About xhoms

Hi @david.sherrill ,   yes. I'm afraid you need a new node (miner) per FQDN (details in the Google DNS API specification at https://developers.google.com/speed/public-dns/docs/dns-over-https) If you're planning to configure 10's or more of them then you might want to take a look to the FQDN-Service project (AWS Serverless Component you can deploy at almost no montly cost and that can resolve 100's of FQDN's at once)   Xavi ... View more

Hi @MichaelPDean,   this is a tricky one.   the right expression is already in your list (us-east-1.all_ips[].{indicator:@})  but it must be double escaped .   First, us-east-1 is not a valid python espression so you must quote it to become "us-east-1" . But you can't provide extractor: "us-east-1".all_ips[].{indicator:@} to the prototype because the YAML loader will fail parsing it due to the first double quote describing the value to be a string scalar and the dot character after the second double quote being considered as an invalid sequence.   So you must escape again for the YAML loader to consider the whole line a string scalar. The right value is then:   extractor: '"us-east-1".all_ips[].{indicator:@}'     ... View more

Hi @Hugh.Kelley,   can't comment on dns.google.com or dns-api.org but would like to provide some comments on https://github.com/PaloAltoNetworks/fqdn-service It is a "serverless implementation" (no VM needed). It is likely to cost you 0$ a month unless you share it with a large community of users It can resolve many FQDN's at once which means that a single miner is needed It can store a history of responses Take into account, though, that if you're using PANOS then you better create custom L7 apps (SSL Decrypt + matching the HTTP Host Header or SSL Response Certificate in case you're not decryting) instead of matching based on FQDN. FQDN matching is performed at "sample intervals" (i.e. once an hour) and these FQDN entries behind AWS rotate tipically at 1 minute intervals. That means that you will, probably, fail to match many sessions between sample intervals no matter which DNS service you end up using ... View more

Hi @carysoc,   the MineMeld standard library already includes a miner for that (azure.cloudIPs) ... View more

Hi @Josephmitchell,   with the new MineMeld version (0.9.50) new nodes were delivered. You must replace the old configuration with the new one (follow instructions at https://live.paloaltonetworks.com/t5/MineMeld-Articles/How-to-Safely-Enable-access-to-Office-365-using-MineMeld-Updated/ta-p/224148) ... View more

Hi @AntonZakharov,   take a look at the article at https://live.paloaltonetworks.com/t5/MineMeld-Articles/Using-MineMeld-as-an-Incident-Response-Platform/ta-p/174690 where a use case for the LocalDB miner is documented.   The LocalDB miner exposes an API you can use to satisfy your need ... View more

Hi @doliver1,   your extractor/indicator combination produces an array of strings instead of an array of objects (you can verify it at http://jmespath.org/)   [ "3.120.18.145/32", "3.120.73.242/32", "3.120.77.98/32", ... ] You need the extractor to generate an array of objects and tell with the indicator which property in each object inside the extracted array contains the indicator.   Use the extrator "preview_cell_2.ip_ranges[].{indicator:@}" that will produce the following array of objects:   [ { "indicator": "3.120.18.145/32" }, { "indicator": "3.120.73.242/32" }, { "indicator": "3.120.77.98/32" }, ... ] and use as "indicator" as indicator or just remove it as that is its default value. ... View more

Hi @wdoria,   just add the "?v=panosurl" at the end of the output node url to get all these anonying prefixes being removed by MineMeld.   More details in https://live.paloaltonetworks.com/t5/MineMeld-Articles/Parameters-for-the-output-feeds/ta-p/146170 ... View more

Hi @benime,   just attempted to reproduce your experience in my lab unsuccesfully. In my case, the input filter for the Express Route condition works like a charm.   This is my infilter configuration: infilters: - actions: - accept conditions: - __method == 'withdraw' name: accept withdraws - actions: - accept conditions: - o365_expressRoute == true name: accept o365_expressRoute - actions: - drop name: drop all ... View more