This website uses cookies essential to its operation, for analytics, and for personalized content. By continuing to browse this site, you acknowledge the use of cookies.
For details on cookie usage on our site, read our Privacy Policy
For details on cookie usage on our site, read our Privacy Policy
About scottsander
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- LIVEcommunity
- About scottsander
03-21-2019
71Posts
20Likes
3Solutions
Mar 21, 2019Last Visited
User
Activity
User
Profile
Latest posts by scottsander
| Subject | Views | Posted |
|---|---|---|
| 2048 | 03-21-2019 01:24 PM | |
| 12066 | 04-22-2018 11:00 AM | |
| 12050 | 04-21-2018 05:09 PM | |
| 4884 | 04-03-2018 01:50 PM | |
| 4885 | 04-03-2018 01:28 PM |
My Liked Posts
| Subject | Likes | Posted |
|---|---|---|
| 1 Like | 06-15-2017 03:24 PM | |
| 1 Like | 04-03-2018 01:50 PM | |
| 3 Likes | 04-22-2018 11:00 AM | |
| 2 Likes | 04-26-2017 06:05 AM | |
| 1 Like | 11-16-2016 06:13 AM |
Posts I Liked
| Subject | Likes | Author | Latest Post |
|---|---|---|---|
| 1 Like | |||
| 1 Like | |||
| 2 Likes | |||
| 1 Like | |||
| 1 Like |
User Badges
Community Statistics
| Member Since | 05-15-2012 12:01 PM |
| Date Last Visited | 03-21-2019 05:29 PM |
| Posts | 71 |
| Total Likes Received | 20 |
03-21-2019
01:24 PM
I'm trying to create a miner that generates a list of TOR exit nodes for consumption by PAN-OS in an EDL. I found the "blutmagie.tor_exit_nodes" prototype and built a graph. My graph uses stdlib.aggregatorIPv4Generic for the processor node and stdlib.feedHCGreen for the output node.
It does generate a list of IPs at the resulting URL, but it's... odd. The prototype uses the following URL: torstatus.blutmagie.de/ip_list_exit.php/Tor_ip_list_EXIT.csv.
As you can see, this is a CSV file. I checked the file and it's just a list of individual IPv4 addresses, one per line. However, when MineMeld builds the EDL, it shows up like this:
102.165.54.56-102.165.54.56
103.194.170.223-103.194.170.223
103.208.220.122-103.208.220.122
103.208.220.226-103.208.220.226
103.234.220.195-103.234.220.195
103.234.220.197-103.234.220.197
103.236.201.110-103.236.201.110 etc.
As you can see it's generating output with ranges, where each range contains a single IP address. Even more, the ranges don't seem to be generating correctly. See this:
109.70.100.10-109.70.100.10
109.70.100.2-109.70.100.2
109.70.100.3-109.70.100.3
109.70.100.4-109.70.100.4
109.70.100.5-109.70.100.5
109.70.100.6-109.70.100.6
109.70.100.7-109.70.100.7
109.70.100.8-109.70.100.8
109.70.100.9-109.70.100.9
Shouldn't that be just....
109.70.100.2-109.70.100.10
...?
If it's not going to build real ranges, I'd just prefer it to be lists of single IP addresses, but I can't figure out how best to approach this. I'm a MineMeld novice, and I can't figure out where the code is that generates the output indicated here.
Pointers would be very welcome.
... View more
04-22-2018
11:00 AM
3 Kudos
OP might still need help, but I figured mine out. Thank you to lmori for the tip about rabbitmq. After going down a bit of a *ahem* rabbit hole in terms of figuring out why that wasn't starting, I found that I had an entry in /etc/hosts that had the server's old IP address:
<old IP address> hostname.domain.com hostname
I just updated this entry in /etc/hosts...
<new IP address> hostname.domain.com hostname
...and rebooted the server.
MineMeld is now working!
username@hostname:~$ sudo -u minemeld /opt/minemeld/engine/current/bin/supervisorctl -c /opt/minemeld/supervisor/config/supervisord.conf status [sudo] password for username: minemeld-engine RUNNING pid 1742, uptime 0:14:13 minemeld-supervisord-listener RUNNING pid 1741, uptime 0:14:13 minemeld-traced RUNNING pid 1743, uptime 0:14:13 minemeld-web RUNNING pid 1744, uptime 0:14:13
... View more
04-21-2018
05:09 PM
I am having the exact same issue as the OP. I changed the MineMeld server's IP address and now the MineMeld engine won't run.
username@hostname:~$ sudo -u minemeld /opt/minemeld/engine/current/bin/supervisorctl -c /opt/minemeld/supervisor/config/supervisord.conf status minemeld-engine FATAL Exited too quickly (process log may have details) minemeld-supervisord-listener RUNNING pid 1696, uptime 0:30:17 minemeld-traced FATAL Exited too quickly (process log may have details) minemeld-web RUNNING pid 1699, uptime 0:30:17
I'm also seeing socket.error: [Errno 111] Connection refused in the engine logs.
I installed MineMeld on Ubuntu 16.04 using the MineMeld Ansible Playbook. I don't have iptables rules configured (well, I do, but they are wide open):
username@hostname:~$ sudo iptables -S
-P INPUT ACCEPT -P FORWARD ACCEPT -P OUTPUT ACCEPT
If anything is configured in a configuration file somewhere to use the server's old IP address, it is something that was done by the ansible playbook installation, not something that I've done.
... View more
04-03-2018
01:50 PM
1 Kudo
I figured it out. I noticed that office365_URLaggregator is based on the prototype stdlib.aggregatorURL which seems to accept only inputs of type "URL" and the prototype stdlib.listDomainGeneric is type "Domain". I found a prototype called stdlib.listURLGeneric and based my new miner on that instead and was able to add it to the aggregator and then verify it was showing up in the resulting EDL. TL;DR: I used the stdlib.listURLGeneric protoype instead of your suggested stdlib.listDomainGeneric. Thanks for getting me pointed in a useful direction!
... View more
04-03-2018
01:28 PM
[UPDATE]: The issue I discuss in this particular post is solved. The resolution is in the following post. Hm. OK, would you mind providing some guidance? I am a MineMeld novice and don't find the interface very intuitive. I previously followed PAN's guide on setting up MineMeld for Office 365. So, based on that, I believe I somehow need to feed the office365_URLaggreggator (prototype: stdlib.aggregatorURL) this new miner you suggested. The trouble is, I seem to be having problems with getting it created correctly. After I create the new stdlib.listDomainGeneric miner and Commit, I don't seem to be able to add it to the aggregator. Here are the steps I'm following to create the new miner. In MineMeld, go to Config. Scroll down and press the hamburger icon (tooltip: browse prototypes). Locate stdlib.listDomainGeneric and click it. Press Clone. Name the new node office365_additionalurls. Press Commit. Go to Nodes. Click on office365_additionalurls. Click the Indicators icon. Press the + icon, enter outlook.com in the Indicator field, and change the Share Level to Green. The problem comes in when I try to then add the new office365_additionalurls miner as an Input on the office365_URLaggregator. I click the list of inputs on the aggregator and find that office365_additionalurls is not an available selection.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
03-21-2019
05:29 PM
|
Likes From
LEGAL NOTICES
Copyright 2007 - 2023 - Palo Alto Networks