LIVEcommunity - About jnewsome

jnewsome · ‎04-18-2018

Thanks Luigi! -John Newsome

jnewsome · ‎04-17-2018

Hi Luigi, Which Ubuntu 14.04 Trusty image are you running? Below is my image... ubuntu/images/hvm-ssd/ubuntu-trusty-14.04-amd64-server-20180404 (ami-d8359ca5) I'm following the manual install process exactly and it works consistently when spinning up Ubuntu on VMWare but in AWS, I continue to get the following error... minemeld-engine FATAL Exited too quickly (process log may have details) minemeld-supervisord-listener RUNNING pid 4720, uptime 0:05:10 minemeld-traced RUNNING pid 4722, uptime 0:05:10 minemeld-web FATAL Exited too quickly (process log may have details) Thanks! -John Newsome

jnewsome · ‎04-17-2018

Thanks Luigi, Any differences between your environment and mine? I'm flexible in mirroring your setup until the new release on PIP 10.0. Thanks! -John Newsome

jnewsome · ‎04-16-2018

Hi Luigi, Forgot that my demo system is a VM-50 which does not support less than PANOS 8.x. Do you have an ETA on when MM will get an update to support the new 8.x logging format? This syslog feature has been a part of my demo script. I can work around it but it does add a bit of sizzle to my demos 🙂 Thanks! -John Newsome

jnewsome · ‎04-16-2018

Hi Luigi, The install is still failing. It's still an issue with Rabbitmq-server. I'm using a Unbutu 14.0.4 LTS (HVM) Instance in AWS. My VPC and EC node is in N. Virginia. My security rule is wide open so there should be nothing blocking any outbound or inbound process. I have attached the AWS system log. Thanks for your help! -John Newsome

jnewsome · ‎04-16-2018

Thanks Luigi! I'm on PANOS 8.1. I can downgrade as this is a demo system. What is the latest PANOS release that supports this feature? Thanks again! -John Newsome

jnewsome · ‎04-13-2018

Team, I've followed this process exactly and I am not seeing any hits in my MM instance. I had this working at some point in the past so I'm not sure what's changed. This is a new MM instance. Netstat does show an active TCP connection between my MM instance and my Firewall on TCP port 13514. https://live.paloaltonetworks.com/t5/MineMeld-Articles/Correlating-PAN-OS-syslog-with-indicators/ta-p/72078 Thanks! -JN

jnewsome · ‎04-13-2018

Team, I'm attempting to delpoy a MM instance into AWS and running into issues which appears to stem from rabbitmq. I have a firewall and other Unbuntu instances deployed so I know my network settings are good. When I deploy the MM instance I can validate that all network services are operational but the install comes to a scretching halt when rabbitmq fails to load. I'm using MM cloud-init version 0.9.8-04. Below is the output from the AWS console system log. Any ideas?

jnewsome · ‎03-09-2018

Team, I'm following the process outlined in the technote below, but I'm not seeing any indicators triggered within Minemeld. I have verified that syslog is configured correctly on the FW and when I attempt to ping IP's sourced by various miners (dshield, spamhaus, etc.) I see the actual syslog traffic between the firewall and my Minemeld node but nothing shows up in Minemeld. As matches in Minemeld. https://live.paloaltonetworks.com/t5/MineMeld-Articles/Correlating-PAN-OS-syslog-with-indicators/ta-p/72078 Any ideas? Thanks! -John Newsome

jnewsome · ‎11-28-2016

That was it Luigi! Had both 32 and 64 bit images of Ubuntu and ended up building my VM from the 32bit image 🙂 Thanks! -JN

jnewsome · ‎11-27-2016

Team, I have run into an issue installing Minemeld following the documented process for install on Ubuntu Server 14.04 LTS. Below is the output from apt update. Seems that there is a GPG key issue and I have made sure that the fingerprint characters match. Any guidance that can be provided would be greatly appreciated! Thanks! -JN jnewsome@minemeld:/etc/apt$ sudo apt-get update && sudo apt-get install -y minemeld rsyslog-minemeld rsyslog-mmnormalize >> minemeldinstall.log Ign http://us.archive.ubuntu.com trusty InRelease Get:1 http://us.archive.ubuntu.com trusty-updates InRelease [65.9 kB] Hit http://security.ubuntu.com trusty-security InRelease Get:2 http://minemeld-updates.panw.io trusty-minemeld InRelease [2,430 B] Ign http://extras.ubuntu.com trusty InRelease Hit http://us.archive.ubuntu.com trusty-backports InRelease Hit http://us.archive.ubuntu.com trusty Release.gpg Hit http://us.archive.ubuntu.com trusty Release Get:3 http://extras.ubuntu.com trusty Release.gpg [72 B] Get:4 http://us.archive.ubuntu.com trusty-updates/main Sources [385 kB] Hit http://security.ubuntu.com trusty-security/main Sources Get:5 http://extras.ubuntu.com trusty Release [11.9 kB] Ign http://extras.ubuntu.com trusty Release Get:6 http://us.archive.ubuntu.com trusty-updates/restricted Sources [5,888 B] Get:7 http://us.archive.ubuntu.com trusty-updates/universe Sources [169 kB] Hit http://security.ubuntu.com trusty-security/restricted Sources Get:8 http://extras.ubuntu.com trusty/main Sources [14 B] Get:9 http://us.archive.ubuntu.com trusty-updates/multiverse Sources [7,522 B] Get:10 http://us.archive.ubuntu.com trusty-updates/main i386 Packages [879 kB] Hit http://security.ubuntu.com trusty-security/universe Sources Hit http://security.ubuntu.com trusty-security/multiverse Sources Get:11 http://us.archive.ubuntu.com trusty-updates/restricted i386 Packages [16.2 kB] Get:12 http://us.archive.ubuntu.com trusty-updates/universe i386 Packages [390 kB] Hit http://security.ubuntu.com trusty-security/main i386 Packages Hit http://security.ubuntu.com trusty-security/restricted i386 Packages Get:13 http://us.archive.ubuntu.com trusty-updates/multiverse i386 Packages [14.5 kB] Hit http://us.archive.ubuntu.com trusty-updates/main Translation-en Hit http://us.archive.ubuntu.com trusty-updates/multiverse Translation-en Hit http://security.ubuntu.com trusty-security/universe i386 Packages Hit http://us.archive.ubuntu.com trusty-updates/restricted Translation-en Hit http://us.archive.ubuntu.com trusty-updates/universe Translation-en Hit http://security.ubuntu.com trusty-security/multiverse i386 Packages Hit http://us.archive.ubuntu.com trusty-backports/main Sources Hit http://security.ubuntu.com trusty-security/main Translation-en Hit http://us.archive.ubuntu.com trusty-backports/restricted Sources Hit http://us.archive.ubuntu.com trusty-backports/universe Sources Hit http://us.archive.ubuntu.com trusty-backports/multiverse Sources Hit http://security.ubuntu.com trusty-security/multiverse Translation-en Hit http://us.archive.ubuntu.com trusty-backports/main i386 Packages Hit http://us.archive.ubuntu.com trusty-backports/restricted i386 Packages Hit http://us.archive.ubuntu.com trusty-backports/universe i386 Packages Hit http://security.ubuntu.com trusty-security/restricted Translation-en Hit http://us.archive.ubuntu.com trusty-backports/multiverse i386 Packages Hit http://us.archive.ubuntu.com trusty-backports/main Translation-en Hit http://us.archive.ubuntu.com trusty-backports/multiverse Translation-en Hit http://security.ubuntu.com trusty-security/universe Translation-en Hit http://us.archive.ubuntu.com trusty-backports/restricted Translation-en Hit http://us.archive.ubuntu.com trusty-backports/universe Translation-en Hit http://us.archive.ubuntu.com trusty/main Sources Hit http://us.archive.ubuntu.com trusty/restricted Sources Hit http://us.archive.ubuntu.com trusty/universe Sources Hit http://us.archive.ubuntu.com trusty/multiverse Sources Hit http://us.archive.ubuntu.com trusty/main i386 Packages Hit http://us.archive.ubuntu.com trusty/restricted i386 Packages Hit http://us.archive.ubuntu.com trusty/universe i386 Packages Hit http://us.archive.ubuntu.com trusty/multiverse i386 Packages Hit http://us.archive.ubuntu.com trusty/main Translation-en Hit http://us.archive.ubuntu.com trusty/multiverse Translation-en Hit http://us.archive.ubuntu.com trusty/restricted Translation-en Hit http://us.archive.ubuntu.com trusty/universe Translation-en Ign http://us.archive.ubuntu.com trusty/main Translation-en_US Ign http://us.archive.ubuntu.com trusty/multiverse Translation-en_US Ign http://us.archive.ubuntu.com trusty/restricted Translation-en_US Ign http://us.archive.ubuntu.com trusty/universe Translation-en_US Fetched 1,947 kB in 6s (322 kB/s) W: GPG error: http://extras.ubuntu.com trusty Release: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 16126D3A3E5C1192 W: Failed to fetch http://minemeld-updates.panw.io/ubuntu/dists/trusty-minemeld/InRelease Unable to find expected entry 'main/source/Sources' in Release file (Wrong sources.list entry or malformed file) E: Some index files failed to download. They have been ignored, or old ones used instead.

Member Since	‎04-01-2013 06:08 AM
Date Last Visited	‎06-02-2020 01:33 PM
Posts	14

Online Status	Offline
Date Last Visited	‎06-02-2020 01:33 PM

Re: Deploying Minemeld in AWS using cloud-init

Re: Deploying Minemeld in AWS using cloud-init

Re: Deploying Minemeld in AWS using cloud-init

Re: PANOS Syslog Forwarding Not Working

Re: Deploying Minemeld in AWS using cloud-init

Re: Deploying Minemeld in AWS using cloud-init

Re: Deploying Minemeld in AWS using cloud-init

Re: Deploying Minemeld in AWS using cloud-init

Re: PANOS Syslog Forwarding Not Working

Re: Deploying Minemeld in AWS using cloud-init

Re: PANOS Syslog Forwarding Not Working

PANOS Syslog Forwarding Not Working

Deploying Minemeld in AWS using cloud-init

Syslog Matcher not matching on Indicators

Re: Issues installing Minemeld

Issues installing Minemeld

Network Security

Cloud Security

Security Operations