Hello,   Forgive my ignorance here (as i'm no programmer or anything by any means),   but trying to follow that logic in what you put below, i feel thats the opposite of what we want. we want to know which objects are NOT in use, by both panorama and the local firewalls themselves (which is the part of this thats a giant pain).   Thank you! ... View more

That works only if we're deleting from the local firewalls, but we're trying to delete panorama objects and its impossible to tell if they're used locally on the firewalls, unless we go through each of the objects manually on the local devices (which we're trying to avoid).   That was the original thing we attempted, but we were running into SO many objects still used on the local devices, that it just wasn't feasable anymore. ... View more

Hello,   Part of the problem is we still have local policies on our firewalls (we are currently in the process of trying to clean that up, migrating everything into panorama but there ARE still objects used in local policies. ... View more

I apologize for the delay in responding, but i was able to perform the fix you suggested and it did indeed work.   For my own knowledge, what was causing this to not work, just so i don't make the same mistake in the future?   Thank you again! ... View more

I apologize for the late response, i was OOO for a few days. Here is the config:   nodes: Tor-exit-nodes_IPv4_list: inputs: - Tor_engine_IPv4 output: false prototype: stdlib.feedHCGreen office365_O365RemoteAnalyzers: inputs: [] output: true prototype: office365.O365RemoteAnalyzers office365_O365: inputs: [] output: true prototype: office365.O365 O365_URL_list: inputs: - O365_engine_URL output: false prototype: stdlib.feedHCGreen office365_sway: inputs: [] output: true prototype: office365.sway Inbound_IPv4_HC_list: inputs: - Inbound_engine_IPv4 output: false prototype: stdlib.feedHCGreen office365_ipv6aggregator: inputs: - office365_O365 - office365_exchangeOnline - office365_exchangeOnlineProtection - office365_O365ProPlus - office365_O365RemoteAnalyzers - office365_identity - office365_crls - office365_office365Video - office365_officeMobile - office365_officeOnline - office365_officeiPad - office365_oneNote - office365_planner - office365_sharepointOnline - office365_skypeBusinessOnline - office365_sway - office365_yammer output: true prototype: stdlib.aggregatorIPv6Simple office365_O365ProPlus: inputs: [] output: true prototype: office365.O365ProPlus aggregatorIPv4Inbound-1499177669119: inputs: [] output: true prototype: stdlib.aggregatorIPv4Inbound aggregatorIPv4Inbound-1499698016985: inputs: - Tor_engine_IPv4 output: true prototype: stdlib.aggregatorIPv4Inbound Inbound_IPv4_LC: inputs: - Inbound_engine_IPv4 output: false prototype: stdlib.feedLCGreen office365_identity: inputs: [] output: true prototype: office365.identity Inbound_engine_IPv4: inputs: - Blocklist_all - DShield_Blocklist - BruteForceBlocker_List - Tor-exit-nodes - MalwareDomainList_IP - ZeusTracker_BadIPS - OutBound_Bad_SSL_Intelligence output: true prototype: stdlib.aggregatorIPv4Inbound office365_office365Video: inputs: [] output: true prototype: office365.office365Video OutboundFeed_LC: inputs: - OutBound_IPv4_engine output: false prototype: stdlib.feedLCGreen office365_URLaggregator: inputs: - office365_O365 - office365_exchangeOnline - office365_exchangeOnlineProtection - office365_O365ProPlus - office365_O365RemoteAnalyzers - office365_crls - office365_identity - office365_office365Video - office365_officeMobile - office365_officeOnline - office365_officeiPad - office365_oneNote - office365_planner - office365_sharepointOnline - office365_skypeBusinessOnline - office365_yammer - office365_sway output: true prototype: stdlib.aggregatorURL AMAZON-AWS-IPs: inputs: [] output: true prototype: aws.AMAZON office365_officeMobile: inputs: [] output: true prototype: office365.officeMobile O365_login: inputs: [] output: true prototype: office365.O365 AzureCloudIPs: inputs: [] output: true prototype: azure.cloudIPs OutboundFeed_HC: inputs: - OutBound_IPv4_engine output: false prototype: stdlib.feedHCGreen office365_sharepointOnline: inputs: [] output: true prototype: office365.sharepointOnline O365_CRL_list: inputs: [] output: true prototype: office365.crls O365_officeiPad: inputs: [] output: true prototype: office365.officeiPad office365_exchangeOnline: inputs: [] output: true prototype: office365.exchangeOnline Blocklist_all: inputs: [] output: true prototype: blocklist_de.all aggregatorIPv4OutboundAzureIPs: inputs: - AzureCloudIPs output: true prototype: stdlib.aggregatorIPv4Outbound office365_exchangeOnlineProtection: inputs: [] output: true prototype: office365.exchangeOnlineProtection BruteForceBlocker_List: inputs: [] output: true prototype: bruteforceblocker.blist AmazonAWSAggregator: inputs: - AMAZON-AWS-IPs output: true prototype: stdlib.aggregatorIPv4Inbound office365_IPv6s: inputs: - office365_ipv6aggregator output: false prototype: stdlib.feedHCWithValue OutBound_Bad_SSL_Intelligence: inputs: [] output: true prototype: sslabusech.ipblacklist O365_Portal_and_Identity: inputs: [] output: true prototype: office365.O365 office365_ipv4aggregator: inputs: - office365_O365 - office365_exchangeOnline - office365_exchangeOnlineProtection - office365_crls - office365_O365ProPlus - office365_O365RemoteAnalyzers - office365_identity - office365_office365Video - office365_officeMobile - office365_officeOnline - office365_officeiPad - office365_oneNote - office365_planner - office365_sharepointOnline - office365_skypeBusinessOnline - office365_sway - office365_yammer output: true prototype: stdlib.aggregatorIPv4Generic O365_IPv4_list: inputs: - O365_engine_IPv4 output: false prototype: stdlib.feedHCGreen Tor_engine_IPv4: inputs: [] output: true prototype: stdlib.aggregatorIPv4Generic office365_URLs: inputs: - office365_URLaggregator output: false prototype: stdlib.feedHCWithValue office365_oneNote: inputs: [] output: true prototype: office365.oneNote feedHCWithValue-AzureIPs: inputs: - aggregatorIPv4OutboundAzureIPs output: true prototype: stdlib.feedHCWithValue office365_crls: inputs: [] output: true prototype: office365.crls IPv4ArtifactsOutput: inputs: - incomingIPv4Aggregator output: true prototype: autofocus.artifactsOutput WannaCry: inputs: [] output: true prototype: autofocus.samplesMiner incomingIPv4Aggregator: inputs: - spamhaus_DROP - spamhaus_EDROP output: true prototype: stdlib.aggregatorIPv4Generic office365_yammer: inputs: [] output: true prototype: office365.yammer OutBound_IPv4_engine: inputs: - ZeusTracker_BadIPS - MalwareDomainList_IP - OutBound_Bad_SSL_Intelligence - Tor-exit-nodes output: true prototype: stdlib.aggregatorIPv4Outbound O365_engine_IPv4: inputs: - WannaCry output: true prototype: stdlib.aggregatorIPv4Generic office365_IPv4s: inputs: - office365_ipv4aggregator output: false prototype: stdlib.feedHCWithValue O365_engine_URL: inputs: - O365_Portal_and_Identity - O365_login - O365_CRL_list - O365_officeiPad output: true prototype: stdlib.aggregatorURL MalwareDomainList_IP: inputs: [] output: true prototype: malwaredomainlist.ip spamhaus_EDROP: inputs: [] output: true prototype: spamhaus.EDROP Tor-exit-nodes: inputs: [] output: true prototype: tor.exit_addresses DShield_Blocklist: inputs: [] output: true prototype: dshield.block office365_officeiPad: inputs: [] output: true prototype: office365.officeiPad ZeusTracker_BadIPS: inputs: [] output: true prototype: zeustracker.badips office365_planner: inputs: [] output: true prototype: office365.planner spamhaus_DROP: inputs: [] output: true prototype: spamhaus.DROP office365_skypeBusinessOnline: inputs: [] output: true prototype: office365.skypeBusinessOnline AWS-IPs-feedHCGreen: inputs: - AmazonAWSAggregator output: false prototype: stdlib.feedHCGreen office365_officeOnline: inputs: [] output: true prototype: office365.officeOnline CLOUDFRONT-AWS-IPRanges: inputs: [] output: true prototype: aws.CLOUDFRONT Inbound-CloudFront-AWS-IPRanges: inputs: - CLOUDFRONT-AWS-IPRanges output: true prototype: stdlib.aggregatorIPv4Inbound CloudFront-IPs-feedHCGreen: inputs: - Inbound-CloudFront-AWS-IPRanges output: false prototype: stdlib.feedHCGreen BlockIPs-Test: inputs: [] output: true prototype: ETOpen.blockIPs aggregatorIPv4BlockIPs: inputs: - BruteForceBlocker_List - MalwareDomainList_IP output: true prototype: stdlib.aggregatorIPv4Inbound IPv4BlockIPs: inputs: - aggregatorIPv4BlockIPs - DShield_Blocklist output: true prototype: stdlib.aggregatorIPv4Inbound IPv4-BlockIPsOutput: inputs: - aggregatorIPv4BlockIPs output: false prototype: stdlib.taxiiDataFeed IPV4-feedHCGreen: inputs: - IPv4BlockIPs output: false prototype: stdlib.feedHCGreen BadSSLOutBoundIPv4: inputs: - OutBound_Bad_SSL_Intelligence output: true prototype: stdlib.aggregatorIPv4Outbound OutBound-BadSSL-HCGreen: inputs: - BadSSLOutBoundIPv4 output: false prototype: stdlib.feedHCGreen SpamhausProcessor: inputs: - spamhaus_EDROP - spamhaus_DROP output: true prototype: stdlib.aggregatorIPv4Outbound SpamhausOutbound: inputs: - SpamhausProcessor output: false prototype: stdlib.feedHCWithValue ... View more

Hello, I apologize for the lack of details on this, this had just started out as a support case/question.   I had created a new processor and a new output node because i wanted two specific miners for an output into a test firewall rule, but once i linked everything together, it seems that no Indicators are being forwarded, and i'm just curious on why. Any assistance would be greatly appreciated, thank you!   Attached is also as creenshot of what i've done with the Spamhaus feeds. ... View more