I'm looking to change the threshold in traced.yml ("The threshold can be configured in the traced.yml config file"). What are the arguments to achieve this change?
... View more
Everything on here no longer works. CFs fail due to not trusting repo, and User Data is too big to import on a fresh launch EC2 instance. Maybe you can simply write a User Data script based on the 3 commands needed to build MineMeld which you have documented on the manual method of installing on Ubuntu 14.04.
... View more
Does the DAG pusher work with the autofocus hosted minemeld/are there any differences in the way the dagpusher pushes---I would think the Firewall would have to initiate the connection to autofocus- or are people whitelisting autofocus.paloaltonetworks.com coming into their environment?
... View more
I echo the suggestions below. If there was also a robust API, this might be able to be scripted external to MM, but even just a syslog would be useful to create at least the notification.
... View more
Hi @andrew.stanton,
thanks, this is a bug and will be fixed in the next release. Details here: https://github.com/PaloAltoNetworks/minemeld-core/issues/213
A workaround is forcing a flush and an update on the existing miner you just added to the aggregator:
$ /opt/minemeld/engine/current/bin/mm-console signal flush aws_amazon_miner
$ /opt/minemeld/engine/current/bin/mm-console hup aws_amazon_miner
... View more
Hi @andrew.stanton,
if you have a new version of an existing extension you don't need to deactivate the former version, you can just upload and activate the new one. The old version should be automatically deactivated.
luigi
... View more
Hi @andrew.stanton,
would you mind opening an issue on github in the minemed-core repo ?
Here: https://github.com/PaloAltoNetworks/minemeld-core/issues
... View more
Hi @andrew.stanton,
we have a beta for it and we should release it next week(-ish).
You can find two sample extensions here:
https://github.com/PaloAltoNetworks/minemeld-cef (output node for Arcsight CEF)
https://github.com/PaloAltoNetworks/youtube-miner (Miner for Youtube API)
luigi
... View more
Also, I did find a tor prototype. Hard to search for it because 'tor' is at the end of aggregator and such...
tor.exit_addresses PROTOTYPE
I find this one is different than the Emerging Threats source. It has less indicators.
... View more
HI @andrew.stanton,
that's what is being used by MineMeld. That file is upgraded with MineMeld upgrades.
The idea then would be:
- take that file and place it in a "safe" directory (a directory persistent across upgrade), like /opt/minemeld/local/certs
- append your cert to that file
- create the file /etc/default/minemeld with contenets "export REQUESTS_CA_BUNDLE=/opt/minemeld/local/certs/cacert.pem"
- sudo service minemeld restart
We are working on a utility to do this.
... View more