category: Data Enrichment & Threat Intelligence
provider: Open Source
commonfields:
  id: Palo Alto Minemeld
  version: -1
configuration:
- display: MineMeld url e.g.(https://192.0.0.1/)
  name: url
  required: true
  type: 0
- display: Username
  name: credentials
  required: true
  type: 9
- display: Block list names e.g.(BlackListIPv4, BlackListURL,Malicious)
  name: blacklist
  type: 0
  required: false
- additionalinfo: When set to "True", only updates indicators that are added or removed. When set to "False", when adding or removing an indicator, the update time for all indicators will be changed.
  defaultvalue: 'False'
  display: Stateless
  name: stateless
  options:
  - 'True'
  - 'False'
  type: 15
  required: false
- display: Whitelist names e.g.(wlWhiteListIPv4,wlWhiteListDomain,Unmalicious)
  name: whitelist
  type: 0
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
description: Deprecated. MineMeld streamlines the aggregation, enforcement and sharing of threat intelligence.
deprecated: true
display: Palo Alto Networks MineMeld (Deprecated)
name: Palo Alto Minemeld
script:
  commands:
  - arguments:
    - description: Miner name - you can get it under Nodes page on MineMeld UI (nodes of type "miner").
      name: miner
      required: true
    - description: The indicator's value to add. Support list \ comma-separated values.
      isArray: true
      name: indicator
      required: true
    - description: The type of the indicator to add to the miner.
      name: type
    - description: Comment for the indicator.
      name: comment
    - auto: PREDEFINED
      description: When set to "True", only updates indicators that are added or removed. When set to "False", when adding or removing an indicator, the update time for all indicators will be changed.
      name: stateless
      predefined:
      - 'True'
      - 'False'
    description: Add an indicator to a miner.
    name: minemeld-add-to-miner
  - arguments:
    - description: Miner name - you can get it under Nodes page on MineMeld UI (nodes of type "miner").
      name: miner
      required: true
    - description: The value of the indicator to remove.
      name: indicator
      required: true
    - description: The type of the indicator to remove from the miner.
      name: type
    - auto: PREDEFINED
      description: When set to "True", only updates indicators that are added or removed. When set to "False", when adding or removing an indicator, the update time for all indicators will be changed.
      name: stateless
      predefined:
      - 'True'
      - 'False'
    description: Removes an indicator from a miner.
    name: minemeld-remove-from-miner
  - arguments:
    - description: Miner name. Specify "all" to get indicators for all miners.
      name: miner
      required: true
    description: Gets the indicators list for a miner.
    name: minemeld-retrieve-miner
    outputs:
    - contextPath: MineMeld.Miner
      description: Entire miner object.
      type: unknown
    - contextPath: MineMeld.Miner.name
      description: Miner name.
      type: string
    - contextPath: MineMeld.Miner.class
      description: Miner class.
      type: string
    - contextPath: MineMeld.Indicators
      description: Entire indicator object.
      type: Unknown
    - contextPath: MineMeld.Indicators.miner
      description: Indicator's miner.
      type: string
    - contextPath: MineMeld.Indicators.type
      description: Indicator type.
      type: string
    - contextPath: MineMeld.Indicators.indicator
      description: Indicator's value.
      type: string
    - contextPath: MineMeld.Indicators.comment
      description: Indicator's comment.
      type: string
  - arguments:
    - description: Miner name.
      name: miner
      required: true
    - description: Indicator details.
      name: indicator
      required: true
    description: Gets indicators from a miner's list.
    name: minemeld-get-indicator-from-miner
    outputs:
    - contextPath: MineMeld.Miner
      description: Entire miner object.
      type: Unknown
    - contextPath: MineMeld.Miner.name
      description: Miner name.
      type: string
    - contextPath: MineMeld.Indicators
      description: Entire indicator object.
      type: unknown
    - contextPath: MineMeld.Indicators.miner
      description: Indicator's miner.
      type: string
    - contextPath: MineMeld.Indicators.type
      description: Indicator type.
      type: string
    - contextPath: MineMeld.Indicators.indicator
      description: Indicator's value.
      type: string
    - contextPath: MineMeld.Indicators.comment
      description: Indicator's comment.
      type: string
  - arguments:
    - default: true
      description: ip
      name: ip
      required: true
    description: Searches for IP addresses on miners.
    name: ip
    outputs:
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: string
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: string
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: string
    - contextPath: DBotScore.Score
      description: The actual score.
      type: number
    - contextPath: IP.Malicious.Vendor
      description: For malicious IPs, the vendor that made the decision
      type: string
    - contextPath: IP.Malicious.Description
      description: For malicious IPs, the reason for the vendor to make the decision
      type: string
    - contextPath: IP.Address
      description: IP address
      type: string
    - contextPath: IP.MineMeld.Indicators
      description: Entire indicator object
      type: Unknown
    - contextPath: IP.MineMeld.Indicators.indicator
      description: Indicator's value
      type: string
    - contextPath: IP.MineMeld.Indicators.miner
      description: Indicator's miner
      type: string
    - contextPath: IP.MineMeld.Indicators.type
      description: Indicator type
      type: string
    - contextPath: IP.MineMeld.Indicators.comment
      description: Indicator's comment
      type: string
    - contextPath: IP.MineMeld.Miner
      description: Entire miner object
      type: unknown
    - contextPath: IP.MineMeld.Miner.name
      description: Miner name
      type: string
    - contextPath: MineMeld.Indicators
      description: Entire indicator object
      type: Unknown
    - contextPath: MineMeld.Indicators.indicator
      description: Indicator's value
      type: string
    - contextPath: MineMeld.Indicators.miner
      description: Indicator's miner
      type: string
    - contextPath: MineMeld.Indicators.type
      description: Indicator type
      type: string
    - contextPath: MineMeld.Indicators.comment
      description: Indicator's comment
      type: string
    - contextPath: MineMeld.Miner
      description: Entire miner object
      type: Unknown
    - contextPath: MineMeld.Miner.name
      description: Miner name
      type: string
  - arguments:
    - default: true
      description: file
      name: file
      required: true
    description: Search for file on lists
    name: file
    outputs:
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: string
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: string
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: string
    - contextPath: DBotScore.Score
      description: The actual score.
      type: number
    - contextPath: File.Malicious.Vendor
      description: For malicious files, the vendor that made the decision.
      type: string
    - contextPath: File.Malicious.Description
      description: For malicious files, the reason that the vendor made the decision.
      type: string
    - contextPath: File.MineMeld.Indicators
      description: Entire indicator object.
      type: Unknown
    - contextPath: File.MineMeld.Indicators.indicator
      description: Indicator's value.
      type: string
    - contextPath: File.MineMeld.Indicators.miner
      description: Indicator's miner.
      type: string
    - contextPath: File.MineMeld.Indicators.type
      description: Indicator type.
      type: string
    - contextPath: File.MineMeld.Indicators.comment
      description: Indicator's comment.
      type: string
    - contextPath: File.MineMeld.Miner
      description: Entire miner object.
      type: unknown
    - contextPath: File.MineMeld.Miner.name
      description: Miner name.
      type: string
    - contextPath: MineMeld.Indicators
      description: Entire indicator object.
      type: Unknown
    - contextPath: MineMeld.Indicators.indicator
      description: Indicator's value.
      type: string
    - contextPath: MineMeld.Indicators.miner
      description: Indicator's miner.
      type: string
    - contextPath: MineMeld.Indicators.type
      description: Indicator type.
      type: string
    - contextPath: MineMeld.Indicators.comment
      description: Indicator's comment.
      type: string
    - contextPath: MineMeld.Miner
      description: Entire miner object.
      type: Unknown
    - contextPath: MineMeld.Miner.name
      description: Miner name.
      type: string
    - contextPath: File.MD5
      description: MD5 hash of the file.
      type: string
    - contextPath: File.SHA1
      description: SHA1 hash of the file.
      type: string
    - contextPath: File.SHA256
      description: SHA256 hash of the file.
      type: string
  - arguments:
    - default: true
      description: domain
      name: domain
      required: true
    description: Searches for a specified domain on lists.
    name: domain
    outputs:
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: string
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: string
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: string
    - contextPath: DBotScore.Score
      description: The actual score.
      type: number
    - contextPath: Domain.Malicious.Vendor
      description: For malicious Domains, the vendor that made the decision.
      type: string
    - contextPath: Domain.Malicious.Description
      description: For malicious domains, the reason that the vendor made the decision.
      type: string
    - contextPath: Domain.Name
      description: Domain's name (value).
      type: string
    - contextPath: Domain.MineMeld.Indicators
      description: Entire indicator object.
      type: Unknown
    - contextPath: Domain.MineMeld.Indicators.indicator
      description: Indicator's value.
      type: string
    - contextPath: Domain.MineMeld.Indicators.miner
      description: Indicator's miner.
      type: string
    - contextPath: Domain.MineMeld.Indicators.type
      description: Indicator type.
      type: string
    - contextPath: Domain.MineMeld.Indicators.comment
      description: Indicator's comment.
      type: string
    - contextPath: Domain.MineMeld.Miner
      description: Entire miner object.
      type: unknown
    - contextPath: Domain.MineMeld.Miner.name
      description: Miner name.
      type: string
    - contextPath: MineMeld.Indicators
      description: Entire indicator object.
      type: Unknown
    - contextPath: MineMeld.Indicators.indicator
      description: Indicator's value.
      type: string
    - contextPath: MineMeld.Indicators.miner
      description: Indicator's miner.
      type: string
    - contextPath: MineMeld.Indicators.type
      description: Indicator type.
      type: string
    - contextPath: MineMeld.Indicators.comment
      description: Indicator's comment.
      type: string
    - contextPath: MineMeld.Miner
      description: Entire miner object.
      type: Unknown
    - contextPath: MineMeld.Miner.name
      description: Miner name.
      type: string
  - arguments:
    - default: true
      description: url
      name: url
      required: true
    description: Searches for the specified URL on lists.
    name: url
    outputs:
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: string
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: string
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: string
    - contextPath: DBotScore.Score
      description: The actual score.
      type: number
    - contextPath: URL.Malicious.Vendor
      description: For malicious URLs, the vendor that made the decision.
      type: string
    - contextPath: URL.Malicious.Description
      description: For malicious URLs, the reason that the vendor made the decision.
      type: string
    - contextPath: URL.Data
      description: URL's data (value).
      type: string
    - contextPath: URL.MineMeld.Indicators
      description: Entire indicator object.
      type: Unknown
    - contextPath: URL.MineMeld.Indicators.indicator
      description: Indicator's value.
      type: string
    - contextPath: URL.MineMeld.Indicators.miner
      description: Indicator's miner.
      type: string
    - contextPath: URL.MineMeld.Indicators.type
      description: Indicator type.
      type: string
    - contextPath: URL.MineMeld.Indicators.comment
      description: Indicator's comment.
      type: string
    - contextPath: URL.MineMeld.Miner
      description: Entire miner object.
      type: unknown
    - contextPath: URL.MineMeld.Miner.name
      description: Miner name.
      type: string
    - contextPath: MineMeld.Indicators
      description: Entire indicator object.
      type: Unknown
    - contextPath: MineMeld.Indicators.indicator
      description: Indicator's value.
      type: string
    - contextPath: MineMeld.Indicators.miner
      description: Indicator's miner.
      type: string
    - contextPath: MineMeld.Indicators.type
      description: Indicator type.
      type: string
    - contextPath: MineMeld.Indicators.comment
      description: Indicator's comment.
      type: string
    - contextPath: MineMeld.Miner
      description: Entire miner object.
      type: Unknown
    - contextPath: MineMeld.Miner.name
      description: Miner name.
      type: string
  - description: Returns all miner names (with supported classes of custom indicators lists).
    name: minemeld-get-all-miners-names
    outputs:
    - contextPath: MineMeld.Miner
      description: Entire miner object.
      type: unknown
    - contextPath: MineMeld.Miner.name
      description: Miner's name.
      type: string
    - contextPath: MineMeld.Miner.class
      description: Miner's class.
      type: string
    - contextPath: MineMeld.Miner.indicators
      description: Amount of miner's indicators.
      type: string
  runonce: false
  script: '-'
  subtype: python2
  type: python
  dockerimage: demisto/python:2.7.18.20958
tests:
- No tests
fromversion: 5.0.0