Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Get Started
- News & Events
- Collaboration
- Education Services
- Technologies
- Next-Generation Firewall
- GlobalProtect
- Threat Prevention Services
- Endpoint Protection
- SSL Decryption
- App-ID
- Content-ID
- User-ID
- 5G
- IoT Security
- Cloud Identity Engine
Network Security
- Prisma Access
- Prisma Cloud
- Prisma SD-WAN
- CN-Series
- VM-Series:
- Alibaba
- AWS
- GCP
- Azure
Cloud Security
- Cortex XDR
- Cortex XSOAR
- Cortex Data Lake
Security Operations
- Resources
- COVID-19 Response Center
About dhenke
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- LIVEcommunity
- About dhenke
Online
3Posts
0Likes
0Solutions
Jun 17, 2021Last Visited
User
Activity
User
Profile
Latest posts by dhenke
| Subject | Views | Posted |
|---|---|---|
| 5918 | 12-20-2018 06:04 AM | |
| 5933 | 12-19-2018 11:46 AM | |
| 1606 | 11-14-2018 12:59 PM |
User Badges
Community Statistics
| Member Since | 08-24-2017 05:59 AM |
| Date Last Visited | 3m ago |
| Posts | 3 |
12-20-2018
06:04 AM
Unfortunately, no.
The predefined miner urlhaus.yml has a url of https://urlhaus.abuse.ch/downloads/text/, which is just a listing of malware URLs with no other values. There is a different url at https://urlhaus.abuse.ch/downloads/csv/ that has several fields (ID, Dateadded, URL, URL status, Threat, Associated tags, and Link to URLhaus entry), but none with a confidence value.
I suppose one could re-write the miner to use the other URL and generate their own level of confidence from the "Dateadded" and "URL status" (excluding the oldest entries that have an "offline" status), but that's a little beyond my current level of proficiency.
... View more
12-19-2018
11:46 AM
I would like to use the urlhaus list as well, but it currently has over 90,000 entries, while the PA-5000 and PA-7000 support a maximum of 50,000 URLs. Is there a smarter way to trim this list other than just blindly dropping the oldest entries using the "?n=50000" parameter?
... View more
11-14-2018
12:59 PM
I'm using a minemeld server to generate an external dynamic list for a PA-5220 runing version 8.1.4. The dynamic URL list exceeds the 50,000 entry limit.
I've seen other posts recommending to use URL parameters to limit the list to the first 50,000 and that the list is sorted by age by default. (see https://live.paloaltonetworks.com/t5/MineMeld-Discussions/Confused-over-EBL-size-limit/td-p/104038)
The URL parameters work fine, but in my experience, the output list is sorted by alpha-numeric/name, not age. The article at https://live.paloaltonetworks.com/t5/MineMeld-Articles/Parameters-for-the-output-feeds/ta-p/146170 under the "Additional parameters" section shows how the default format sorting is by name rather than date.
I'm using the built-in stdlib.feedHCGreen prototype.
Do I need to create a custom prototype that will sort by age rather than name?
... View more
Contact Me
| Online Status |
Online
|
| Date Last Visited |
3m ago
|
Latest Tags
No tags yet
LEGAL NOTICES
Copyright 2007 - 2021 - Palo Alto Networks
