Questions for Brian 3/5/2020

[TalonF]

• Picture of the Diagram (make sure it is accurate)
• Is there any way to measure a 7-day metric before and after we implement the API fix for the 15 minutes updates. To see if inbound traffic is affected by our change.
• Make sure we have a good understanding of the University of Nebraska Palo Alto and the CIF setup is accurate.
• Are these IPs being temporary blocked or permanently blocked? Are they being flushed ever?
• CIF environment issues and unable to use (if time allows)

[skyemakable]

Notes from the meeting today

---

• Picture of the Diagram (make sure it is accurate)

  • One cif server in Lincoln (one v2 Brian is using and one v3 used in production)
  • Palo Altos in diagram are good
  • Cronjob – it exists in one system that pulls from duke and sits on a server. It pulls in feeds from duke and parses it out and puts on CIF for palo alto to ingest.
  • Palo Alto – from each have to tell them to pull from cif server for feeds

• Is there any way to measure a 7-day metric before and after we implement the API fix for the 15 minutes updates? To see if inbound traffic is affected by our change.

  • Just a report to set up in palo alto then implement new rule in palo alto and give priority. Can do by ips threat.

• Make sure we have a good understanding of the University of Nebraska Palo Alto and the CIF setup is accurate.

  • Give palo alto url like http://x.x.x.x:9000/cif_ip.txt/ for palo alto to pull feeds from
  • But issue is about the secure header, like to point to the api instead of the url?
  • Could have an open API for the palo alto and just have permissions on CIF to only allow palo alto to get feeds?
  • Alan.nelson@nebraska.edu
  • Contact him (CC brian) to ask about this (have example set up)
  • Ask about working together the CIF and palo alto APIs
  • CIF should be handling any duplicates that come in

• Are these IPs being temporary blocked or permanently blocked? Are they being flushed ever?

  • Holds data by month
  • Can set up cronjobs to purge every 3-6 months to purge database
  • Pruning elastic database (can’t have too much data or it breaks)
  • On CIFv3 there isn’t anything set up for purging (v2 may have it)

• CIF environment issues and unable to use (if time allows)

• Can make yml file where other feeds are, give it a token, and parser would be cif.

  • Specify different feeds to pull in from. Can use v3 to push feeds to each other.

• Could set up cron job to restart v3 server every morning at 6am to fix login issue