Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- LIVEcommunity
- ›
- About benime
About benime
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
User
Activity
User
Profile
Latest posts by benime
| Subject | Views | Posted |
|---|---|---|
| 3878 | 06-10-2019 01:59 PM | |
| 2539 | 10-29-2018 10:43 AM | |
| 5091 | 10-24-2018 10:54 AM | |
| 2572 | 10-24-2018 09:07 AM | |
| 2583 | 10-23-2018 04:30 PM |
My Liked Posts
| Subject | Likes | Posted |
|---|---|---|
| 1 | 06-10-2019 01:59 PM | |
| 1 | 10-03-2018 03:04 PM |
Posts I Liked
| Subject | Likes | Author | Latest Post |
|---|---|---|---|
| 2 |
User Badges
Public Statistics
| Date Registered | 03-27-2018 08:25 AM |
| Date Last Visited | |
| Total Messages Posted | 7 |
| Total Likes Received | 2 |
06-10-2019
01:59 PM
1 Kudo
FR-11251: Panorama High Availability: MFA using SAML (Okta) When using SP-initiated SSO from PAN-OS via Okta and SAML, the SSO profile selection is sync'd between Active/Passive. Thus, you can only log in to one of your devices from an HA pair--e.g. if your SAML auth profile and its associated configuration in Okta redirects to the Active device's ACS URL, then you can only authenticate to the Active device. If you initiate SSO from the the Passive device, it will fail because you are redirected to the Active device's ACS URL and the assertion is for the Passive device.
... View more
10-29-2018
10:43 AM
After turning on verbose logging, I was able to see what was happening when MineMeld retrieved my feed from FS-ISAC. Ultimately, I solved the problem by publishing a feed containing 'observables' and not just indicators.
... View more
10-24-2018
10:54 AM
@hshawn wrote:
Where are you all even getting the feed names and discovery_service URL for the feed? I am looking all over the portal and I don't see anything with TAXII feed information anywhere in there.
the URL mentioned in this thread (analysis.fsisac.com...) does not seem to be a real thing. Anyone have a working FS-ISAC feed into Minemeld? Can you provide some details about how to find the required info for populating the variables here?
TIA
I don't know if you ever solved this, but if you don't have access to analysis.fsisac.com you'll need to request it from FS-ISAC support.
Once you have access, there's a Publish link at the top of the page that allows you to create your own custom feed based on the information you want (URLs, IPs, file hashes, etc.) and other criteria. You'll use the feed name combined with your credentials to access it.
HTH
... View more
10-24-2018
09:07 AM
So, here's the configuration of my TaxiiClient prototype:
age_out:
default: last_seen+30d
sudden_death: false
attributes:
confidence: 100
share_level: green
client_cert_required: true
collection: <user.feed>
discovery_service: https://analysis.fsisac.com/taxii-discovery-service
initial_interval: 30d
source_name: fsisac.<user.feed>
I've tried this with both last_seen+30d and null, as well as varying initial_interval and setting the feed in FS-ISAC to only IP Watchlist and Indicators, just in case it was an issue parsing certain items, but it still retrieves 0 indicators.
... View more
10-23-2018
04:30 PM
I recently created a feed over at FS-ISAC for my organization, and I'm able to connect successfully from within MineMeld, however I am not receiving any indicators.
My initial_interval is set to 30d and when I test using 'taxii-poll' from the shell I'm able to retrieve indicators that way, so I know the feed I'm publishing is working, but MineMeld shows 0 indicators.
Any ideas where to look next? I've checked the engine logs and there are no errors, and the miner has zero logs.
... View more
10-03-2018
03:04 PM
1 Kudo
@xhoms, It's funny because I was using almost the exact same syntax/conditions you were; except I was using single quotes around the 'true' in the o365_expressRoute condition.
Once I removed those it works as expected, now.
Thanks for following up!
... View more
10-01-2018
10:50 AM
I'm trying to filter out unneeded/unnecessary indicators from our O365 feed, but no matter where I apply the filters I am still receiving all of the indicators.
For example, I would like to filter on only indicators available over Express Route, and in the JSON you can see that 'expressRoute' is an available field with a boolean value of either true or false, but trying to add an infilter or outfilter condition for 'o365_expressRoute' doesn't work. I just end up with 0 indicators in my output due to the drop all at the end of my condition statements.
Can someone explain to me why this is? There's even an available prototype that comes with MineMeld for filtering out 3rd Party Integrations from the O365 API feed, and even that doesn't work.
... View more
Latest Blogs
Latest Posts
Copyright 2007 - 2021 - Palo Alto Networks
