search

PaloAltoNetworks / minemeld

Main MineMeld documentation repo
379 stars 64 forks source link

MineMeld withdrawing indicators when used by multiple users #15

Closed aalmeidasilva closed 6 years ago

aalmeidasilva commented 6 years ago

Let’s say you have two users connected to MineMeld.

The first user opens one miner to add an indicator to it and left the browser opened. At the same time, a second user opens the same miner and left the browser opened. So, they are seeing the same indicators. Now, let’s say that the first user adds an indicator to the miner, but the second user does not refresh the page and adds an indicator just after the first user.

In this situation, MineMeld will withdraw the first indicator added by the first user because the browser of the last user (second user) didn’t list that first indicator. Similar behavior if you delete an indicator (minemeld will add the indicator again).

I am now adding 200+ indicators to the miner again because of this issue. Looks like Minemeld use the data from the browser to compare the data on the server. Everything that is new is dropped (withdraw) and everything that was deleted is added again based on the data from you browser.

aalmeidasilva commented 6 years ago

Looks like this is a well known limitation in MineMeld. There is a workaround for this issue described here:

https://live.paloaltonetworks.com/t5/MineMeld-Discussions/IP-addresses-disappearing-from-miner/m-p/188686#M1698

jtschichold commented 6 years ago

Hi @aalmeidasilva, yes, please use the stdlib.localDB Miner is more stable and performant. It will subsitute all the existing local Miners in the future release.