About xhoms

xhoms · ‎08-19-2020

Hi @JamesRen , I think you're right. The "/watch" policy is meant to deny non-allowed videos and so its action should be "block"

xhoms · ‎06-16-2020

@efritz , I'd look for API's or logs available in the engine that is spinning up the VM's in order to get the IP addresses from there (instead of trying to get the IP addresses from the FQDN mapped to them). If these logs exists then it should be quite easy to code a script that uses PAN-OS Dynamic Address Group API with them.

xhoms · ‎06-11-2020

Hi @efritz , depending on the amount of subdomains under subdomain.com you can consider using FQDN Objects or a cloud service that generates the list of IP's (the EDL source) out of a large set of FQDN's. Take a look at the serverless implementation of a FQDN Service Feed

xhoms · ‎06-11-2020

@Alexander_Forero , I'm afraid you can't. You should interface directly with WildFire to get other hash values (SHA1, MD5) for that given sample. Have you taken a look to the XSOAR Threat Intel Management? That's a whole new dimension regards threat intel management.

xhoms · ‎05-03-2019

Hi @Michael_D , thanks for letting us know the example was not working anymore. Yahoo discontinued his weather API. Just the example to another provider.

xhoms · ‎02-28-2019

Hi @david.sherrill , yes. I'm afraid you need a new node (miner) per FQDN (details in the Google DNS API specification at https://developers.google.com/speed/public-dns/docs/dns-over-https) If you're planning to configure 10's or more of them then you might want to take a look to the FQDN-Service project (AWS Serverless Component you can deploy at almost no montly cost and that can resolve 100's of FQDN's at once) Xavi

xhoms · ‎02-06-2019

Hi @MichaelPDean, this is a tricky one. the right expression is already in your list (us-east-1.all_ips[].{indicator:@}) but it must be double escaped . First, us-east-1 is not a valid python espression so you must quote it to become "us-east-1" . But you can't provide extractor: "us-east-1".all_ips[].{indicator:@} to the prototype because the YAML loader will fail parsing it due to the first double quote describing the value to be a string scalar and the dot character after the second double quote being considered as an invalid sequence. So you must escape again for the YAML loader to consider the whole line a string scalar. The right value is then: extractor: '"us-east-1".all_ips[].{indicator:@}'

xhoms · ‎01-23-2019

Hi @jcardenosa, current ThreatConnect miner does not extract port information from IPv4 indicators. That means that, to satisfy this use case: a new feature to extract port attributes should be added to the TC Miner and a new output node capable of generating your formatted output would be needed as well

xhoms · ‎12-26-2018

Hi @Hugh.Kelley, can't comment on dns.google.com or dns-api.org but would like to provide some comments on https://github.com/PaloAltoNetworks/fqdn-service It is a "serverless implementation" (no VM needed). It is likely to cost you 0$ a month unless you share it with a large community of users It can resolve many FQDN's at once which means that a single miner is needed It can store a history of responses Take into account, though, that if you're using PANOS then you better create custom L7 apps (SSL Decrypt + matching the HTTP Host Header or SSL Response Certificate in case you're not decryting) instead of matching based on FQDN. FQDN matching is performed at "sample intervals" (i.e. once an hour) and these FQDN entries behind AWS rotate tipically at 1 minute intervals. That means that you will, probably, fail to match many sessions between sample intervals no matter which DNS service you end up using

xhoms · ‎12-20-2018

Hi @svdaddio, could you take a look at the minemeld-web log file to see is there is any significative error message? (/opt/minemeld/log/minemeld-web.log)

xhoms · ‎12-20-2018

Hi @dhenke, is there any "confidence-like" value attached to the indicators you could use as a input filter criteria?

xhoms · ‎12-18-2018

Hi @peter.moscatelli, you might want to take a look to the project https://github.com/PaloAltoNetworks/fqdn-service It can genererate an IPv4/IPv6 feed out of FQDN's hosted in AWS. The generated feed can be consumed directly by the PANOS devices or by a SimpleJSON MineMeld miner

xhoms · ‎12-04-2018

Hi @SOCGC, let me know how could I help you.

xhoms · ‎12-04-2018

Hi @KengSeng, AF-MM has a different UI and may have a different YAML validator. Try quoting the string ("*.ip_ranges[].{indicator:@}"). It should work with that.

xhoms · ‎11-27-2018

Hi @carysoc, the MineMeld standard library already includes a miner for that (azure.cloudIPs)

xhoms · ‎11-15-2018

Hi @Sec101, miners for the new API were first released with MineMeld 0.9.46. But Microsoft made some changes in the API after that. The current Microsoft API is implemented in MineMeld 0.9.50

xhoms · ‎11-05-2018

Hi @Josephmitchell, with the new MineMeld version (0.9.50) new nodes were delivered. You must replace the old configuration with the new one (follow instructions at https://live.paloaltonetworks.com/t5/MineMeld-Articles/How-to-Safely-Enable-access-to-Office-365-using-MineMeld-Updated/ta-p/224148)

xhoms · ‎11-05-2018

Hi @AlexanderAstardzhiev, current O365_API miner implementation prefixes the attributes 'expressRoute', 'optionalImpact', 'serviceArea', 'tcpPorts', 'udpPorts', 'category' and 'required' with the 'o365_' string. That is the reason. https://github.com/PaloAltoNetworks/minemeld-core/blob/dc261fe35614b87ab554b08a0e2a7962850bb23d/minemeld/ft/o365.py#L276

xhoms · ‎11-05-2018

Hi @AntonZakharov, take a look at the article at https://live.paloaltonetworks.com/t5/MineMeld-Articles/Using-MineMeld-as-an-Incident-Response-Platform/ta-p/174690 where a use case for the LocalDB miner is documented. The LocalDB miner exposes an API you can use to satisfy your need

xhoms · ‎10-29-2018

Hi @austinrappeport, yes. Take a look at this script contributed by Luigi Mori for such a purpose.

xhoms · ‎10-26-2018

Hi @TommiK, you're right. The backend file name will change overnight without previous notification. Time ago I build the MS Article for MineMeld that can dynamically extract references in MS Articles and download them. It currently wraps the CSVFT class so only works for CSV formated downloads. Someone could be interested on contributing to the extension to create a SimpleJSON wrapper as well.

xhoms · ‎10-26-2018

Hi @Sistemas_SanLucar, can you take a look at the engine error log (/opt/minemeld/minemeld-engine.log) and try locate relevant error entries to share with us?

xhoms · ‎10-26-2018

Hi @otlaP5, the way you configure the OS to make the wget tool use a proxy and the way you configure the Python Runtime to make the requests page (the one MineMeld relies on) use a proxy are different. So getting wget to work in the same hosts wher MineMeld lives doesn't mean everything is configured OK. Said that, your environment configuration seems OK. Next things I'd investigate would be: Does the proxy requiere authentication? Does the proxy enforce SSL Decryption?

xhoms · ‎10-26-2018

Hi @doliver1, your extractor/indicator combination produces an array of strings instead of an array of objects (you can verify it at http://jmespath.org/) [ "3.120.18.145/32", "3.120.73.242/32", "3.120.77.98/32", ... ] You need the extractor to generate an array of objects and tell with the indicator which property in each object inside the extracted array contains the indicator. Use the extrator "preview_cell_2.ip_ranges[].{indicator:@}" that will produce the following array of objects: [ { "indicator": "3.120.18.145/32" }, { "indicator": "3.120.73.242/32" }, { "indicator": "3.120.77.98/32" }, ... ] and use as "indicator" as indicator or just remove it as that is its default value.

xhoms · ‎10-26-2018

Hi @hshawn, It would require a huge effort. Main reason some wheel python packages MineMeld depends on that are not available for the ARM architecture.

xhoms · ‎10-26-2018

Hi @LCMember3226, option A: Use the Ansible Playbook option B: Add Docker support to your RedHat system and deploy the jtschichold/minemed image in DockerHub

xhoms · ‎10-25-2018

Hi @mikealanni, just create a new prototype out of any prototype that already uses the SimpleJSON class (i.e. the aws.AMAZON one)

xhoms · ‎10-07-2018

Hi @wdoria, just add the "?v=panosurl" at the end of the output node url to get all these anonying prefixes being removed by MineMeld. More details in https://live.paloaltonetworks.com/t5/MineMeld-Articles/Parameters-for-the-output-feeds/ta-p/146170

xhoms · ‎10-04-2018

Hi @TommiK, the following SimpleJSON class based prototype is doing the job for me. age_out: default: null interval: 257 sudden_death: true attributes: confidence: 100 share_level: green type: IPv4 extractor: values[].properties.addressPrefixes[].{indicator:@} prefix: azure source_name: azure url: https://download.microsoft.com/download/7/1/D/71D86715-5596-4529-9B13-DA13A5DE5B63/ServiceTags_Public_20181001.json If you want to mine prefixes for specific system services then you'll have to adjust the JMESPath expression to suit your needs.

xhoms · ‎10-03-2018

Hi @benime, just attempted to reproduce your experience in my lab unsuccesfully. In my case, the input filter for the Express Route condition works like a charm. This is my infilter configuration: infilters: - actions: - accept conditions: - __method == 'withdraw' name: accept withdraws - actions: - accept conditions: - o365_expressRoute == true name: accept o365_expressRoute - actions: - drop name: drop all

Date Registered	‎11-15-2012 11:10 PM
Date Last Visited	‎08-21-2020 09:51 AM
Total Messages Posted	287
Total Likes Received	52

Online Status	Offline
Date Last Visited	‎08-21-2020 09:51 AM

Strata

Prisma

Cortex

About xhoms