r_buchwalder · ‎08-31-2021

Hello I run into the same problem, as I would avoid that XSOAR Playbook scans URLs, which XSOAR already did. The dockerize hindering me too to store already scanned urls. So I've build an own Integration which use FTP as a store. My solution for the FTP: it runs on the demisto machine, with vsfdpd... regards roger

r_buchwalder · ‎08-30-2021

Hello We do use Hybrid Analysis to check URLs. Is anyone here, who can tell me how to read the results? For scanned URLs we get on Hybrid Analysis Website a "no specific result", "suspicious" or "malicious" as result. But I do not see those results in any Output of the automation. Only from third-Party scanners - but the result of Hybrid Analysis I can't see. I expect something like HybridAnalysis.URL.Verdict = suspicious Does anyone get any clue, how I get a proper result? thanks roger

r_buchwalder · ‎08-30-2021

Atullo I do not have an d1 installation here. Since I'm not able to install d1-Service on Demisto machine. "Failed - Cannot install engine along with Cortex XSOAR server" Do I need an Engine to use those Communication Task? If so, I need first to setup a new machine. Thanks roger

r_buchwalder · ‎08-30-2021

Hello Atullo So, here one example: 1,2021/08/26 15:03:56,013201006616,THREAT,wildfire,2305,2021/08/26 15:03:51,1.1.1.1,2.2.2.2,0.0.0.0,0.0.0.0,SMTP-Traffic,,,smtp-base,vsys0,DMZ,EXT,ae2.2,ae1.1,PANORAMA,2021/08/26 15:03:51,1015351,1,58020,25,0,0,0x1102000,tcp,allow,"http://<url>/r/?id=tc08d19,8cb4a0,9b03889&p1=%40kjsI",Email Link(52143),phishing,high,client-to-server,6951421833034849569,0xa000000000000000,<countr>,10.0.0.0-10.255.255.255,0,,0,<sha256>,eu.wildfire.paloaltonetworks.com,0,,email-link,,,<sender-Email>,"Buy It, Mike!",<recipient Email>,5131320962,2060,1816,0,0,DMZ-1,<machinename>,,,,,0,,0,,N/A,unknown,WildFire-0,0x0,0,4294967295,,,<code>,0, I've replaced some stuff with <> and modified IP's, vlans etc. regards roger

r_buchwalder · ‎08-27-2021

Hello Atullo The solution sounds fine, but Wildfire's syslog has more than one field with "-s in it. And I would like to use it in a mapper, so there are 78 mappings for each Syslog-Entry. And this is only for Wildfire-Mapping. is there no easier way? I think that this is a "normal" syslog behavior, that commas are present in the comments inside of ". thanks roger

r_buchwalder · ‎08-26-2021

reboot was done, but still no port 8080: :~$ sudo grep BindAddress /usr/local/demisto/d1.conf "BindAddress": ":8080", :~$ ss -tulpen | grep 8080 :~$

r_buchwalder · ‎08-26-2021

Hello Atullo I'll enter the following command: sudo systemctl restart demisto | tail -f /var/log/demisto/server.log After that I do see Logs from Demisto and wait until I see: info Server up and running, good luck to us all After that I do a: systemctl status demisto And check, If there is: Loaded: loaded (/etc/systemd/system/demisto.service; enabled; vendor preset: disabled) Active: active (running) since Thu 2021-08-26 17:01:05 CEST; 2min 41s ago thanks roger PS: I just saw, that the one Demisto-Service is still in a shutdown prodecere, and is traped in a loop: 2021-08-26 17:11:53.3694 info Long running has stopped for instance [an_instance_1] 2021-08-26 17:11:53.3698 info Creating container manager for single run for docker image [demisto/pyt...] 2021-08-26 17:11:53.4215 info Stopping docker container demistoserver_py 2021-08-26 17:11:53.7984 error Container exit with error. container name: [demistoserver_py...] error: [exit status 137] (2619) 2021-08-26 17:11:54.3401 info Existing long running instance [an_instance_1] 2021-08-26 17:11:54.3403 info Long running execution has stopped for instance [an_instance_1] I'm going to reboot the machine.

r_buchwalder · ‎08-26-2021

Hello I'll try to get a API request from our Panoramas. The curl request looks like; curl -X GET "https://<panorama>/api/?key=<api-key>&type=op&<show><devices><all></all></devices></show>" So, I tried with the Integration "Palo Alto Networks PAN-OS" There is a command "panorama", where I mitgh enter some Automations, here "type" and "cmd". If I enter those data into that command, the result is empty. Task Result #1: panorama Command: !panorama cmd="<show><devices><all></all></devices></show>" type="op" (Panorama) Command was executed successfully. But there is no Result: Outputs (0) and " There are no outputs for this task" So I've read the Manual for that integration and that command: https://xsoar.pan.dev/docs/reference/integrations/panorama#panorama And there I see, that cmd "Specifies the xml structure that defines the command. Used for operation commands." and command says: "Run a command. For example, command =<show><arp><entry name='all'/></arp></show>" If I try to enter my cmd= into Command, I do get an Error back: Reason Request Failed. with status: 400. Reason is: Missing value for parameter "cmd". (can we remove those "&quot"?) soo.. Also If I enter cmd=-arguments into both arguments (cmd and command) - I do get an empty response. So, how do I request Panorama? Actually I'de like to get all devices connected/managed though Panorama, so I can work further in my new build playbook. thanks roger

r_buchwalder · ‎08-25-2021

Hello Atullo Indeed, I did not hat the colon in the config - could you please take care, that this little info gets into the document in my thead opening? How ever, I did all your steps, but system could not find d1.service, I tried first with demisto.service then with a reboot - still no port 8080 (btw, I like the -tulpen, use it since years 🙂 ) regards roger

Member Since	‎11-04-2020 06:08 AM
Date Last Visited	‎05-10-2022 11:55 AM
Posts	55
Total Likes Received	8

Online Status	Offline
Date Last Visited	‎05-10-2022 11:55 AM

About r_buchwalder

Minemeld & Log4j

Re: Need help for Hybrid Analysis Automatisation

Re: [XSOAR] Issue downloading files

Re: XSOAR - Send CSV

Wildfire Report "Results" into "Outputs"

Cortex XSOAR search "contains" instead of "equals"

Task "jira-edit-issue" can not handle arrays in "Description"-Filed (with solution)

Enable Communication Tasks

Re: Enable Communication Tasks

Confluence Service username ascii-problems

Re: Confluence Service username ascii-problems

Re: RegEx ... a comprehensive list?

Re: War room: View full content in a new tab. Output in column instead of row

Minemeld taking up a lot of disk space opt/minemeld/local/trace/*

Re: Service APIVoid' Test fails with a 'success'

Minemeld & Log4j

Re: Need help for Hybrid Analysis Automatisation

Re: [XSOAR] Issue downloading files

Re: XSOAR - Send CSV

Wildfire Report "Results" into "Outputs"

Re: XSOAR - Send CSV

Re: [XSOAR] Issue downloading files

Need help for Hybrid Analysis Automatisation

Re: Enable Communication Tasks

Re: Cut syslog messages, strugeling on commas between quotes

Re: Cut syslog messages, strugeling on commas between quotes

Re: Enable Communication Tasks

Re: Enable Communication Tasks

Integration "Palo Alto Networks PAN-OS" Question

Re: Enable Communication Tasks

Network Security

Cloud Security

Security Operations

About r_buchwalder