This website uses cookies essential to its operation, for analytics, and for personalized content. By continuing to browse this site, you acknowledge the use of cookies.
For details on cookie usage on our site, read our Privacy Policy
For details on cookie usage on our site, read our Privacy Policy
About ArildSaether
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- LIVEcommunity
- About ArildSaether
08-24-2022
13Posts
0Likes
1Solution
Aug 24, 2022Last Visited
User
Activity
User
Profile
Latest posts by ArildSaether
| Subject | Views | Posted |
|---|---|---|
| 1364 | 08-10-2021 02:38 AM | |
| 4052 | 04-07-2020 06:53 AM | |
| 9804 | 06-29-2017 02:42 AM | |
| 9810 | 06-29-2017 12:02 AM | |
| 6792 | 06-29-2017 12:00 AM | |
| 6808 | 06-27-2017 05:11 AM | |
| 14699 | 06-26-2017 06:17 AM | |
| 9881 | 06-26-2017 03:42 AM | |
| 7048 | 06-20-2017 06:41 AM | |
| 7057 | 06-19-2017 10:53 PM |
Posts I Liked
| Subject | Likes | Author | Latest Post |
|---|---|---|---|
| 1 Like |
User Badges
Community Statistics
| Member Since | 04-05-2017 02:07 AM |
| Date Last Visited | 08-24-2022 01:43 PM |
| Posts | 13 |
08-10-2021
02:38 AM
I currently use minemeld to whitelist the list of O365 IP ranges etc, but I have not been able to find a miner for the Oracle Cloud.
Oracle publishes a JSON file with the relevant IPs (https://docs.oracle.com/en-us/iaas/tools/public_ip_ranges.json), so maybe I need to use Minemeld to parse the JSON somehow?
Hoping I'm not the only one trying to use Oracle 🙂
... View more
04-07-2020
06:53 AM
Hi, I have been trying to use Ansible to retrieve the arp table from a PA FW. Logging in with ssh, it's a quick and easy "show arp all", but using Ansible, I am struggling. I was sure panos_op would work with "show arp all", but it doesn't. I also looked at panos_type_cmd, but that seems not to be the way either. More config than state. Finally, I looked through several facts modules, with no luck. Any pointers?
... View more
06-29-2017
02:42 AM
Thank you.
That worked perfectly. But maybe that should be included in the documentation for CentOS7/RHEL7 and Minemeld? It's hard to see how to make it work with a proxy without that nugget of insight.
I also needed to change the sudoers file in order to install behind a proxy, adding:
Defaults env_keep += "http_proxy"
Defaults env_keep += "https_proxy"
in order for the environment variables to be kept when ansible does something with elevated privileges.
... View more
06-29-2017
12:02 AM
As far as I can figure out, this is related to Minemeld on CentOS 7 only. Works great on Ubuntu.
Would like to hear if anyone has been able to make it work with CentOS and proxies.
... View more
06-29-2017
12:00 AM
This works great with Ubuntu 14.04. Both when installing using the apt-packages or when using git/ansible. No problem at all.
However, there is no way I am able to make it work with CentOS 7 (ansible install). The proxy settings simply do not seem to get picked up.
... View more
06-27-2017
05:11 AM
I now firmly believe this is related to the proxies. When monitoring traffic using tcpdump, we see that Minemeld never sends it to the system-wide proxies, it just tries to reach the Internet directly. Should it not use the environment settings?
The error message seems to be related to the PA firewalls responding, not the expected web sites.
... View more
06-26-2017
06:17 AM
Hi,
Not much to go by, is it? Maybe you could share some more info? I am assuming you have checked the systemctl status and found the "FATAL" status. What does the syslog say?
... View more
06-26-2017
03:42 AM
Hi,
There doesn't seem to be anything official on how to set up Minemeld to use corporate proxies. When trying to contact external URLs from within minemeld, it does not respect the proxy settings in either /etc/profile or /etc/default. It tries to access the Internet directly, and fails miserably, of course.
How do I make Minemeld hit the proxies?
BTW, I am using CentOS for this installation, but I don't think that should matter much.
... View more
06-20-2017
06:41 AM
Hi,
Standard. I was just setting them up to make sure I understood things properly. Miner, aggregator and output nodes. Looks good in the graphical visualization, but this error message isn't exactly ideal. If it hadn't been for the fact that curl works, I would have suspected our proxies (struggled a bit with them when installing Minemeld).
... View more
06-19-2017
10:53 PM
Hi,
Not the only one. Some O365 ones work (I got that config as a hand-me-down, and they seem slightly different), but when adding a few IP-based ones, I get this error message for this miner, and for another one. And that one also works from curl.
This is the error message from the other miner:
2017-06-20T07:51:39 (26737)basepoller._polling_loop INFO: Polling AnotherIPsource 2017-06-20T07:51:39 (26737)connectionpool._new_conn INFO: Starting new HTTPS connection (1): feodotracker.abuse.ch 2017-06-20T07:51:39 (26737)basepoller._poll ERROR: Exception in polling loop for AnotherIPsource: __str__ returned non-string (type SysCallError) Traceback (most recent call last): File "/opt/minemeld/engine/core/minemeld/ft/basepoller.py", line 720, in _poll performed = self._polling_loop() File "/opt/minemeld/engine/core/minemeld/ft/basepoller.py", line 570, in _polling_loop iterator = self._build_iterator(now) File "/opt/minemeld/engine/core/minemeld/ft/http.py", line 191, in _build_iterator **rkwargs File "/opt/minemeld/engine/current/lib/python2.7/site-packages/requests/api.py", line 69, in get return request('get', url, params=params, **kwargs) File "/opt/minemeld/engine/current/lib/python2.7/site-packages/requests/api.py", line 50, in request response = session.request(method=method, url=url, **kwargs) File "/opt/minemeld/engine/current/lib/python2.7/site-packages/requests/sessions.py", line 465, in request resp = self.send(prep, **send_kwargs) File "/opt/minemeld/engine/current/lib/python2.7/site-packages/requests/sessions.py", line 573, in send r = adapter.send(request, **kwargs) File "/opt/minemeld/engine/current/lib/python2.7/site-packages/requests/adapters.py", line 370, in send timeout=timeout File "/opt/minemeld/engine/current/lib/python2.7/site-packages/requests/packages/urllib3/connectionpool.py", line 544, in urlopen body=body, headers=headers) File "/opt/minemeld/engine/current/lib/python2.7/site-packages/requests/packages/urllib3/connectionpool.py", line 344, in _make_request self._raise_timeout(err=e, url=url, timeout_value=conn.timeout) File "/opt/minemeld/engine/current/lib/python2.7/site-packages/requests/packages/urllib3/connectionpool.py", line 314, in _raise_timeout if 'timed out' in str(err) or 'did not complete (read)' in str(err): # Python 2.6 TypeError: __str__ returned non-string (type SysCallError) 2017-06-20T07:51:41 (26737)basepoller._actor_loop INFO: AnotherIPsource - command: 1497937894247 sudden_death 2017-06-20T07:51:41 (26737)basepoller._actor_loop INFO: AnotherIPsource - command: 1497937894247 age_out 2017-06-20T07:51:41 (26737)table._query_by_index INFO: Deleted in scan of _age_out: 0 2017-06-20T07:51:41 (26737)basepoller._actor_loop INFO: AnotherIPsource - command: 1497937894247 gc 2017-06-20T07:51:41 (26737)table._query_by_index INFO: Deleted in scan of _withdrawn: 0
... View more
06-19-2017
07:53 AM
Hi,
I am having problems running miners in my network. We use a proxy, so that might be an issue, but the HTTP_PROXY and HTTPS_PROXY values are set correctly, and curl/wget work fine. But I am unsure how to check what Minemeld is doing.
This is what I find in the error log when trying to manually trigger "IPNode4" to retrieve its indicators:
2017-06-19T16:35:04 (26737)basepoller.hup INFO: IPNode4 - hup received, force polling 2017-06-19T16:35:04 (26737)basepoller._huppable_wait INFO: hup is clear: False 2017-06-19T16:35:04 (26737)basepoller._actor_loop INFO: IPNode4 - command: 1497882904343 poll 2017-06-19T16:35:04 (26737)basepoller._polling_loop INFO: Polling IPNode4 2017-06-19T16:35:04 (26737)connectionpool._new_conn INFO: Starting new HTTPS connection (1): lists.blocklist.de 2017-06-19T16:35:09 (26737)basepoller._poll ERROR: Exception in polling loop for IPNode4: __str__ returned non-string (type SysCallError) Traceback (most recent call last): File "/opt/minemeld/engine/core/minemeld/ft/basepoller.py", line 720, in _poll performed = self._polling_loop() File "/opt/minemeld/engine/core/minemeld/ft/basepoller.py", line 570, in _polling_loop iterator = self._build_iterator(now) File "/opt/minemeld/engine/core/minemeld/ft/http.py", line 191, in _build_iterator **rkwargs File "/opt/minemeld/engine/current/lib/python2.7/site-packages/requests/api.py", line 69, in get return request('get', url, params=params, **kwargs) File "/opt/minemeld/engine/current/lib/python2.7/site-packages/requests/api.py", line 50, in request response = session.request(method=method, url=url, **kwargs) File "/opt/minemeld/engine/current/lib/python2.7/site-packages/requests/sessions.py", line 465, in request resp = self.send(prep, **send_kwargs) File "/opt/minemeld/engine/current/lib/python2.7/site-packages/requests/sessions.py", line 573, in send r = adapter.send(request, **kwargs) File "/opt/minemeld/engine/current/lib/python2.7/site-packages/requests/adapters.py", line 370, in send timeout=timeout File "/opt/minemeld/engine/current/lib/python2.7/site-packages/requests/packages/urllib3/connectionpool.py", line 544, in urlopen body=body, headers=headers) File "/opt/minemeld/engine/current/lib/python2.7/site-packages/requests/packages/urllib3/connectionpool.py", line 344, in _make_request self._raise_timeout(err=e, url=url, timeout_value=conn.timeout) File "/opt/minemeld/engine/current/lib/python2.7/site-packages/requests/packages/urllib3/connectionpool.py", line 314, in _raise_timeout if 'timed out' in str(err) or 'did not complete (read)' in str(err): # Python 2.6 TypeError: __str__ returned non-string (type SysCallError)
However, when trying the url specified for " lists.blocklist.de" from the command line, everything works fine...
Any ideas?
... View more
LEGAL NOTICES
Copyright 2007 - 2023 - Palo Alto Networks