Palo Alto Minemeld Deprecated

Deprecated. MineMeld streamlines the aggregation, enforcement and sharing of threat intelligence.

Data Enrichment & Threat Intelligence · Deprecated Content (Deprecated)

Details

IDPalo Alto Minemeld
ProviderOpen Source
CategoryData Enrichment & Threat Intelligence
From Version5.0.0
Docker Imagedemisto/python:2.7.18.20958

README

Use the Palo Alto Networks MineMeld integration to manage your MineMeld miners from within Cortex XSOAR. All commands require the super admin role.

Use Cases

  • Add or remove indicators from a miner.
  • Fetch miners, IP addresses, files, domains, and URLs.
  • Get a list of all your miners.

NOTE: Indicators on an allow list get a DBot score of 1. Indicators on a block list get a DBot score of 3.

Supported Miner Prototypes

  • localDB
  • listURLGeneric
  • listIPv4Generic
  • listDomainGeneric
  • listIPv6Generic

Configure Palo Alto Networks MineMeld on Cortex XSOAR:

  1. Navigate to Settings > Integrations > Servers & Services.
  2. Search for Palo Alto Networks MineMeld.
  3. Click Add instance to create and configure a new integration instance.
    • Name: A textual name for the integration instance.
    • Mine
    • meld URL : The URL of your MineMeld environment.
    • Username & Password : Your credentials in the MineMeld environment.
    • Block list names : Comma separated list of miners, to be added to the Cortex XSOAR block list.
    • Allow list names: CSV list of miners to add to the Cortex XSOAR allow list.
    • Use system proxy settings
  4. Click Test to validate the URLs and connection.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details. All commands require the super admin role.

  1. Add an indicator to a miner: minemeld-add-to-miner
  2. Remove an indicator from a miner: minemeld-remove-from-miner
  3. Get miner details: minemeld-retrieve miner
  4. Get an indicator from a miner: minemeld-get-indicator-from-miner
  5. Get IP address indicator: ip
  6. Get file indicator: file
  7. Get domain indicator: domain
  8. Get URL indicator: url
  9. Get a list of all the miners: minemeld-get-all-miners-names

 

1. Add an indicator to a miner


Adds a specified indicator to a specified miner. Do not add a single indicator to multiple miners.

Base Command

minemeld-add-to-miner

Input
Argument Name Description More Information
miner Miner name To find the miner name, search for List of Supported Nodes on your MineMeld environment.
indicator Indicator to add to miner

Any type of indicator.

Examples of valid indicators: 

  • IP address
  • File hash
  • Domain
  • URL
  • And more
comment Textual description or comment for the indicator -

 

Context output

There is no context output for this command.

Command example

!minemeld-add-to-miner miner=Supicious indicator=7.7.7.7

War Room Output

2. Remove an indicator from a miner


Removes a specified indicator from a specified miner.

Base Command

minemeld-remove-from-miner

Input
Argument Name Description More Information
miner Miner name To find the miner name, search for List of Supported Nodes on your MineMeld environment.
indicator The indicator to remove

Any type of indicator.

Examples of valid indicators: 

  • IP address
  • File hash
  • Domain
  • URL
  • And more

 

Context output

There is no context output for this command.

Command example

!minemeld-remove-from-miner miner=Suspicious indicator=7.7.7.7

War Room Output

 

3. Get miner details


Retrieves information about a specified miner.

Base Code

minemeld-retrieve-miner

Input
Argument Name Description More Information
miner Miner name To select all miners type miner=all.

 

Context Output
Path Description
MineMeld.Miner Entire miner object
MineMeld.Miner.name Miner name
MineMeld.Miner.class Miner class
MineMeld.Indicators Entire indicator object
MineMeld.Indicators.miner Miner of indicator
MineMeld.Indicators.type Indicator type
MineMeld.Indicators.indicator Indicator value
MineMeld.Indicators.comment Indicator comment

 

Command Example

!minemeld-retrieve-miner miner=Suspicious

War Room Output

 

4. Get an indicator within a miner


Retrieves information about a specified indicator associated with a specified miner.

Base Command

minemeld-get-indicator-from-miner

Input
Argument Name Description
miner Miner name
indicator

Any type of indicator.

Examples of valid indicators: 

  • IP address
  • File hash
  • Domain
  • URL
  • And more

 

Context Output
Path Description
MineMeld.Miner Entire miner object
MineMeld.Miner.name Miner name
MineMeld.Indicators Entire indicator object
MineMeld.Indicators.miner Miner of the indicator
MineMeld.Indicators.type Indicator type
MineMeld.Indicators.indicator Indicator value
MineMeld.Indicators.comment Indicator comment

 

Command Example

!minemeld-get-indicator-from-miner miner=Suspicious indicator=7.7.7.7

War Room Output

5. Get IP address indicator


Retrieves all occurrences of the specified IP address, including the context in which it is found.

For this command to succeed, the miner (associated with the IP address indicator) has to be on a Cortex XSOAR block list or allow list.

Base Command

ip

Input
Argument Name Description
ip IP address

 

Context Output
Path Description
DBotScore.Indicator The Indicator
DBotScore.Type The Indicator type
DBotScore.Vendor The DBot score vendor
DBotScore.Score The DBot score
IP.Malicious.Vendor For malicious IP addresses, the vendor defined the IP address as malicious
IP.Malicious.Description For malicious IP addresses, the reason why the vendor defined the IP address as malicious
IP.Address IP address
IP.MineMeld.Indicators Entire indicator object
IP.MineMeld.Indicators.indicator Indicator value
IP.MineMeld.Indicators.miner Miner of the indicator
IP.MineMeld.Indicators.type Indicator type
IP.MineMeld.Indicators.comment Indicator comment
MineMeld.Indicators Entire indicator object
MineMeld.Indicators.indicator Indicator value
MineMeld.Indicators.miner Miner of the indicator
MineMeld.Indicators.type Indicator type
MineMeld.Indicators.comment Indicator comment
MineMeld.Miner Entire miner object
MineMeld.Miner.name Miner name

 

Command Example

!ip ip=7.7.7.7 using-brand="Palo Alto Minemeld"

War Room Output

 

6. Get file indicator


Retrieves all occurrences of the specified file, including the context in which it is found.

For this command to succeed, the miner (associated with the file indicator) has to be on a Cortex XSOAR block list or allow list.

Base Command

file

Input
Argument Name Description
file Any type of file hash

 

Context Output
Path Description
DBotScore.Indicator The Indicator
DBotScore.Type The Indicator type
DBotScore.Vendor The DBot score vendor
DBotScore.Score The DBot score
File.Malicious.Vendor For malicious files, the vendor that defined the file as malicious
File.Malicious.Description For malicious files, the reason why the vendor defined the file as malicious
File.MineMeld.Indicators Entire indicator object
File.MineMeld.Indicators.indicator Indicator value
File.MineMeld.Indicators.miner Miner of the indicator.
File.MineMeld.Indicators.type Indicator type
File.MineMeld.Indicators.comment Indicator comment
MineMeld.Indicators Entire indicator object
MineMeld.Indicators.indicator Indicator value
MineMeld.Indicators.miner Miner of the indicator
MineMeld.Indicators.type Indicator type
MineMeld.Indicators.comment Indicator comment
MineMeld.Miner Entire miner object
MineMeld.Miner.name Miner name
File.MD5 MD5 hash of the file
File.SHA1 SHA-1 hash of the file
File.SHA256 SHA-256 hash of the file

 

Command example

!file file=9acb44549b41563697bb490144ec6258 using-brand="Palo Alto Minemeld"

War Room Output

 

7. Get domain indicator


Retrieves all occurrences of the specified domain, including the context in which it is found.

For this command to succeed, the miner (associated with the domain indicator) has to be on a Cortex XSOAR block list or allow list.

Base Command

domain

Input
Argument Name Description
domain Domain

 

Context Output
Path Description
DBotScore.Indicator The Indicator
DBotScore.Type The Indicator type
DBotScore.Vendor The DBot score vendor
DBotScore.Score The DBot score
Domain.Malicious.Vendor For malicious domains, the vendor that defined the domain as malicious
Domain.Malicious.Description For malicious domains, the reason that the vendor defined the domain as malicious
Domain.Name Domain name (value)
Domain.MineMeld.Indicators Entire indicator object
Domain.MineMeld.Indicators.indicator Indicator value
Domain.MineMeld.Indicators.miner Indicator miner
Domain.MineMeld.Indicators.type Indicator type
Domain.MineMeld.Indicators.comment Indicator comment
MineMeld.Indicators Entire indicator object
MineMeld.Indicators.indicator Indicator value
MineMeld.Indicators.miner Miner of the indicator
MineMeld.Indicators.type Indicator type
MineMeld.Indicators.comment Indicator comment
MineMeld.Miner Entire miner object
MineMeld.Miner.name Miner name

 

Command example

!domain domain=moogle.com using-brand="Palo Alto Minemeld"

War Room Output

 

8. Get URL indicator


Retrieves all occurrences of the specified URL, including the context in which it is found.

For this command to succeed, the miner (associated with the URL indicator) has to be on a Cortex XSOAR block list or allow list.

Base Command

url

Input
Argument Name Description
url URL to retrieve instances for

 

Context Output
Path Description
DBotScore.Indicator The Indicator
DBotScore.Type The Indicator type
DBotScore.Vendor The DBot score vendor
DBotScore.Score The DBot score
URL.Malicious.Vendor For malicious URLs, the vendor that defined the URL as malicious
URL.Malicious.Description For malicious URLs, the reason that the vendor defined the URL as malicious
URL.Data URL data (value)
URL.MineMeld.Indicators Entire indicator object
URL.MineMeld.Indicators.indicator Indicator value
URL.MineMeld.Indicators.miner Miner of the indicator
URL.MineMeld.Indicators.type Indicator type
URL.MineMeld.Indicators.comment Indicator comment
MineMeld.Indicators Entire indicator object
MineMeld.Indicators.indicator Indicator value
MineMeld.Indicators.miner Miner of the Indicator
MineMeld.Indicators.type Indicator type
MineMeld.Indicators.comment Indicator comment
MineMeld.Miner Entire miner object
MineMeld.Miner.name Miner name

 

Command example

!url url=voogle.com/malicious.exe using-brand="Palo Alto Minemeld"

War Room Output

 

9. Get a list of all the miners


Retrieves the names of all the miners, the class of each miner, and how many indicators are associated with each miner.

Base Command

minemeld-get-all-miners-names

Input

There is no input for this command.

Context Output
Path Description
MineMeld.Miner Entire miner object
MineMeld.Miner.name Miner name
MineMeld.Miner.class Miner class
MineMeld.Miner.indicators Number of miner indicators

 

Command example

!minemeld-get-all-miners-names

War Room Output
 

Configuration parameters

  • url — MineMeld url e.g.(https://192.0.0.1/) (required)
  • credentials — Username (required)
  • blacklist — Block list names e.g.(BlackListIPv4, BlackListURL,Malicious)
  • stateless — Stateless
  • whitelist — Whitelist names e.g.(wlWhiteListIPv4,wlWhiteListDomain,Unmalicious)
  • proxy — Use system proxy settings

Commands (9)

  • domain

    Searches for a specified domain on lists.

  • file

    Search for file on lists

  • ip

    Searches for IP addresses on miners.

  • minemeld-add-to-miner

    Add an indicator to a miner.

  • minemeld-get-all-miners-names

    Returns all miner names (with supported classes of custom indicators lists).

  • minemeld-get-indicator-from-miner

    Gets indicators from a miner's list.

  • minemeld-remove-from-miner

    Removes an indicator from a miner.

  • minemeld-retrieve-miner

    Gets the indicators list for a miner.

  • url

    Searches for the specified URL on lists.

category: Data Enrichment & Threat Intelligence
provider: Open Source
commonfields:
  id: Palo Alto Minemeld
  version: -1
configuration:
- display: MineMeld url e.g.(https://192.0.0.1/)
  name: url
  required: true
  type: 0
- display: Username
  name: credentials
  required: true
  type: 9
- display: Block list names e.g.(BlackListIPv4, BlackListURL,Malicious)
  name: blacklist
  type: 0
  required: false
- additionalinfo: When set to "True", only updates indicators that are added or removed. When set to "False", when adding or removing an indicator, the update time for all indicators will be changed.
  defaultvalue: 'False'
  display: Stateless
  name: stateless
  options:
  - 'True'
  - 'False'
  type: 15
  required: false
- display: Whitelist names e.g.(wlWhiteListIPv4,wlWhiteListDomain,Unmalicious)
  name: whitelist
  type: 0
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
description: Deprecated. MineMeld streamlines the aggregation, enforcement and sharing of threat intelligence.
deprecated: true
display: Palo Alto Networks MineMeld (Deprecated)
name: Palo Alto Minemeld
script:
  commands:
  - arguments:
    - description: Miner name - you can get it under Nodes page on MineMeld UI (nodes of type "miner").
      name: miner
      required: true
    - description: The indicator's value to add. Support list \ comma-separated values.
      isArray: true
      name: indicator
      required: true
    - description: The type of the indicator to add to the miner.
      name: type
    - description: Comment for the indicator.
      name: comment
    - auto: PREDEFINED
      description: When set to "True", only updates indicators that are added or removed. When set to "False", when adding or removing an indicator, the update time for all indicators will be changed.
      name: stateless
      predefined:
      - 'True'
      - 'False'
    description: Add an indicator to a miner.
    name: minemeld-add-to-miner
  - arguments:
    - description: Miner name - you can get it under Nodes page on MineMeld UI (nodes of type "miner").
      name: miner
      required: true
    - description: The value of the indicator to remove.
      name: indicator
      required: true
    - description: The type of the indicator to remove from the miner.
      name: type
    - auto: PREDEFINED
      description: When set to "True", only updates indicators that are added or removed. When set to "False", when adding or removing an indicator, the update time for all indicators will be changed.
      name: stateless
      predefined:
      - 'True'
      - 'False'
    description: Removes an indicator from a miner.
    name: minemeld-remove-from-miner
  - arguments:
    - description: Miner name. Specify "all" to get indicators for all miners.
      name: miner
      required: true
    description: Gets the indicators list for a miner.
    name: minemeld-retrieve-miner
    outputs:
    - contextPath: MineMeld.Miner
      description: Entire miner object.
      type: unknown
    - contextPath: MineMeld.Miner.name
      description: Miner name.
      type: string
    - contextPath: MineMeld.Miner.class
      description: Miner class.
      type: string
    - contextPath: MineMeld.Indicators
      description: Entire indicator object.
      type: Unknown
    - contextPath: MineMeld.Indicators.miner
      description: Indicator's miner.
      type: string
    - contextPath: MineMeld.Indicators.type
      description: Indicator type.
      type: string
    - contextPath: MineMeld.Indicators.indicator
      description: Indicator's value.
      type: string
    - contextPath: MineMeld.Indicators.comment
      description: Indicator's comment.
      type: string
  - arguments:
    - description: Miner name.
      name: miner
      required: true
    - description: Indicator details.
      name: indicator
      required: true
    description: Gets indicators from a miner's list.
    name: minemeld-get-indicator-from-miner
    outputs:
    - contextPath: MineMeld.Miner
      description: Entire miner object.
      type: Unknown
    - contextPath: MineMeld.Miner.name
      description: Miner name.
      type: string
    - contextPath: MineMeld.Indicators
      description: Entire indicator object.
      type: unknown
    - contextPath: MineMeld.Indicators.miner
      description: Indicator's miner.
      type: string
    - contextPath: MineMeld.Indicators.type
      description: Indicator type.
      type: string
    - contextPath: MineMeld.Indicators.indicator
      description: Indicator's value.
      type: string
    - contextPath: MineMeld.Indicators.comment
      description: Indicator's comment.
      type: string
  - arguments:
    - default: true
      description: ip
      name: ip
      required: true
    description: Searches for IP addresses on miners.
    name: ip
    outputs:
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: string
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: string
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: string
    - contextPath: DBotScore.Score
      description: The actual score.
      type: number
    - contextPath: IP.Malicious.Vendor
      description: For malicious IPs, the vendor that made the decision
      type: string
    - contextPath: IP.Malicious.Description
      description: For malicious IPs, the reason for the vendor to make the decision
      type: string
    - contextPath: IP.Address
      description: IP address
      type: string
    - contextPath: IP.MineMeld.Indicators
      description: Entire indicator object
      type: Unknown
    - contextPath: IP.MineMeld.Indicators.indicator
      description: Indicator's value
      type: string
    - contextPath: IP.MineMeld.Indicators.miner
      description: Indicator's miner
      type: string
    - contextPath: IP.MineMeld.Indicators.type
      description: Indicator type
      type: string
    - contextPath: IP.MineMeld.Indicators.comment
      description: Indicator's comment
      type: string
    - contextPath: IP.MineMeld.Miner
      description: Entire miner object
      type: unknown
    - contextPath: IP.MineMeld.Miner.name
      description: Miner name
      type: string
    - contextPath: MineMeld.Indicators
      description: Entire indicator object
      type: Unknown
    - contextPath: MineMeld.Indicators.indicator
      description: Indicator's value
      type: string
    - contextPath: MineMeld.Indicators.miner
      description: Indicator's miner
      type: string
    - contextPath: MineMeld.Indicators.type
      description: Indicator type
      type: string
    - contextPath: MineMeld.Indicators.comment
      description: Indicator's comment
      type: string
    - contextPath: MineMeld.Miner
      description: Entire miner object
      type: Unknown
    - contextPath: MineMeld.Miner.name
      description: Miner name
      type: string
  - arguments:
    - default: true
      description: file
      name: file
      required: true
    description: Search for file on lists
    name: file
    outputs:
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: string
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: string
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: string
    - contextPath: DBotScore.Score
      description: The actual score.
      type: number
    - contextPath: File.Malicious.Vendor
      description: For malicious files, the vendor that made the decision.
      type: string
    - contextPath: File.Malicious.Description
      description: For malicious files, the reason that the vendor made the decision.
      type: string
    - contextPath: File.MineMeld.Indicators
      description: Entire indicator object.
      type: Unknown
    - contextPath: File.MineMeld.Indicators.indicator
      description: Indicator's value.
      type: string
    - contextPath: File.MineMeld.Indicators.miner
      description: Indicator's miner.
      type: string
    - contextPath: File.MineMeld.Indicators.type
      description: Indicator type.
      type: string
    - contextPath: File.MineMeld.Indicators.comment
      description: Indicator's comment.
      type: string
    - contextPath: File.MineMeld.Miner
      description: Entire miner object.
      type: unknown
    - contextPath: File.MineMeld.Miner.name
      description: Miner name.
      type: string
    - contextPath: MineMeld.Indicators
      description: Entire indicator object.
      type: Unknown
    - contextPath: MineMeld.Indicators.indicator
      description: Indicator's value.
      type: string
    - contextPath: MineMeld.Indicators.miner
      description: Indicator's miner.
      type: string
    - contextPath: MineMeld.Indicators.type
      description: Indicator type.
      type: string
    - contextPath: MineMeld.Indicators.comment
      description: Indicator's comment.
      type: string
    - contextPath: MineMeld.Miner
      description: Entire miner object.
      type: Unknown
    - contextPath: MineMeld.Miner.name
      description: Miner name.
      type: string
    - contextPath: File.MD5
      description: MD5 hash of the file.
      type: string
    - contextPath: File.SHA1
      description: SHA1 hash of the file.
      type: string
    - contextPath: File.SHA256
      description: SHA256 hash of the file.
      type: string
  - arguments:
    - default: true
      description: domain
      name: domain
      required: true
    description: Searches for a specified domain on lists.
    name: domain
    outputs:
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: string
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: string
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: string
    - contextPath: DBotScore.Score
      description: The actual score.
      type: number
    - contextPath: Domain.Malicious.Vendor
      description: For malicious Domains, the vendor that made the decision.
      type: string
    - contextPath: Domain.Malicious.Description
      description: For malicious domains, the reason that the vendor made the decision.
      type: string
    - contextPath: Domain.Name
      description: Domain's name (value).
      type: string
    - contextPath: Domain.MineMeld.Indicators
      description: Entire indicator object.
      type: Unknown
    - contextPath: Domain.MineMeld.Indicators.indicator
      description: Indicator's value.
      type: string
    - contextPath: Domain.MineMeld.Indicators.miner
      description: Indicator's miner.
      type: string
    - contextPath: Domain.MineMeld.Indicators.type
      description: Indicator type.
      type: string
    - contextPath: Domain.MineMeld.Indicators.comment
      description: Indicator's comment.
      type: string
    - contextPath: Domain.MineMeld.Miner
      description: Entire miner object.
      type: unknown
    - contextPath: Domain.MineMeld.Miner.name
      description: Miner name.
      type: string
    - contextPath: MineMeld.Indicators
      description: Entire indicator object.
      type: Unknown
    - contextPath: MineMeld.Indicators.indicator
      description: Indicator's value.
      type: string
    - contextPath: MineMeld.Indicators.miner
      description: Indicator's miner.
      type: string
    - contextPath: MineMeld.Indicators.type
      description: Indicator type.
      type: string
    - contextPath: MineMeld.Indicators.comment
      description: Indicator's comment.
      type: string
    - contextPath: MineMeld.Miner
      description: Entire miner object.
      type: Unknown
    - contextPath: MineMeld.Miner.name
      description: Miner name.
      type: string
  - arguments:
    - default: true
      description: url
      name: url
      required: true
    description: Searches for the specified URL on lists.
    name: url
    outputs:
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: string
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: string
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: string
    - contextPath: DBotScore.Score
      description: The actual score.
      type: number
    - contextPath: URL.Malicious.Vendor
      description: For malicious URLs, the vendor that made the decision.
      type: string
    - contextPath: URL.Malicious.Description
      description: For malicious URLs, the reason that the vendor made the decision.
      type: string
    - contextPath: URL.Data
      description: URL's data (value).
      type: string
    - contextPath: URL.MineMeld.Indicators
      description: Entire indicator object.
      type: Unknown
    - contextPath: URL.MineMeld.Indicators.indicator
      description: Indicator's value.
      type: string
    - contextPath: URL.MineMeld.Indicators.miner
      description: Indicator's miner.
      type: string
    - contextPath: URL.MineMeld.Indicators.type
      description: Indicator type.
      type: string
    - contextPath: URL.MineMeld.Indicators.comment
      description: Indicator's comment.
      type: string
    - contextPath: URL.MineMeld.Miner
      description: Entire miner object.
      type: unknown
    - contextPath: URL.MineMeld.Miner.name
      description: Miner name.
      type: string
    - contextPath: MineMeld.Indicators
      description: Entire indicator object.
      type: Unknown
    - contextPath: MineMeld.Indicators.indicator
      description: Indicator's value.
      type: string
    - contextPath: MineMeld.Indicators.miner
      description: Indicator's miner.
      type: string
    - contextPath: MineMeld.Indicators.type
      description: Indicator type.
      type: string
    - contextPath: MineMeld.Indicators.comment
      description: Indicator's comment.
      type: string
    - contextPath: MineMeld.Miner
      description: Entire miner object.
      type: Unknown
    - contextPath: MineMeld.Miner.name
      description: Miner name.
      type: string
  - description: Returns all miner names (with supported classes of custom indicators lists).
    name: minemeld-get-all-miners-names
    outputs:
    - contextPath: MineMeld.Miner
      description: Entire miner object.
      type: unknown
    - contextPath: MineMeld.Miner.name
      description: Miner's name.
      type: string
    - contextPath: MineMeld.Miner.class
      description: Miner's class.
      type: string
    - contextPath: MineMeld.Miner.indicators
      description: Amount of miner's indicators.
      type: string
  runonce: false
  script: '-'
  subtype: python2
  type: python
  dockerimage: demisto/python:2.7.18.20958
tests:
- No tests
fromversion: 5.0.0