Minemeld installation, continued
I cheated/pivoted a little bit - decided to simulate a bit more closely what I'd be using at work. I bootstrapped a CentOS VM and followed the instructions in: https://github.com/PaloAltoNetworks/minemeld-ansible
1sudo yum install -y wget git gcc python-devel libffi-devel openssl-devel zlib-dev sqlite-devel bzip2-devel 2wget https://bootstrap.pypa.io/get-pip.py 3sudo -H python get-pip.py 4sudo -H pip install ansible 5git clone https://github.com/PaloAltoNetworks/minemeld-ansible.git 6cd minemeld-ansible 7ansible-playbook -K -i 127.0.0.1, local.yml 8usermod -a -G minemeld # add your user to minemeld group, useful for development
Everything worked fine - I had to retry the playbook once to get it to run, but the install playbook even enabled/started the requisite services. I'd highly recommend this approach over the OVA - it took me ~ 30 minutes in total to get Minemeld up and running in my lab, including the CentOS ISO download.
Anyone else who is doing this may find it useful to know that the usermod above doesn't grant you login access to minemeld - it has its own credential set. Default credentials are admin|minemeld.
My next objective will be to integrate with my lab firewall using EDLs. Here's a preview of it running without any custom miners - eventually I'd like to mine NSX-T's manager to share object groups between systems.