Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Get Started
- News & Events
- Collaboration
- Education Services
- Technologies
- Next-Generation Firewall
- GlobalProtect
- Threat Prevention Services
- Endpoint Protection
- SSL Decryption
- 5G
- IoT Security
- Prisma SD-WAN
Network Security
- Prisma Access
- Prisma SaaS
- Prisma Cloud
- CN-Series
- VM-Series:
- Alibaba
- AWS
- GCP
- Azure
Cloud Security
- Cortex XDR
- Cortex XSOAR
- Cortex Data Lake
Security Operations
- Resources
- COVID-19 Response Center
- LIVEcommunity
- ›
- About ArildSaether
About ArildSaether
Announcements
Changes to the LIVEcommunity experience are coming soon... Here's what you need to know.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
04-15-2020
10Posts
0Likes
1Solution
Apr 15, 2020Last Visited
User
Activity
User
Profile
Latest posts by ArildSaether
| Subject | Views | Posted |
|---|---|---|
| 1212 | 04-07-2020 06:53 AM | |
| 7385 | 06-29-2017 02:42 AM | |
| 7393 | 06-29-2017 12:02 AM | |
| 4117 | 06-29-2017 12:00 AM | |
| 4133 | 06-27-2017 05:11 AM |
Posts I Liked
| Subject | Likes | Author | Latest Post |
|---|---|---|---|
| 1 |
User Badges
Public Statistics
| Date Registered | 04-05-2017 02:07 AM |
| Date Last Visited | 04-15-2020 01:56 AM |
| Total Messages Posted | 12 |
04-07-2020
06:53 AM
Hi, I have been trying to use Ansible to retrieve the arp table from a PA FW. Logging in with ssh, it's a quick and easy "show arp all", but using Ansible, I am struggling. I was sure panos_op would work with "show arp all", but it doesn't. I also looked at panos_type_cmd, but that seems not to be the way either. More config than state. Finally, I looked through several facts modules, with no luck. Any pointers?
... View more
06-29-2017
02:42 AM
Thank you.
That worked perfectly. But maybe that should be included in the documentation for CentOS7/RHEL7 and Minemeld? It's hard to see how to make it work with a proxy without that nugget of insight.
I also needed to change the sudoers file in order to install behind a proxy, adding:
Defaults env_keep += "http_proxy"
Defaults env_keep += "https_proxy"
in order for the environment variables to be kept when ansible does something with elevated privileges.
... View more
06-29-2017
12:02 AM
As far as I can figure out, this is related to Minemeld on CentOS 7 only. Works great on Ubuntu.
Would like to hear if anyone has been able to make it work with CentOS and proxies.
... View more
06-29-2017
12:00 AM
This works great with Ubuntu 14.04. Both when installing using the apt-packages or when using git/ansible. No problem at all.
However, there is no way I am able to make it work with CentOS 7 (ansible install). The proxy settings simply do not seem to get picked up.
... View more
06-27-2017
05:11 AM
I now firmly believe this is related to the proxies. When monitoring traffic using tcpdump, we see that Minemeld never sends it to the system-wide proxies, it just tries to reach the Internet directly. Should it not use the environment settings?
The error message seems to be related to the PA firewalls responding, not the expected web sites.
... View more
06-26-2017
06:17 AM
Hi,
Not much to go by, is it? Maybe you could share some more info? I am assuming you have checked the systemctl status and found the "FATAL" status. What does the syslog say?
... View more
06-26-2017
03:42 AM
Hi,
There doesn't seem to be anything official on how to set up Minemeld to use corporate proxies. When trying to contact external URLs from within minemeld, it does not respect the proxy settings in either /etc/profile or /etc/default. It tries to access the Internet directly, and fails miserably, of course.
How do I make Minemeld hit the proxies?
BTW, I am using CentOS for this installation, but I don't think that should matter much.
... View more
06-20-2017
06:41 AM
Hi,
Standard. I was just setting them up to make sure I understood things properly. Miner, aggregator and output nodes. Looks good in the graphical visualization, but this error message isn't exactly ideal. If it hadn't been for the fact that curl works, I would have suspected our proxies (struggled a bit with them when installing Minemeld).
... View more
06-19-2017
10:53 PM
Hi,
Not the only one. Some O365 ones work (I got that config as a hand-me-down, and they seem slightly different), but when adding a few IP-based ones, I get this error message for this miner, and for another one. And that one also works from curl.
This is the error message from the other miner:
2017-06-20T07:51:39 (26737)basepoller._polling_loop INFO: Polling AnotherIPsource 2017-06-20T07:51:39 (26737)connectionpool._new_conn INFO: Starting new HTTPS connection (1): feodotracker.abuse.ch 2017-06-20T07:51:39 (26737)basepoller._poll ERROR: Exception in polling loop for AnotherIPsource: __str__ returned non-string (type SysCallError) Traceback (most recent call last): File "/opt/minemeld/engine/core/minemeld/ft/basepoller.py", line 720, in _poll performed = self._polling_loop() File "/opt/minemeld/engine/core/minemeld/ft/basepoller.py", line 570, in _polling_loop iterator = self._build_iterator(now) File "/opt/minemeld/engine/core/minemeld/ft/http.py", line 191, in _build_iterator **rkwargs File "/opt/minemeld/engine/current/lib/python2.7/site-packages/requests/api.py", line 69, in get return request('get', url, params=params, **kwargs) File "/opt/minemeld/engine/current/lib/python2.7/site-packages/requests/api.py", line 50, in request response = session.request(method=method, url=url, **kwargs) File "/opt/minemeld/engine/current/lib/python2.7/site-packages/requests/sessions.py", line 465, in request resp = self.send(prep, **send_kwargs) File "/opt/minemeld/engine/current/lib/python2.7/site-packages/requests/sessions.py", line 573, in send r = adapter.send(request, **kwargs) File "/opt/minemeld/engine/current/lib/python2.7/site-packages/requests/adapters.py", line 370, in send timeout=timeout File "/opt/minemeld/engine/current/lib/python2.7/site-packages/requests/packages/urllib3/connectionpool.py", line 544, in urlopen body=body, headers=headers) File "/opt/minemeld/engine/current/lib/python2.7/site-packages/requests/packages/urllib3/connectionpool.py", line 344, in _make_request self._raise_timeout(err=e, url=url, timeout_value=conn.timeout) File "/opt/minemeld/engine/current/lib/python2.7/site-packages/requests/packages/urllib3/connectionpool.py", line 314, in _raise_timeout if 'timed out' in str(err) or 'did not complete (read)' in str(err): # Python 2.6 TypeError: __str__ returned non-string (type SysCallError) 2017-06-20T07:51:41 (26737)basepoller._actor_loop INFO: AnotherIPsource - command: 1497937894247 sudden_death 2017-06-20T07:51:41 (26737)basepoller._actor_loop INFO: AnotherIPsource - command: 1497937894247 age_out 2017-06-20T07:51:41 (26737)table._query_by_index INFO: Deleted in scan of _age_out: 0 2017-06-20T07:51:41 (26737)basepoller._actor_loop INFO: AnotherIPsource - command: 1497937894247 gc 2017-06-20T07:51:41 (26737)table._query_by_index INFO: Deleted in scan of _withdrawn: 0
... View more
06-19-2017
07:53 AM
Hi,
I am having problems running miners in my network. We use a proxy, so that might be an issue, but the HTTP_PROXY and HTTPS_PROXY values are set correctly, and curl/wget work fine. But I am unsure how to check what Minemeld is doing.
This is what I find in the error log when trying to manually trigger "IPNode4" to retrieve its indicators:
2017-06-19T16:35:04 (26737)basepoller.hup INFO: IPNode4 - hup received, force polling 2017-06-19T16:35:04 (26737)basepoller._huppable_wait INFO: hup is clear: False 2017-06-19T16:35:04 (26737)basepoller._actor_loop INFO: IPNode4 - command: 1497882904343 poll 2017-06-19T16:35:04 (26737)basepoller._polling_loop INFO: Polling IPNode4 2017-06-19T16:35:04 (26737)connectionpool._new_conn INFO: Starting new HTTPS connection (1): lists.blocklist.de 2017-06-19T16:35:09 (26737)basepoller._poll ERROR: Exception in polling loop for IPNode4: __str__ returned non-string (type SysCallError) Traceback (most recent call last): File "/opt/minemeld/engine/core/minemeld/ft/basepoller.py", line 720, in _poll performed = self._polling_loop() File "/opt/minemeld/engine/core/minemeld/ft/basepoller.py", line 570, in _polling_loop iterator = self._build_iterator(now) File "/opt/minemeld/engine/core/minemeld/ft/http.py", line 191, in _build_iterator **rkwargs File "/opt/minemeld/engine/current/lib/python2.7/site-packages/requests/api.py", line 69, in get return request('get', url, params=params, **kwargs) File "/opt/minemeld/engine/current/lib/python2.7/site-packages/requests/api.py", line 50, in request response = session.request(method=method, url=url, **kwargs) File "/opt/minemeld/engine/current/lib/python2.7/site-packages/requests/sessions.py", line 465, in request resp = self.send(prep, **send_kwargs) File "/opt/minemeld/engine/current/lib/python2.7/site-packages/requests/sessions.py", line 573, in send r = adapter.send(request, **kwargs) File "/opt/minemeld/engine/current/lib/python2.7/site-packages/requests/adapters.py", line 370, in send timeout=timeout File "/opt/minemeld/engine/current/lib/python2.7/site-packages/requests/packages/urllib3/connectionpool.py", line 544, in urlopen body=body, headers=headers) File "/opt/minemeld/engine/current/lib/python2.7/site-packages/requests/packages/urllib3/connectionpool.py", line 344, in _make_request self._raise_timeout(err=e, url=url, timeout_value=conn.timeout) File "/opt/minemeld/engine/current/lib/python2.7/site-packages/requests/packages/urllib3/connectionpool.py", line 314, in _raise_timeout if 'timed out' in str(err) or 'did not complete (read)' in str(err): # Python 2.6 TypeError: __str__ returned non-string (type SysCallError)
However, when trying the url specified for " lists.blocklist.de" from the command line, everything works fine...
Any ideas?
... View more
Latest Blogs
Latest Posts
Copyright 2007 - 2021 - Palo Alto Networks
