About Sarou22

Just as an FYI, the MineMeld image hasn't gotten updated in quite a long time. You could continue to utilize the Docker image and properly isolate it to become less of an issue, but it's still pretty outdated. ENVOY is a potential solution you could look into along with EDL Manager depending on the feature set that you actually need to utilize.  ... View more

thats right. the Firewall needs group mapping so you can use AD groups on your firewall. ... View more

@Sarou22, Since this is really basic service overview discussions, I would really recommend either reading Palo Alto Networks data sheet on these products or engaging your account team for an overview. That way you can get all of your questions answered as they are doing the product demo and it'll make more sense. If you don't want to engage your sales team and want to learn more about a particular product, take a look at the products admin guide. That's going to have a basic overview introduction section that describes what the product or service actually does.    As for for a brief overview:   AutoFocus: AutoFocus is all about threat intelligence and providing contextual information and correlation between events across your network. So it takes in all of the threat feeds from Cortex XDR agents you may have deployed, firewalls, WildFire, Prisma Access, ect. and provides additional context and alerting around all of the different events you are seeing on the network.    MineMeld: MineMeld is all about combining indicators from different sources and allowing you to feed those all back out in a processed easy to consume fashion. While it's used a lot to block resources across the network through mining blocklists of various types, you can just as easily use it to automatically pull in things like Azure or AWS service IPs.  ... View more

@Sarou22, You didn't actually include the diagram, so we can't actually explain the diagram to you ; - )   As for miner nodes, think of it as an intake. Its job is to simply extract indicators from whatever feed is defined in the prototype configuration. That's really the miner nodes job, it simply goes out to whatever source you've configured and pulls the indicators from the source. ... View more