About iThreatHunt

Please update minemeld-cef output for supporting hash value (MD5,SHA1,SHA256). ... View more

I need this feature too. Please update minemeld-cef output for supporting hash value (MD5,SHA1,SHA256). ... View more

Can not upgrade to 0.9.50   /opt/minemeld/log# sudo /usr/sbin/minemeld-auto-update 2018-10-17 12:04:28,873 INFO:0.9.11 Current status: 2018-10-17 12:04:28,873 INFO:0.9.11 minemeld-engine: current: 0.9.44 latest: 0.9.44 2018-10-17 12:04:28,874 INFO:0.9.11 minemeld-webui: current: 0.9.44 latest: 0.9.44 2018-10-17 12:04:28,874 INFO:0.9.11 minemeld-prototypes: current: 0.9.44 latest: 0.9.44 2018-10-17 12:04:29,023 DEBUG:0.9.11 curl output: 2018-10-17 12:04:29,113 DEBUG:0.9.11 curl output: 2018-10-17 12:04:29,113 DEBUG:0.9.11 gpgv: /usr/bin/gpgv --ignore-time-conflict --keyring /etc/apt/trusted.gpg --keyring /etc/apt/trusted.gpg.d/minemeld.gpg /tmp/mmaupackagesgpgUlquCA /tmp/mmaupackagesLFlVWK 2018-10-17 12:04:29,123 INFO:0.9.11 gpgv output: gpgv: Signature made Fri 27 Jul 2018 09:20:38 PM ICT using RSA key ID 7B630999 gpgv: Good signature from "Palo Alto Networks, MineMeld Team <minemeld@paloaltonetworks.com>" gpgv: aka "[invalid image]" 2018-10-17 12:04:29,136 INFO:0.9.11 Marking minemeld-engine 0.9.50.post1 for deployment 2018-10-17 12:04:29,136 INFO:0.9.11 Marking minemeld-webui 0.9.50 for deployment 2018-10-17 12:04:29,137 INFO:0.9.11 Marking minemeld-prototypes 0.9.50 for deployment 2018-10-17 12:04:29,137 INFO:0.9.11 Space available on /opt/minemeld device: 8287468KB 2018-10-17 12:04:29,137 INFO:0.9.11 Downloading package minemeld-engine version 0.9.50.post1 from http://minemeld-updates.panw.io/stage2/0_9/minemeld-core-0.9.50.post1-linux-x86_64.tar.gz 2018-10-17 12:04:29,928 DEBUG:0.9.11 curl output: 2018-10-17 12:04:29,928 INFO:0.9.11 Package minemeld-engine version 0.9.50.post1 downloaded in /tmp/minemeld-engineJ6W1bg 2018-10-17 12:04:30,828 INFO:0.9.11 New extensions frigidaire created Setting up virtualenv New python executable in /opt/minemeld/engine/0.9.50.post1/bin/python Installing setuptools, pip, wheel... Complete output from command /opt/minemeld/engine/0.9.50.post1/bin/python - setuptools pip wheel: Looking in links: /tmp/minemeld-engine0AUDIZ/data Collecting setuptools /tmp/minemeld-engine0AUDIZ/data/pip-18.0-py2.py3-none-any.whl/pip/_vendor/urllib3/util/ssl_.py:369: SNIMissingWarning: An HTTPS request has been made, but the SNI (Server Name Indication) extension to TLS is not available on this platform. This may cause the server to present an incorrect TLS certificate, which can cause validation failures. You can upgrade to a newer version of Python to solve this. For more information, see https://urllib3.readthedocs.io/en/latest/advanced-usage.html#ssl-warnings /tmp/minemeld-engine0AUDIZ/data/pip-18.0-py2.py3-none-any.whl/pip/_vendor/urllib3/util/ssl_.py:160: InsecurePlatformWarning: A true SSLContext object is not available. This prevents urllib3 from configuring SSL appropriately and may cause certain SSL connections to fail. You can upgrade to a newer version of Python to solve this. For more information, see https://urllib3.readthedocs.io/en/latest/advanced-usage.html#ssl-warnings /tmp/minemeld-engine0AUDIZ/data/pip-18.0-py2.py3-none-any.whl/pip/_vendor/urllib3/util/ssl_.py:160: InsecurePlatformWarning: A true SSLContext object is not available. This prevents urllib3 from configuring SSL appropriately and may cause certain SSL connections to fail. You can upgrade to a newer version of Python to solve this. For more information, see https://urllib3.readthedocs.io/en/latest/advanced-usage.html#ssl-warnings Retrying (Retry(total=4, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ProtocolError('Connection aborted.', error(104, 'Connection reset by peer'))': /packages/96/06/c8ee69628191285ddddffb277bd5abdf769166e7a14b867c2a172f0175b1/setuptools-40.4.3-py2.py3-none-any.whl /tmp/minemeld-engine0AUDIZ/data/pip-18.0-py2.py3-none-any.whl/pip/_vendor/urllib3/util/ssl_.py:160: InsecurePlatformWarning: A true SSLContext object is not available. This prevents urllib3 from configuring SSL appropriately and may cause certain SSL connections to fail. You can upgrade to a newer version of Python to solve this. For more information, see https://urllib3.readthedocs.io/en/latest/advanced-usage.html#ssl-warnings Retrying (Retry(total=3, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ProtocolError('Connection aborted.', error(104, 'Connection reset by peer'))': /packages/96/06/c8ee69628191285ddddffb277bd5abdf769166e7a14b867c2a172f0175b1/setuptools-40.4.3-py2.py3-none-any.whl /tmp/minemeld-engine0AUDIZ/data/pip-18.0-py2.py3-none-any.whl/pip/_vendor/urllib3/util/ssl_.py:160: InsecurePlatformWarning: A true SSLContext object is not available. This prevents urllib3 from configuring SSL appropriately and may cause certain SSL connections to fail. You can upgrade to a newer version of Python to solve this. For more information, see https://urllib3.readthedocs.io/en/latest/advanced-usage.html#ssl-warnings Retrying (Retry(total=2, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ProtocolError('Connection aborted.', error(104, 'Connection reset by peer'))': /packages/96/06/c8ee69628191285ddddffb277bd5abdf769166e7a14b867c2a172f0175b1/setuptools-40.4.3-py2.py3-none-any.whl /tmp/minemeld-engine0AUDIZ/data/pip-18.0-py2.py3-none-any.whl/pip/_vendor/urllib3/util/ssl_.py:160: InsecurePlatformWarning: A true SSLContext object is not available. This prevents urllib3 from configuring SSL appropriately and may cause certain SSL connections to fail. You can upgrade to a newer version of Python to solve this. For more information, see https://urllib3.readthedocs.io/en/latest/advanced-usage.html#ssl-warnings Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ProtocolError('Connection aborted.', error(104, 'Connection reset by peer'))': /packages/96/06/c8ee69628191285ddddffb277bd5abdf769166e7a14b867c2a172f0175b1/setuptools-40.4.3-py2.py3-none-any.whl /tmp/minemeld-engine0AUDIZ/data/pip-18.0-py2.py3-none-any.whl/pip/_vendor/urllib3/util/ssl_.py:160: InsecurePlatformWarning: A true SSLContext object is not available. This prevents urllib3 from configuring SSL appropriately and may cause certain SSL connections to fail. You can upgrade to a newer version of Python to solve this. For more information, see https://urllib3.readthedocs.io/en/latest/advanced-usage.html#ssl-warnings Retrying (Retry(total=0, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ProtocolError('Connection aborted.', error(104, 'Connection reset by peer'))': /packages/96/06/c8ee69628191285ddddffb277bd5abdf769166e7a14b867c2a172f0175b1/setuptools-40.4.3-py2.py3-none-any.whl /tmp/minemeld-engine0AUDIZ/data/pip-18.0-py2.py3-none-any.whl/pip/_vendor/urllib3/util/ssl_.py:160: InsecurePlatformWarning: A true SSLContext object is not available. This prevents urllib3 from configuring SSL appropriately and may cause certain SSL connections to fail. You can upgrade to a newer version of Python to solve this. For more information, see https://urllib3.readthedocs.io/en/latest/advanced-usage.html#ssl-warnings Could not install packages due to an EnvironmentError: HTTPSConnectionPool(host='files.pythonhosted.org', port=443): Max retries exceeded with url: /packages/96/06/c8ee69628191285ddddffb277bd5abdf769166e7a14b867c2a172f0175b1/setuptools-40.4.3-py2.py3-none-any.whl (Caused by ProtocolError('Connection aborted.', error(104, 'Connection reset by peer'))) ---------------------------------------- ...Installing setuptools, pip, wheel...done. Traceback (most recent call last): File "/tmp/minemeld-engine0AUDIZ/data/virtualenv.py", line 2343, in <module> main() File "/tmp/minemeld-engine0AUDIZ/data/virtualenv.py", line 712, in main symlink=options.symlink) File "/tmp/minemeld-engine0AUDIZ/data/virtualenv.py", line 947, in create_environment download=download, File "/tmp/minemeld-engine0AUDIZ/data/virtualenv.py", line 904, in install_wheel call_subprocess(cmd, show_stdout=False, extra_env=env, stdin=SCRIPT) File "/tmp/minemeld-engine0AUDIZ/data/virtualenv.py", line 796, in call_subprocess % (cmd_desc, proc.returncode)) OSError: Command /opt/minemeld/engine/0.9.50.post1/bin/python - setuptools pip wheel failed with error code 1 2018-10-17 12:04:40,946 ERROR:0.9.11 Exception deploying version 0.9.50.post1 of package minemeld-engine Traceback (most recent call last): File "/usr/sbin/minemeld-auto-update", line 534, in deploy_package targetdir File "/usr/sbin/minemeld-auto-update", line 207, in engine_deployer raise RuntimeError('Error deploying package %s' % pname) RuntimeError: Error deploying package minemeld-engine 2018-10-17 12:04:41,004 INFO:0.9.11 Downloading package minemeld-webui version 0.9.50 from http://minemeld-updates.panw.io/stage2/0_9/minemeld-webui-0.9.50.tar.gz 2018-10-17 12:04:41,382 DEBUG:0.9.11 curl output: 2018-10-17 12:04:41,383 INFO:0.9.11 Package minemeld-webui version 0.9.50 downloaded in /tmp/minemeld-webuiIlwkyb 2018-10-17 12:04:41,590 INFO:0.9.11 Successfully deployed package minemeld-webui version 0.9.50 2018-10-17 12:04:41,602 INFO:0.9.11 Downloading package minemeld-prototypes version 0.9.50 from http://minemeld-updates.panw.io/stage2/0_9/minemeld-prototypes-0.9.50.tar.gz 2018-10-17 12:04:41,707 DEBUG:0.9.11 curl output: 2018-10-17 12:04:41,707 INFO:0.9.11 Package minemeld-prototypes version 0.9.50 downloaded in /tmp/minemeld-prototypesqqkiYG 2018-10-17 12:04:41,800 INFO:0.9.11 Successfully deployed package minemeld-prototypes version 0.9.50 2018-10-17 12:04:41,967 CRITICAL:0.9.11 One of the packages had errors, abort 2018-10-17 12:04:41,968 INFO:0.9.11 Removing stale version 0.9.50.post1 of package minemeld-engine 2018-10-17 12:04:42,200 INFO:0.9.11 Removing stale version 0.9.50 of package minemeld-webui 2018-10-17 12:04:42,330 INFO:0.9.11 Removing stale version 0.9.50 of package minemeld-prototypes ... View more

Hi Guy,   Any update?   I am interested in pulling data from SWIFT too.     ... View more

SSL Warnings urllib3 will issue several different warnings based on the level of certificate verification support. These warning indicate particular situations and can resolved in different ways. InsecureRequestWarning This happens when an request is made to an HTTPS URL without certificate verification enabled. Follow the certificate verification guide to resolve this warning. InsecurePlatformWarning This happens on Python 2 platforms that have an outdated ssl module. These older ssl modules can cause some insecure requests to succeed where they should fail and secure requests to fail where they should succeed. Follow the pyOpenSSL guide to resolve this warning. SNIMissingWarning This happens on Python 2 versions older than 2.7.9. These older versions lack SNI support. This can cause servers to present a certificate that the client thinks is invalid. Follow the pyOpenSSL guide to resolve this warning. ... View more

I use this config for blacklsit ip only   ... View more

@xhoms How do you config on MM & McAfee Product? Could you recommend to me? I 'm staritng to learning about McAfee Threat Intelligence Exchange (TIE) DXL.   Thank you. ... View more

Hi @xhoms   I found a issue because I hardening MM web server to support TLSv1.1/1.2 only but PAN Firewall connect to MM via TLSv1 as default. ... View more

Hi @xhoms   Have you test MineMeld with McAfee DXL (TIE)?   Thank you ... View more

@xhoms  This is good guideline.   Could you capture example for step 5 - 3. Certificate Profile including the CA that issued MineMeld's SSL certificate (for PANOS 8.0) or Step for generate  MineMeld's SSL certificate with CA?   I try to both certificate but it is not working. ... View more

@xhoms   My Palo cannot access to Minemeld. It show URL access error. I think that the certificate may be wrong and No log in access.log (Minemeld) ... View more