About Sistemas_SanLucar

Hi,   Thank you for your answer. But it does not indicate how to remove a malicious element that is in the quarantine.   I don't understand why there's no option in the console to tell the agent to delete it.   I still think the console has a long way to go to catch up with other similar products.   Regards ... View more

It's the same for us. We use Traps with another Sophos Endpoint antivirus. The problem is that Sophos detects the files in the trap quarantine and we want to delete them manually and we can't. We've tried it: -Connect to the remote Traps console and perform a deletion of the /f pathfile. I thought that the Traps console already had enough permissions to delete their files. (bummer!) -I tried to run from the same console a /User rune:... but it asks me for the password and I can't type it. -I tried to connect through Windows Explorer with a domain user who is a member of the machine's administrator. I see the file but it won't let me delete it. What permissions and what do I have to do to delete it? Can someone share the way to do it? Palo Alto could take note of improving the product. He can be very good at detecting viruses but if he doesn't improve the console and management tools we don't do anything.   Regards ... View more

I don't have any solution.   I've reinstalled Minemeld and it's working. But days later it stops working again. It shows data in the miner, in the processor but not in the output. When it fails, I try to uninstall the plug-in and reinstall it and therefore generate the miner, processor and output again. It doesn't work if I don't do the first step. When I install the plugin from github, I copy the link and the master version, 0.1 and 0.11 comes out. Choose which one you choose, always install version 0.1.     ... View more

Some prototype does that Minemeld crashs   I deployed other instance in Ubuntu 18 ... View more

How do i do it?   thank you ... View more

1)a) Add the repositories fo file /etc/apt/sources.list deb http://us.archive.ubuntu.com/ubuntu/ bionic universe /etc/apt/sources.list deb http://minemeld-updates.panw.io/ubuntu trusty-minemeld main 1)    $ sudo apt-get update 2)    $ sudo apt-get upgrade # optional 3)    $ sudo apt-get install -y gcc git python-minimal python2.7-dev libffi-dev libssl-dev make 4)    $ wget https://bootstrap.pypa.io/get-pip.py 5)    $ sudo -H python get-pip.py 6)    $ sudo -H pip install ansible 7)    $ git clone https://github.com/PaloAltoNetworks/minemeld-ansible.git 😎     $ cd minemeld-ansible 8)a) After setp 8), we modified configuration I copeid the files  Ubuntu-16.04.yml to Ubuntu-18.04.yml  in directory structure , these files didn't exist in setup. Current structure: ./roles/infrastructure/vars/Ubuntu-14.04.yml ./roles/infrastructure/vars/Ubuntu-16.04.yml ./roles/infrastructure/vars/Ubuntu-18.04.yml ./roles/minemeld/vars/Ubuntu-14.04.yml ./roles/minemeld/vars/Ubuntu-16.04.yml ./roles/minemeld/vars/Ubuntu-18.04.yml ./roles/minemeld/tasks/Ubuntu-18.04-post.yml ./roles/minemeld/tasks/Ubuntu-16.04-post.yml ./roles/minemeld/tasks/Ubuntu-14.04-post.yml 8)b) As indicated at the beginning of the README.MD installation manual, we have modified the local.yml file to be able to install the stable version instead of the "dev" development one. So that the local.yml file remains this way. ----------------------------------------- - name: minemeld playbook   hosts: 127.0.0.1   connection: local   become: true   vars:           #  minemeld_version: develop     file_permissions: 'u=rwX,g=rwX,o=rX'   # uncomment the following to install stable     minemeld_version: master     group_permissions: 'u=rwX,g=rX,o=rX'   # remove comment to set custom repositories   # core_repo: " https://github.com/jtschichold/minemeld-core.git "   # prototype_repo: " https://github.com/jtschichold/minemeld-node-prototypes.git "   # webui_repo: " https://github.com/jtschichold/minemeld-webui.git "   roles:   - infrastructure   - minemeld ------------------------------------------- 9)    $ ansible-playbook -K -i 127.0.0.1, local.yml 10)    $ usermod -a -G minemeld # add your user to minemeld group, useful for development ... View more

Hi,   Forgive my ignorance on the subject. You mean to rerun the command: ansible-playbook -K -i 127.0.0.1, local.yml or I have to rerun some more additional command before.     Thank you ... View more

Hi, A few days ago, I installed Minemeld con Ansible and Ubuntu 18. I think , I have a similar problem but with  urlhaus.URL. Regards   Regards ... View more

Hi,   I could install Minemeld in Ubuntu 18.04 but I had a problem   https://github.com/PaloAltoNetworks/minemeld-ansible/issues/35   and fixed it.   I have a question. I can't run the command   /usr/sbin/minemeld-auto-update File minemled-auto-update does not exists. then If I want to update Minemeld, how does I make it?   Thank you ... View more

Hi Xavier,   I ran the command:   "gpg --keyring /etc/apt/trusted.gpg.d/minemeld.gpg --fingerprint "     After I tried:   /usr/sbin/minemeld-auto-update   It did not work.   Regards   Hola Xavier,   Intenté el comando que me indicas y parece que la firma es correcta. Pero falla cuando intento actualizar.   ¿se os ocurre que más podría hacer?   Gracias   Saludos   ... View more

Hi,   thank you for your answer.   I tried to apply it but I had problems.   I have Pan-os 6.1.0   When I try to create a url filter profile. it does not show my dbl.   how could I make it?   thank you   ... View more

Thank you. ... View more

  I continue with the doubt. If the list has 5000 ip. What does Palo Alto do? Does it only read from the list the ip that it allows? Does it give error and does not read anything?   Thank you ... View more

i,   I have installed Minemild and I applied article and create dbl for Offcie365:   https://live.paloaltonetworks.com/t5/MineMeld-Arti cles/How-to-Safely-Enable-access-to-Office-365-usi ...   I have cretate 2 rules for Office 365 to test if feed sources Office 365 works.   I have a rule to match with feed list office 365 servers and application Office365 and all traffic should match with this rule. And I have below this rule other rule with destination "any" and application Office 365.   Log shows traffic match with 2 rule.   That means there are IPs that are not in the sources provided by Minemeld.   On the other hand, System Log Pa-500 shows this message:   'EBL(O365-IPV4) Refresh Aborted. No changes to list file   what's mean this message? Is an error ? ... View more