Palo Alto Minemeld Deprecated
Deprecated. MineMeld streamlines the aggregation, enforcement and sharing of threat intelligence.
Data Enrichment & Threat Intelligence · Deprecated Content (Deprecated)
Details
| ID | Palo Alto Minemeld |
|---|---|
| Provider | Open Source |
| Category | Data Enrichment & Threat Intelligence |
| From Version | 5.0.0 |
| Docker Image | demisto/python:2.7.18.20958 |
README
Use the Palo Alto Networks MineMeld integration to manage your MineMeld miners from within Cortex XSOAR. All commands require the super admin role.
Use Cases
- Add or remove indicators from a miner.
- Fetch miners, IP addresses, files, domains, and URLs.
- Get a list of all your miners.
NOTE: Indicators on an allow list get a DBot score of 1. Indicators on a block list get a DBot score of 3.
Supported Miner Prototypes
- localDB
- listURLGeneric
- listIPv4Generic
- listDomainGeneric
- listIPv6Generic
Configure Palo Alto Networks MineMeld on Cortex XSOAR:
- Navigate to Settings > Integrations > Servers & Services.
- Search for Palo Alto Networks MineMeld.
- Click Add instance to create and configure a new integration instance.
- Name: A textual name for the integration instance.
- Mine
- meld URL : The URL of your MineMeld environment.
- Username & Password : Your credentials in the MineMeld environment.
- Block list names : Comma separated list of miners, to be added to the Cortex XSOAR block list.
- Allow list names: CSV list of miners to add to the Cortex XSOAR allow list.
- Use system proxy settings
- Click Test to validate the URLs and connection.
Commands
You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details. All commands require the super admin role.
- Add an indicator to a miner: minemeld-add-to-miner
- Remove an indicator from a miner: minemeld-remove-from-miner
- Get miner details: minemeld-retrieve miner
- Get an indicator from a miner: minemeld-get-indicator-from-miner
- Get IP address indicator: ip
- Get file indicator: file
- Get domain indicator: domain
- Get URL indicator: url
- Get a list of all the miners: minemeld-get-all-miners-names
1. Add an indicator to a miner
Adds a specified indicator to a specified miner. Do not add a single indicator to multiple miners.
Base Command
minemeld-add-to-miner
Input
| Argument Name | Description | More Information |
|---|---|---|
| miner | Miner name | To find the miner name, search for List of Supported Nodes on your MineMeld environment. |
| indicator | Indicator to add to miner |
Any type of indicator. Examples of valid indicators:
|
| comment | Textual description or comment for the indicator | - |
Context output
There is no context output for this command.
Command example
!minemeld-add-to-miner miner=Supicious indicator=7.7.7.7
War Room Output

2. Remove an indicator from a miner
Removes a specified indicator from a specified miner.
Base Command
minemeld-remove-from-miner
Input
| Argument Name | Description | More Information |
|---|---|---|
| miner | Miner name | To find the miner name, search for List of Supported Nodes on your MineMeld environment. |
| indicator | The indicator to remove |
Any type of indicator. Examples of valid indicators:
|
Context output
There is no context output for this command.
Command example
!minemeld-remove-from-miner miner=Suspicious indicator=7.7.7.7
War Room Output

3. Get miner details
Retrieves information about a specified miner.
Base Code
minemeld-retrieve-miner
Input
| Argument Name | Description | More Information |
|---|---|---|
| miner | Miner name | To select all miners type miner=all. |
Context Output
| Path | Description |
|---|---|
| MineMeld.Miner | Entire miner object |
| MineMeld.Miner.name | Miner name |
| MineMeld.Miner.class | Miner class |
| MineMeld.Indicators | Entire indicator object |
| MineMeld.Indicators.miner | Miner of indicator |
| MineMeld.Indicators.type | Indicator type |
| MineMeld.Indicators.indicator | Indicator value |
| MineMeld.Indicators.comment | Indicator comment |
Command Example
!minemeld-retrieve-miner miner=Suspicious
War Room Output
4. Get an indicator within a miner
Retrieves information about a specified indicator associated with a specified miner.
Base Command
minemeld-get-indicator-from-miner
Input
| Argument Name | Description |
|---|---|
| miner | Miner name |
| indicator |
Any type of indicator. Examples of valid indicators:
|
Context Output
| Path | Description |
|---|---|
| MineMeld.Miner | Entire miner object |
| MineMeld.Miner.name | Miner name |
| MineMeld.Indicators | Entire indicator object |
| MineMeld.Indicators.miner | Miner of the indicator |
| MineMeld.Indicators.type | Indicator type |
| MineMeld.Indicators.indicator | Indicator value |
| MineMeld.Indicators.comment | Indicator comment |
Command Example
!minemeld-get-indicator-from-miner miner=Suspicious indicator=7.7.7.7
War Room Output

5. Get IP address indicator
Retrieves all occurrences of the specified IP address, including the context in which it is found.
For this command to succeed, the miner (associated with the IP address indicator) has to be on a Cortex XSOAR block list or allow list.
Base Command
ip
Input
| Argument Name | Description |
|---|---|
| ip | IP address |
Context Output
| Path | Description |
|---|---|
| DBotScore.Indicator | The Indicator |
| DBotScore.Type | The Indicator type |
| DBotScore.Vendor | The DBot score vendor |
| DBotScore.Score | The DBot score |
| IP.Malicious.Vendor | For malicious IP addresses, the vendor defined the IP address as malicious |
| IP.Malicious.Description | For malicious IP addresses, the reason why the vendor defined the IP address as malicious |
| IP.Address | IP address |
| IP.MineMeld.Indicators | Entire indicator object |
| IP.MineMeld.Indicators.indicator | Indicator value |
| IP.MineMeld.Indicators.miner | Miner of the indicator |
| IP.MineMeld.Indicators.type | Indicator type |
| IP.MineMeld.Indicators.comment | Indicator comment |
| MineMeld.Indicators | Entire indicator object |
| MineMeld.Indicators.indicator | Indicator value |
| MineMeld.Indicators.miner | Miner of the indicator |
| MineMeld.Indicators.type | Indicator type |
| MineMeld.Indicators.comment | Indicator comment |
| MineMeld.Miner | Entire miner object |
| MineMeld.Miner.name | Miner name |
Command Example
!ip ip=7.7.7.7 using-brand="Palo Alto Minemeld"
War Room Output
6. Get file indicator
Retrieves all occurrences of the specified file, including the context in which it is found.
For this command to succeed, the miner (associated with the file indicator) has to be on a Cortex XSOAR block list or allow list.
Base Command
file
Input
| Argument Name | Description |
|---|---|
| file | Any type of file hash |
Context Output
| Path | Description |
|---|---|
| DBotScore.Indicator | The Indicator |
| DBotScore.Type | The Indicator type |
| DBotScore.Vendor | The DBot score vendor |
| DBotScore.Score | The DBot score |
| File.Malicious.Vendor | For malicious files, the vendor that defined the file as malicious |
| File.Malicious.Description | For malicious files, the reason why the vendor defined the file as malicious |
| File.MineMeld.Indicators | Entire indicator object |
| File.MineMeld.Indicators.indicator | Indicator value |
| File.MineMeld.Indicators.miner | Miner of the indicator. |
| File.MineMeld.Indicators.type | Indicator type |
| File.MineMeld.Indicators.comment | Indicator comment |
| MineMeld.Indicators | Entire indicator object |
| MineMeld.Indicators.indicator | Indicator value |
| MineMeld.Indicators.miner | Miner of the indicator |
| MineMeld.Indicators.type | Indicator type |
| MineMeld.Indicators.comment | Indicator comment |
| MineMeld.Miner | Entire miner object |
| MineMeld.Miner.name | Miner name |
| File.MD5 | MD5 hash of the file |
| File.SHA1 | SHA-1 hash of the file |
| File.SHA256 | SHA-256 hash of the file |
Command example
!file file=9acb44549b41563697bb490144ec6258 using-brand="Palo Alto Minemeld"
War Room Output
7. Get domain indicator
Retrieves all occurrences of the specified domain, including the context in which it is found.
For this command to succeed, the miner (associated with the domain indicator) has to be on a Cortex XSOAR block list or allow list.
Base Command
domain
Input
| Argument Name | Description |
|---|---|
| domain | Domain |
Context Output
| Path | Description |
|---|---|
| DBotScore.Indicator | The Indicator |
| DBotScore.Type | The Indicator type |
| DBotScore.Vendor | The DBot score vendor |
| DBotScore.Score | The DBot score |
| Domain.Malicious.Vendor | For malicious domains, the vendor that defined the domain as malicious |
| Domain.Malicious.Description | For malicious domains, the reason that the vendor defined the domain as malicious |
| Domain.Name | Domain name (value) |
| Domain.MineMeld.Indicators | Entire indicator object |
| Domain.MineMeld.Indicators.indicator | Indicator value |
| Domain.MineMeld.Indicators.miner | Indicator miner |
| Domain.MineMeld.Indicators.type | Indicator type |
| Domain.MineMeld.Indicators.comment | Indicator comment |
| MineMeld.Indicators | Entire indicator object |
| MineMeld.Indicators.indicator | Indicator value |
| MineMeld.Indicators.miner | Miner of the indicator |
| MineMeld.Indicators.type | Indicator type |
| MineMeld.Indicators.comment | Indicator comment |
| MineMeld.Miner | Entire miner object |
| MineMeld.Miner.name | Miner name |
Command example
!domain domain=moogle.com using-brand="Palo Alto Minemeld"
War Room Output
8. Get URL indicator
Retrieves all occurrences of the specified URL, including the context in which it is found.
For this command to succeed, the miner (associated with the URL indicator) has to be on a Cortex XSOAR block list or allow list.
Base Command
url
Input
| Argument Name | Description |
|---|---|
| url | URL to retrieve instances for |
Context Output
| Path | Description |
|---|---|
| DBotScore.Indicator | The Indicator |
| DBotScore.Type | The Indicator type |
| DBotScore.Vendor | The DBot score vendor |
| DBotScore.Score | The DBot score |
| URL.Malicious.Vendor | For malicious URLs, the vendor that defined the URL as malicious |
| URL.Malicious.Description | For malicious URLs, the reason that the vendor defined the URL as malicious |
| URL.Data | URL data (value) |
| URL.MineMeld.Indicators | Entire indicator object |
| URL.MineMeld.Indicators.indicator | Indicator value |
| URL.MineMeld.Indicators.miner | Miner of the indicator |
| URL.MineMeld.Indicators.type | Indicator type |
| URL.MineMeld.Indicators.comment | Indicator comment |
| MineMeld.Indicators | Entire indicator object |
| MineMeld.Indicators.indicator | Indicator value |
| MineMeld.Indicators.miner | Miner of the Indicator |
| MineMeld.Indicators.type | Indicator type |
| MineMeld.Indicators.comment | Indicator comment |
| MineMeld.Miner | Entire miner object |
| MineMeld.Miner.name | Miner name |
Command example
!url url=voogle.com/malicious.exe using-brand="Palo Alto Minemeld"
War Room Output

9. Get a list of all the miners
Retrieves the names of all the miners, the class of each miner, and how many indicators are associated with each miner.
Base Command
minemeld-get-all-miners-names
Input
There is no input for this command.
Context Output
| Path | Description |
|---|---|
| MineMeld.Miner | Entire miner object |
| MineMeld.Miner.name | Miner name |
| MineMeld.Miner.class | Miner class |
| MineMeld.Miner.indicators | Number of miner indicators |
Command example
!minemeld-get-all-miners-names
War Room Output
Configuration parameters
url— MineMeld url e.g.(https://192.0.0.1/) (required)credentials— Username (required)blacklist— Block list names e.g.(BlackListIPv4, BlackListURL,Malicious)stateless— Statelesswhitelist— Whitelist names e.g.(wlWhiteListIPv4,wlWhiteListDomain,Unmalicious)proxy— Use system proxy settings
Commands (9)
-
domainSearches for a specified domain on lists.
-
fileSearch for file on lists
-
ipSearches for IP addresses on miners.
-
minemeld-add-to-minerAdd an indicator to a miner.
-
minemeld-get-all-miners-namesReturns all miner names (with supported classes of custom indicators lists).
-
minemeld-get-indicator-from-minerGets indicators from a miner's list.
-
minemeld-remove-from-minerRemoves an indicator from a miner.
-
minemeld-retrieve-minerGets the indicators list for a miner.
-
urlSearches for the specified URL on lists.
category: Data Enrichment & Threat Intelligence provider: Open Source commonfields: id: Palo Alto Minemeld version: -1 configuration: - display: MineMeld url e.g.(https://192.0.0.1/) name: url required: true type: 0 - display: Username name: credentials required: true type: 9 - display: Block list names e.g.(BlackListIPv4, BlackListURL,Malicious) name: blacklist type: 0 required: false - additionalinfo: When set to "True", only updates indicators that are added or removed. When set to "False", when adding or removing an indicator, the update time for all indicators will be changed. defaultvalue: 'False' display: Stateless name: stateless options: - 'True' - 'False' type: 15 required: false - display: Whitelist names e.g.(wlWhiteListIPv4,wlWhiteListDomain,Unmalicious) name: whitelist type: 0 required: false - display: Use system proxy settings name: proxy type: 8 required: false description: Deprecated. MineMeld streamlines the aggregation, enforcement and sharing of threat intelligence. deprecated: true display: Palo Alto Networks MineMeld (Deprecated) name: Palo Alto Minemeld script: commands: - arguments: - description: Miner name - you can get it under Nodes page on MineMeld UI (nodes of type "miner"). name: miner required: true - description: The indicator's value to add. Support list \ comma-separated values. isArray: true name: indicator required: true - description: The type of the indicator to add to the miner. name: type - description: Comment for the indicator. name: comment - auto: PREDEFINED description: When set to "True", only updates indicators that are added or removed. When set to "False", when adding or removing an indicator, the update time for all indicators will be changed. name: stateless predefined: - 'True' - 'False' description: Add an indicator to a miner. name: minemeld-add-to-miner - arguments: - description: Miner name - you can get it under Nodes page on MineMeld UI (nodes of type "miner"). name: miner required: true - description: The value of the indicator to remove. name: indicator required: true - description: The type of the indicator to remove from the miner. name: type - auto: PREDEFINED description: When set to "True", only updates indicators that are added or removed. When set to "False", when adding or removing an indicator, the update time for all indicators will be changed. name: stateless predefined: - 'True' - 'False' description: Removes an indicator from a miner. name: minemeld-remove-from-miner - arguments: - description: Miner name. Specify "all" to get indicators for all miners. name: miner required: true description: Gets the indicators list for a miner. name: minemeld-retrieve-miner outputs: - contextPath: MineMeld.Miner description: Entire miner object. type: unknown - contextPath: MineMeld.Miner.name description: Miner name. type: string - contextPath: MineMeld.Miner.class description: Miner class. type: string - contextPath: MineMeld.Indicators description: Entire indicator object. type: Unknown - contextPath: MineMeld.Indicators.miner description: Indicator's miner. type: string - contextPath: MineMeld.Indicators.type description: Indicator type. type: string - contextPath: MineMeld.Indicators.indicator description: Indicator's value. type: string - contextPath: MineMeld.Indicators.comment description: Indicator's comment. type: string - arguments: - description: Miner name. name: miner required: true - description: Indicator details. name: indicator required: true description: Gets indicators from a miner's list. name: minemeld-get-indicator-from-miner outputs: - contextPath: MineMeld.Miner description: Entire miner object. type: Unknown - contextPath: MineMeld.Miner.name description: Miner name. type: string - contextPath: MineMeld.Indicators description: Entire indicator object. type: unknown - contextPath: MineMeld.Indicators.miner description: Indicator's miner. type: string - contextPath: MineMeld.Indicators.type description: Indicator type. type: string - contextPath: MineMeld.Indicators.indicator description: Indicator's value. type: string - contextPath: MineMeld.Indicators.comment description: Indicator's comment. type: string - arguments: - default: true description: ip name: ip required: true description: Searches for IP addresses on miners. name: ip outputs: - contextPath: DBotScore.Indicator description: The indicator that was tested. type: string - contextPath: DBotScore.Type description: The indicator type. type: string - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: string - contextPath: DBotScore.Score description: The actual score. type: number - contextPath: IP.Malicious.Vendor description: For malicious IPs, the vendor that made the decision type: string - contextPath: IP.Malicious.Description description: For malicious IPs, the reason for the vendor to make the decision type: string - contextPath: IP.Address description: IP address type: string - contextPath: IP.MineMeld.Indicators description: Entire indicator object type: Unknown - contextPath: IP.MineMeld.Indicators.indicator description: Indicator's value type: string - contextPath: IP.MineMeld.Indicators.miner description: Indicator's miner type: string - contextPath: IP.MineMeld.Indicators.type description: Indicator type type: string - contextPath: IP.MineMeld.Indicators.comment description: Indicator's comment type: string - contextPath: IP.MineMeld.Miner description: Entire miner object type: unknown - contextPath: IP.MineMeld.Miner.name description: Miner name type: string - contextPath: MineMeld.Indicators description: Entire indicator object type: Unknown - contextPath: MineMeld.Indicators.indicator description: Indicator's value type: string - contextPath: MineMeld.Indicators.miner description: Indicator's miner type: string - contextPath: MineMeld.Indicators.type description: Indicator type type: string - contextPath: MineMeld.Indicators.comment description: Indicator's comment type: string - contextPath: MineMeld.Miner description: Entire miner object type: Unknown - contextPath: MineMeld.Miner.name description: Miner name type: string - arguments: - default: true description: file name: file required: true description: Search for file on lists name: file outputs: - contextPath: DBotScore.Indicator description: The indicator that was tested. type: string - contextPath: DBotScore.Type description: The indicator type. type: string - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: string - contextPath: DBotScore.Score description: The actual score. type: number - contextPath: File.Malicious.Vendor description: For malicious files, the vendor that made the decision. type: string - contextPath: File.Malicious.Description description: For malicious files, the reason that the vendor made the decision. type: string - contextPath: File.MineMeld.Indicators description: Entire indicator object. type: Unknown - contextPath: File.MineMeld.Indicators.indicator description: Indicator's value. type: string - contextPath: File.MineMeld.Indicators.miner description: Indicator's miner. type: string - contextPath: File.MineMeld.Indicators.type description: Indicator type. type: string - contextPath: File.MineMeld.Indicators.comment description: Indicator's comment. type: string - contextPath: File.MineMeld.Miner description: Entire miner object. type: unknown - contextPath: File.MineMeld.Miner.name description: Miner name. type: string - contextPath: MineMeld.Indicators description: Entire indicator object. type: Unknown - contextPath: MineMeld.Indicators.indicator description: Indicator's value. type: string - contextPath: MineMeld.Indicators.miner description: Indicator's miner. type: string - contextPath: MineMeld.Indicators.type description: Indicator type. type: string - contextPath: MineMeld.Indicators.comment description: Indicator's comment. type: string - contextPath: MineMeld.Miner description: Entire miner object. type: Unknown - contextPath: MineMeld.Miner.name description: Miner name. type: string - contextPath: File.MD5 description: MD5 hash of the file. type: string - contextPath: File.SHA1 description: SHA1 hash of the file. type: string - contextPath: File.SHA256 description: SHA256 hash of the file. type: string - arguments: - default: true description: domain name: domain required: true description: Searches for a specified domain on lists. name: domain outputs: - contextPath: DBotScore.Indicator description: The indicator that was tested. type: string - contextPath: DBotScore.Type description: The indicator type. type: string - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: string - contextPath: DBotScore.Score description: The actual score. type: number - contextPath: Domain.Malicious.Vendor description: For malicious Domains, the vendor that made the decision. type: string - contextPath: Domain.Malicious.Description description: For malicious domains, the reason that the vendor made the decision. type: string - contextPath: Domain.Name description: Domain's name (value). type: string - contextPath: Domain.MineMeld.Indicators description: Entire indicator object. type: Unknown - contextPath: Domain.MineMeld.Indicators.indicator description: Indicator's value. type: string - contextPath: Domain.MineMeld.Indicators.miner description: Indicator's miner. type: string - contextPath: Domain.MineMeld.Indicators.type description: Indicator type. type: string - contextPath: Domain.MineMeld.Indicators.comment description: Indicator's comment. type: string - contextPath: Domain.MineMeld.Miner description: Entire miner object. type: unknown - contextPath: Domain.MineMeld.Miner.name description: Miner name. type: string - contextPath: MineMeld.Indicators description: Entire indicator object. type: Unknown - contextPath: MineMeld.Indicators.indicator description: Indicator's value. type: string - contextPath: MineMeld.Indicators.miner description: Indicator's miner. type: string - contextPath: MineMeld.Indicators.type description: Indicator type. type: string - contextPath: MineMeld.Indicators.comment description: Indicator's comment. type: string - contextPath: MineMeld.Miner description: Entire miner object. type: Unknown - contextPath: MineMeld.Miner.name description: Miner name. type: string - arguments: - default: true description: url name: url required: true description: Searches for the specified URL on lists. name: url outputs: - contextPath: DBotScore.Indicator description: The indicator that was tested. type: string - contextPath: DBotScore.Type description: The indicator type. type: string - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: string - contextPath: DBotScore.Score description: The actual score. type: number - contextPath: URL.Malicious.Vendor description: For malicious URLs, the vendor that made the decision. type: string - contextPath: URL.Malicious.Description description: For malicious URLs, the reason that the vendor made the decision. type: string - contextPath: URL.Data description: URL's data (value). type: string - contextPath: URL.MineMeld.Indicators description: Entire indicator object. type: Unknown - contextPath: URL.MineMeld.Indicators.indicator description: Indicator's value. type: string - contextPath: URL.MineMeld.Indicators.miner description: Indicator's miner. type: string - contextPath: URL.MineMeld.Indicators.type description: Indicator type. type: string - contextPath: URL.MineMeld.Indicators.comment description: Indicator's comment. type: string - contextPath: URL.MineMeld.Miner description: Entire miner object. type: unknown - contextPath: URL.MineMeld.Miner.name description: Miner name. type: string - contextPath: MineMeld.Indicators description: Entire indicator object. type: Unknown - contextPath: MineMeld.Indicators.indicator description: Indicator's value. type: string - contextPath: MineMeld.Indicators.miner description: Indicator's miner. type: string - contextPath: MineMeld.Indicators.type description: Indicator type. type: string - contextPath: MineMeld.Indicators.comment description: Indicator's comment. type: string - contextPath: MineMeld.Miner description: Entire miner object. type: Unknown - contextPath: MineMeld.Miner.name description: Miner name. type: string - description: Returns all miner names (with supported classes of custom indicators lists). name: minemeld-get-all-miners-names outputs: - contextPath: MineMeld.Miner description: Entire miner object. type: unknown - contextPath: MineMeld.Miner.name description: Miner's name. type: string - contextPath: MineMeld.Miner.class description: Miner's class. type: string - contextPath: MineMeld.Miner.indicators description: Amount of miner's indicators. type: string runonce: false script: '-' subtype: python2 type: python dockerimage: demisto/python:2.7.18.20958 tests: - No tests fromversion: 5.0.0




