About andrew.stanton

In a Dagpusher output, I see the VSYS as a column, but when adding device there is no input field for VSYS.       I checked the code on GitHub for the file at: minemeld-webui/src/app/nodedetail/dagpusher.controller.ts   Seems like maybe the VSYS is not fully implemented as part of add device.       Can anyone confirm whether we can mention VSYS somewhere else for dagpusher device? ... View more

Hello,   I have a dev and prod instance of MM.  Noticed both dev and prod behaving the same way, where many indicators were not showing up in output feed for AWS miners.  Config on both is the following:   nodes: aws_route53_miner: inputs: [] output: true prototype: aws.ROUTE53 aws_ipv4_output: inputs: - aws_ipv4_aggregator output: false prototype: stdlib.feedHCWithValue aws_s3_miner: inputs: [] output: true prototype: minemeldlocal.aws_S3 aws_ec2_miner: inputs: [] output: true prototype: aws.EC2 aws_amazon_miner: inputs: [] output: true prototype: aws.AMAZON aws_ipv4_aggregator: inputs: - aws_cloudfront_miner - aws_ec2_miner - aws_route53_miner - aws_route53_healthchecks_miner - aws_amazon_miner - aws_s3_miner output: true prototype: stdlib.aggregatorIPv4Generic aws_cloudfront_miner: inputs: [] output: true prototype: aws.CLOUDFRONT aws_route53_healthchecks_miner: inputs: [] output: true prototype: aws.ROUTE53_HEALTHCHECKS Dev/Prod both showed the same # of indicators on Nodes tab:   aws_amazon_miner 511 aws_cloudfront_miner 35 aws_ec2_miner 222 aws_route53_healthchecks_miner 16 aws_route53_miner 2 aws_s3_miner 62   aws_ipv4_aggregator 323 aws_ipv4_output 346   I made a change in dev to take the aws_amazon_miner with 511 indicators straight to an output.   nodes: aws_test_full_output: inputs: - aws_amazon_miner output: false prototype: stdlib.feedHCWithValue The result is that the issue is not seen on this output, but the original aggregator and output nodes also had the issue go away for the time being:   aws_ipv4_aggregator 848 aws_ipv4_output 577 aws_test_full_output 511   Was planning to go production with this AWS output next week.  Need to vet out this issue asap.   Attaching engine logs from both instances as well as copys of output feeds in multiple versions.   prod  0.9.36 dev 0.9.38   ... View more

I cannot find any documentation on these prototypes.  How does MM know what devices to push to?  It seems to me we would need to clone stdlib.nonpersistentDagPusher or stdlib.dagPusher and enter some configuration.     I also don't understand the difference between persistent and nonpersistent.  Since the output doesn't live on MM, I would hope that MM would be able to add and remove registered IPs from all configured devices or firewalls.  Is this the difference between the two?     ... View more

I tried this and it seemed to work, just want to be sure it is the right procedure.   1. Disable/delete existing extension wheel 2. Upload/activate updated extension wheel   Is there any negative impact on the nodes using the prototypes and classes of the removed extension between steps 1 and 2? ... View more

I didnt see an issue on the GitHub for this or anything in the discussions.   ... View more

If able to successfully create a new class by adding code to the /engine folder, will that code essentially be lost when MineMeld updates?   I understand the ability to add classes/extensions will be added in the future, but it is not here yet.   https://github.com/PaloAltoNetworks/minemeld-core/issues/113     ... View more

Hello,   In some use-cases, we may want to have the following features:   Filtering - Maybe a list of search strings that if matched are excluded from the output Use-Case: URL lists for O365 are very messy, and sometimes we don't trust all the output given by MS.  We may want to filter certain URLs from getting added to the output Notification - Knowledge of new additions/removals to an output via email, syslog, HTTP call, or whatever other notification framework fits best with the project (I do see there are logs in the Log tab, but I am not sure exactly the meaning, and/or if anything can be done with these logs) Use-Case: Some lists may need to be monitored closely, particularly lists that do not change often or have significant impact in the environment.   Approval - Approve changes before they are added to an output Use-Case: Similarly with O365, we may want to approve the changes rather than trust them by default.  Some vetting process may be done by the admin, and they would decide to add something to the filter or approve the changes   Would this be some kind of processor node that handles these?   Is there something I am missing that is already doing this or maybe doing it in a different way than I have framed it up?   Thanks ~ Andrew ... View more

Hi,   Anyone have a prototype for the TOR IP list already aggregated by panwdbl via Emerging Threats?   Thank you. ... View more

I could see the node was having problems pulling the external resource due it being decrypted and our CA being used.   I added our CA to the Ubuntu store with the processes used here, but still no juice.   http://askubuntu.com/questions/645818/how-to-install-certificates-for-command-line   Thoughts? ... View more