Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Get Started
- News & Events
- Collaboration
- Education Services
- Technologies
- Next-Generation Firewall
- GlobalProtect
- Threat Prevention Services
- Endpoint Protection
- SSL Decryption
- 5G
- IoT Security
- Prisma SD-WAN
Network Security
- Prisma Access
- Prisma SaaS
- Prisma Cloud
- CN-Series
- VM-Series:
- Alibaba
- AWS
- GCP
- Azure
Cloud Security
- Cortex XDR
- Cortex XSOAR
- Cortex Data Lake
Security Operations
- Resources
- COVID-19 Response Center
- LIVEcommunity
- ›
- About chirss
About chirss
Announcements
Changes to the LIVEcommunity experience are coming soon... Here's what you need to know.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
12-12-2018
67Posts
7Likes
1Solution
Dec 12, 2018Last Visited
User
Activity
User
Profile
Latest posts by chirss
| Subject | Views | Posted |
|---|---|---|
| 1247 | 12-07-2018 05:39 AM | |
| 1647 | 11-08-2018 10:47 AM | |
| 4084 | 10-24-2018 10:19 AM | |
| 2032 | 08-16-2018 09:11 AM | |
| 1918 | 08-16-2018 08:51 AM |
My Liked Posts
| Subject | Likes | Posted |
|---|---|---|
| 2 | 07-05-2018 09:10 AM | |
| 1 | 06-02-2017 07:47 AM | |
| 1 | 07-05-2018 09:44 AM | |
| 1 | 09-27-2016 02:03 PM | |
| 1 | 10-06-2017 02:10 PM |
Posts I Liked
| Subject | Likes | Author | Latest Post |
|---|---|---|---|
| 1 |
User Badges
Public Statistics
| Date Registered | 09-14-2016 10:48 AM |
| Date Last Visited | 12-12-2018 02:53 PM |
| Total Messages Posted | 67 |
| Total Likes Received | 7 |
12-07-2018
05:39 AM
I have a different sort of thought and could use some help figuring out if mm can do this. Essentially I would like to feed in a list of ip addresses and then if there is a match against any blacklist to throw it to an output. The idea here is to list out all of the ip addresses I would want to know showed up in a blacklist/rbl in order to figure out why ip addresses I manage are getting listed and to know which blacklists are doing it. I don't have this problem right now, this is just more a thought I had on something else mm could do potentially.
... View more
11-08-2018
10:47 AM
I'm feel like I'm being a bit obtuse here, however I can't figure this out. The stdlib.listIPv4Generic miner allows for either cidr or a range. However when I enter x.x.x.x-x.x.x.x it doesn't like this format. I've also tried things like x.x.x.[x-x] and the like. Does anyone know what range format this miner will accept?
... View more
10-24-2018
10:19 AM
I'm back on this, a year later. Trying to relate subscribing to a person or pulse to how it gets pulled by the miner, if it does.
... View more
08-16-2018
09:11 AM
It's a bit more complicated, but maybe this can help as well? ^((?:((\d{1,3}.){3}\d{1,3}\s))(.*))$ I haven't tested it yet since I don't have a feed like this, but it seems to match and non-capture group on what it needs to.
... View more
08-16-2018
08:51 AM
Anyone had a chance to think on this? I've not come much further on these.
... View more
07-05-2018
09:44 AM
1 Kudo
Watch out on redhat, I ran into an issue with the sslwrap library on any miner using ssl/tls. If you run into this ensure python-gevent is installed. We ran into too many issues on rhel and ended up moving to a different supported platform.
... View more
07-05-2018
09:10 AM
2 Kudos
Hi, I'm considering how to do some of the following, if anyone has advice or links to documentation I'm not finding I would appreciate it: Export the configuration in a way that any local custom miners are also backed up, meaning the restore is a literal one liner command or something along those lines. The export backup is a manual click and won't work for something automated. Integration with active directory, ldap, or something else for authentication based on group membership to the web ui. High availability. Other than auto focus I can't seem to find a way to handle this. If a mm instance is down other than some sort of vip/round robin dns solution, or something else does anyone have a suggestion here? Thanks!
... View more
11-10-2017
02:20 PM
Ya. But firehol has a ton of lists. It might be worth contacting them directly to see if they have a preferred way to grab the data than from github.
... View more
10-09-2017
09:59 AM
Do you have a logstash sending the indicator additions and removals over to your siem?
... View more
10-06-2017
02:10 PM
1 Kudo
This one is fairly straight forward. Based on an ipv4 miner:
attributes: confidence: 50 direction: inbound share_level: green type: IPv4 ignore_regex: ^# source_name: firehol.blocklist_net_ua url: https://raw.githubusercontent.com/firehol/blocklist-ipsets/master/blocklist_net_ua.ipset user_agent: MineMeld
There are a ton of lists just under his blocklist ipsets:
https://github.com/firehol/blocklist-ipsets
I'm not sure if this is the right way to go about processing the data long term, but in the short term it looks handy.
... View more
10-06-2017
09:04 AM
There's ebl, edl, persistentdag, nonpersistentdag, etc. Limits on the number of feeds.
Does anyone have a concise summary of some kind which makes picking which one of these, or combination of these, is the best route to go for integrating with panos?
... View more
10-05-2017
09:50 AM
Ya exactly.
The problem I'm finding is a lot of the miners likely have duplicate entries of some kind. So I'm sending them all to the same processor for similar types of feeds (phishing type miners to phishing processor for example). However I have to validate everything coming in before being able to trust it, i.e. verify before trusting.
The scenario you're talking about would be very beneficial in at least this scenario.
... View more
10-05-2017
08:32 AM
Also maybe a miner isn't the right thing so much as a processor. If an ioc hits the processor it then queries the api (within limits of the api).
There are an awful lot of reputation type things which could possibly be used in a similar manner.
... View more
10-05-2017
08:31 AM
Ya that's what I want as well. If I can compare url information from a feed with what safebrowsing thinks of it and then come up with a ranking to be used by different outputs that would be ideal. Is this what you are thinking? I haven't played enough with miner creation to build anything like this out.
... View more
Latest Blogs
Latest Posts
Copyright 2007 - 2021 - Palo Alto Networks
