About chirss

chirss · ‎12-07-2018

I have a different sort of thought and could use some help figuring out if mm can do this. Essentially I would like to feed in a list of ip addresses and then if there is a match against any blacklist to throw it to an output. The idea here is to list out all of the ip addresses I would want to know showed up in a blacklist/rbl in order to figure out why ip addresses I manage are getting listed and to know which blacklists are doing it. I don't have this problem right now, this is just more a thought I had on something else mm could do potentially.

chirss · ‎11-08-2018

I'm feel like I'm being a bit obtuse here, however I can't figure this out. The stdlib.listIPv4Generic miner allows for either cidr or a range. However when I enter x.x.x.x-x.x.x.x it doesn't like this format. I've also tried things like x.x.x.[x-x] and the like. Does anyone know what range format this miner will accept?

chirss · ‎10-24-2018

I'm back on this, a year later. Trying to relate subscribing to a person or pulse to how it gets pulled by the miner, if it does.

chirss · ‎08-16-2018

It's a bit more complicated, but maybe this can help as well? ^((?:((\d{1,3}.){3}\d{1,3}\s))(.*))$ I haven't tested it yet since I don't have a feed like this, but it seems to match and non-capture group on what it needs to.

chirss · ‎08-16-2018

Anyone had a chance to think on this? I've not come much further on these.

chirss · ‎07-05-2018

Watch out on redhat, I ran into an issue with the sslwrap library on any miner using ssl/tls. If you run into this ensure python-gevent is installed. We ran into too many issues on rhel and ended up moving to a different supported platform.

chirss · ‎07-05-2018

Hi, I'm considering how to do some of the following, if anyone has advice or links to documentation I'm not finding I would appreciate it: Export the configuration in a way that any local custom miners are also backed up, meaning the restore is a literal one liner command or something along those lines. The export backup is a manual click and won't work for something automated. Integration with active directory, ldap, or something else for authentication based on group membership to the web ui. High availability. Other than auto focus I can't seem to find a way to handle this. If a mm instance is down other than some sort of vip/round robin dns solution, or something else does anyone have a suggestion here? Thanks!

chirss · ‎11-10-2017

Ya. But firehol has a ton of lists. It might be worth contacting them directly to see if they have a preferred way to grab the data than from github.

chirss · ‎10-09-2017

Do you have a logstash sending the indicator additions and removals over to your siem?

chirss · ‎10-06-2017

This one is fairly straight forward. Based on an ipv4 miner: attributes: confidence: 50 direction: inbound share_level: green type: IPv4 ignore_regex: ^# source_name: firehol.blocklist_net_ua url: https://raw.githubusercontent.com/firehol/blocklist-ipsets/master/blocklist_net_ua.ipset user_agent: MineMeld There are a ton of lists just under his blocklist ipsets: https://github.com/firehol/blocklist-ipsets I'm not sure if this is the right way to go about processing the data long term, but in the short term it looks handy.

chirss · ‎10-06-2017

There's ebl, edl, persistentdag, nonpersistentdag, etc. Limits on the number of feeds. Does anyone have a concise summary of some kind which makes picking which one of these, or combination of these, is the best route to go for integrating with panos?

chirss · ‎10-05-2017

Ya exactly. The problem I'm finding is a lot of the miners likely have duplicate entries of some kind. So I'm sending them all to the same processor for similar types of feeds (phishing type miners to phishing processor for example). However I have to validate everything coming in before being able to trust it, i.e. verify before trusting. The scenario you're talking about would be very beneficial in at least this scenario.

chirss · ‎10-05-2017

Also maybe a miner isn't the right thing so much as a processor. If an ioc hits the processor it then queries the api (within limits of the api). There are an awful lot of reputation type things which could possibly be used in a similar manner.

chirss · ‎10-05-2017

Ya that's what I want as well. If I can compare url information from a feed with what safebrowsing thinks of it and then come up with a ranking to be used by different outputs that would be ideal. Is this what you are thinking? I haven't played enough with miner creation to build anything like this out.

chirss · ‎10-04-2017

Can you get the error log and paste it here?

chirss · ‎10-03-2017

Google has a threat list api, has anyone created a miner for it? https://developers.google.com/safe-browsing/v4/lists

chirss · ‎10-02-2017

Thanks. I'm able to clone a miner and set it to sha256 (or sha1) and it pulls 315 indicators. What I'm trying to figure out is how it relates to subscriptions in otx, if anyone knows. Thanks for confirming, I was able to at least pull data once I made a miner for them (noticed I wasn't looking for hashes in the miner itself)

chirss · ‎09-08-2017

How could I go about changing this to mine sha256 indicators out of otx?

chirss · ‎09-08-2017

Ah it's a paid subscription of some kind and I just have a freebie account. Makes sense.

chirss · ‎09-08-2017

I guess I need to figure out why it won't let me get into the intelligence or hunting sections of the vt website. Thanks for pointing me in the right direction.

chirss · ‎09-08-2017

I'm running into an issue with the virus total miner. Once the API key is set it continues to throw this error: 2017-09-08T14:24:58 (2986)basepoller._actor_loop INFO: virustotal_notifications-green - command: 1504880698052 poll 2017-09-08T14:24:58 (2986)basepoller._polling_loop INFO: Polling virustotal_notifications-green 2017-09-08T14:24:58 (2986)connectionpool._new_conn INFO: Starting new HTTPS connection (1): www.virustotal.com 2017-09-08T14:24:58 (2986)basepoller._poll ERROR: Exception in polling loop for virustotal_notifications-green: No JSON object could be decoded Traceback (most recent call last): File "/opt/minemeld/engine/0.9.42/local/lib/python2.7/site-packages/minemeld/ft/basepoller.py", line 721, in _poll performed = self._polling_loop() File "/opt/minemeld/engine/0.9.42/local/lib/python2.7/site-packages/minemeld/ft/basepoller.py", line 571, in _polling_loop iterator = self._build_iterator(now) File "/opt/minemeld/engine/0.9.42/local/lib/python2.7/site-packages/minemeld/ft/vt.py", line 88, in _build_iterator return super(Notifications, self)._build_iterator(now) File "/opt/minemeld/engine/0.9.42/local/lib/python2.7/site-packages/minemeld/ft/json.py", line 135, in _build_iterator result = self.extractor.search(r.json()) File "/opt/minemeld/engine/0.9.42/local/lib/python2.7/site-packages/requests/models.py", line 819, in json return json.loads(self.text, **kwargs) File "/usr/lib/python2.7/json/__init__.py", line 338, in loads return _default_decoder.decode(s) File "/usr/lib/python2.7/json/decoder.py", line 366, in decode obj, end = self.raw_decode(s, idx=_w(s, 0).end()) File "/usr/lib/python2.7/json/decoder.py", line 384, in raw_decode raise ValueError("No JSON object could be decoded") ValueError: No JSON object could be decoded 2017-09-08T14:24:59 (2986)basepoller._polling_loop INFO: Polling virustotal_notifications-green 2017-09-08T14:24:59 (2986)connectionpool._new_conn INFO: Starting new HTTPS connection (1): www.virustotal.com 2017-09-08T14:24:59 (2986)basepoller._poll ERROR: Exception in polling loop for virustotal_notifications-green: No JSON object could be decoded Traceback (most recent call last): File "/opt/minemeld/engine/0.9.42/local/lib/python2.7/site-packages/minemeld/ft/basepoller.py", line 721, in _poll performed = self._polling_loop() File "/opt/minemeld/engine/0.9.42/local/lib/python2.7/site-packages/minemeld/ft/basepoller.py", line 571, in _polling_loop iterator = self._build_iterator(now) File "/opt/minemeld/engine/0.9.42/local/lib/python2.7/site-packages/minemeld/ft/vt.py", line 88, in _build_iterator return super(Notifications, self)._build_iterator(now) File "/opt/minemeld/engine/0.9.42/local/lib/python2.7/site-packages/minemeld/ft/json.py", line 135, in _build_iterator result = self.extractor.search(r.json()) File "/opt/minemeld/engine/0.9.42/local/lib/python2.7/site-packages/requests/models.py", line 819, in json return json.loads(self.text, **kwargs) File "/usr/lib/python2.7/json/__init__.py", line 338, in loads return _default_decoder.decode(s) File "/usr/lib/python2.7/json/decoder.py", line 366, in decode obj, end = self.raw_decode(s, idx=_w(s, 0).end()) File "/usr/lib/python2.7/json/decoder.py", line 384, in raw_decode raise ValueError("No JSON object could be decoded") ValueError: No JSON object could be decoded 2017-09-08T14:25:04 (2986)basepoller._actor_loop INFO: virustotal_notifications-green - command: 1504880698052 age_out It's not liking something it's getting however I'm not seeing anything else in the logs to help figure this out.

chirss · ‎09-07-2017

Oh bah I was looking at the first numbers. Thanks Luigi.

chirss · ‎09-07-2017

What's the best way to update if none of the steps in the forum posts work?

chirss · ‎09-06-2017

So I'm having issues updating minemeld. Here's what I have currently: ||/ Name Version Architecture Description +++-===============================================-============================-============================-=================================================================================================== ii minemeld 0.9.11-1build1 amd64 minemeld VM system files ~$ history | tail 659 sudo apt-get autoremove 660 sudo add-apt-repository -ry ppa:adiscon/v8-stable 661 cd ~ 662 wget -qO - https://minemeld-updates.panw.io/gpg.key | sudo apt-key add - 663 sudo add-apt-repository "deb http://minemeld-updates.panw.io/ubuntu trusty-minemeld main" 664 sudo apt-get update 665 sudo apt-get install -y minemeld 666 dpkg -l minemeld 667 history | head -n 5 668 history | tail ubuntu@vm119is01mm01:~$ sudo /usr/sbin/minemeld-auto-update 2017-09-06 18:46:59,695 INFO:0.9.11 Current status: 2017-09-06 18:46:59,695 INFO:0.9.11 minemeld-engine: current: 0.9.42 latest: 0.9.42 2017-09-06 18:46:59,696 INFO:0.9.11 minemeld-webui: current: 0.9.42 latest: 0.9.42 2017-09-06 18:46:59,696 INFO:0.9.11 minemeld-prototypes: current: 0.9.42 latest: 0.9.42 2017-09-06 18:46:59,979 DEBUG:0.9.11 curl output: 2017-09-06 18:47:00,065 DEBUG:0.9.11 curl output: 2017-09-06 18:47:00,065 DEBUG:0.9.11 gpgv: /usr/bin/gpgv --ignore-time-conflict --keyring /etc/apt/trusted.gpg --keyring /etc/apt/trusted.gpg.d/minemeld.gpg /tmp/mmaupackagesgpgoJJJVz /tmp/mmaupackagesuTXnuA 2017-09-06 18:47:00,070 INFO:0.9.11 gpgv output: gpgv: Signature made Tue 05 Sep 2017 02:26:58 PM UTC using RSA key ID 7B630999 gpgv: Good signature from "Palo Alto Networks, MineMeld Team <minemeld@paloaltonetworks.com>" gpgv: aka "[invalid image]" 2017-09-06 18:47:00,074 INFO:0.9.11 No package to deploy, exit I'm fairly certain I have something amiss here I am not entirely sure what it is. Any ideas?

chirss · ‎08-07-2017

That page isn't resolving Luigi. 🙂

chirss · ‎06-21-2017

For your example webex you could make a simple whitelist miner for domains and for ip addresses based on the data here: https://cisco-support.webex.com/guest/articles/en_US/Usability_FAQs/WBX264/myr=false

chirss · ‎06-21-2017

Sent it over, let me know if you see anything odd.

chirss · ‎06-19-2017

Thanks this seems to work. I have it pulling some data. Not any feeds I subscribe to though.

chirss · ‎06-19-2017

I have an alienvault otx miner set up. I would like to subscribe to a lot of the pulses published there, however it's as though the feed isn't presenting or something along those lines. I've had it running for a decent amount of time and the amount of indicators is fairly small. Other than subscribing in the otx web interface is there anything else you need to do in order to get the indicators to start coming through?

chirss · ‎06-02-2017

LDAP auth (primarily msft) would be ideal along with SAML. I'd like to be able to restrict access to a group or groups within LDAP which SAML doesn't provide.

Date Registered	‎09-14-2016 10:48 AM
Date Last Visited	‎12-12-2018 02:53 PM
Total Messages Posted	67
Total Likes Received	6

Online Status	Offline
Date Last Visited	‎12-12-2018 02:53 PM

Enterprise

Prisma

Cortex

About chirss