Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Get Started
- News & Events
- Collaboration
- Education Services
- Technologies
- Next-Generation Firewall
- GlobalProtect
- Threat Prevention Services
- Endpoint Protection
- SSL Decryption
- App-ID
- Content-ID
- User-ID
- 5G
- IoT Security
- Cloud Identity Engine
Network Security
- Prisma Access
- Prisma Cloud
- Prisma SD-WAN
- CN-Series
- VM-Series:
- Alibaba
- AWS
- GCP
- Azure
Cloud Security
- Cortex XDR
- Cortex XSOAR
- Cortex Data Lake
Security Operations
- Resources
- COVID-19 Response Center
About PA-User
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- LIVEcommunity
- About PA-User
08-09-2019
7Posts
0Likes
0Solutions
Aug 09, 2019Last Visited
User
Activity
User
Profile
Latest posts by PA-User
| Subject | Views | Posted |
|---|---|---|
| 3328 | 02-28-2018 10:52 AM | |
| 3333 | 02-28-2018 10:41 AM | |
| 3366 | 02-27-2018 12:32 PM | |
| 2502 | 02-15-2018 09:05 AM | |
| 4800 | 02-14-2018 08:00 AM |
Posts I Liked
| Subject | Likes | Author | Latest Post |
|---|---|---|---|
| 1 Like | |||
| 1 Like | |||
| 1 Like | |||
| 1 Like | |||
| 1 Like |
User Badges
Community Statistics
| Member Since | 08-19-2015 09:10 AM |
| Date Last Visited | 08-09-2019 04:55 PM |
| Posts | 7 |
02-28-2018
10:52 AM
Awesome! Looking forward to that. I've been managing DAG (Dynamic Address Group) objects in PA with some homebrew scripting up to now. Hoping to let minemeld take over some of that.
I've got one more question to add if it's not too much trouble -- maybe you were already addressing this. Does the DAGPusher node remove IPs registered to a DAG that are no longer present because they have been removed from the list?
My experience has been that adding IPs to DAGs via API is super easy but then the care and feeding of syncing the lists takes a bit more scripting and verification. I'curious whether DAGPusher removes IPs that have been removed from it's list.
... View more
02-28-2018
10:41 AM
I was hoping you'd chime in; you've been immensly helpful!
Is that something you were hoping to publish this week yet or is it still a work in progress?
... View more
02-27-2018
12:32 PM
Regarding DAGPusher Output node.
I don't mean to hit anyone with a firehose but I have several questions I'm having trouble finding the answers to regarding the DAGPusher Output node in MineMeld. It's my understanding this node will allow MineMeld to add IPs to a Dyanmic Address Group object on a PA.
Is there any documentation for this module?
How is the desired Dyanmic Address Group object on the target PA specified?
How is the vsys specified? When adding a new "handled device" vsys isn't listed but after adding there is a column for it.
Is there a minimum PA software version for this to work?
Can the a PA API key be utilized instead of user password?
I'm doing some testing and can see where to add "handled devices"; however, as of yet I'm not seeing entries being pushed to my lab pa after providing the ssh credentials. I'm interested the expected behavior of this module.
*EDIT*
After switching from FQDN for hostname to IPv4 address, I'm now seeing entries being pushed looks like it's pushing the IPs to the following tags by default;
"mmld_confidence_high" "mmld_direction_unknown" "mmld_pushed"
I'm assuming then I will need to modify the prototype to specifcy a different tag. Any info on what 'config/variables' I would need to set to change or add a different tag?
... View more
02-15-2018
09:05 AM
I’m interested in whether MineMeld can, or should, be used to trigger a PA EDL refresh if the indicators for a feed were changed after an update?
Has anyone seen this done before?
I’m curious whether this would be a recommended solution or whether interfacing with a PA’s API should be left to another scripting platform? If it is appropriate to perform this from the MineMeld platform, I’m interested in how best to accomplish that.
The use case for this is on a pre-8.x PA platform where frequent EDL refreshes have become worrisome and sometimes problematic. The thought here is to only trigger the PA EDL refresh if and when a MineMeld feed has had changes to the feed in question. The hope is that this would reduce the EDL refresh interval for several of our current feeds and help to eliminate commits jobs that aren’t doing anything. The API into the PA is already established and the API calls to refresh these lists are working from a separate scripting platform. The thought was to simplify the solution by allowing MineMeld to make the call directly.
... View more
02-14-2018
08:00 AM
Yep,
Not a problem, I'll setup an API account and include the crediantials in my curl request. This is certainly workable. Thanks for all your help!
... View more
02-13-2018
02:02 PM
xhoms,
Thanks! Getting closer.
Looks like that works well once authenticated; however, is there a way to generate an API key to trigger these from a remote scripting platform?
... View more
02-13-2018
01:16 PM
Is anyone aware of a way to remotely trigger a Minemeld Miner refresh.
Does MineMeld have it's own API?
I'm familiar with using PA API and Dynamic Address Groups for instant addititions of IPs. This is for a usecase where EDLs are used and we'd like to trigger MineMeld and then PA refreshes. I can refresh the PA EDL via API; however, I'm not sure how to trigger a refresh on the MineMeld Miner.
As a workarround for now, I may just adjust the Miner prototype update frequency to something small. No more than a few minutes and then just delay the PA refresh until outside the Miner refresh interval I go with.
With all of that said, I'm curious whether MineMeld has it's own API wherein I can trigger events such as a miner refresh remotely.
... View more
LEGAL NOTICES
Copyright 2007 - 2021 - Palo Alto Networks
