Minemeld installation, continued

I cheated/pivoted a little bit - decided to simulate a bit more closely what I'd be using at work. I bootstrapped a CentOS VM and followed the instructions in: https://github.com/PaloAltoNetworks/minemeld-ansible

1sudo yum install -y wget git gcc python-devel libffi-devel openssl-devel zlib-dev sqlite-devel bzip2-devel  
2wget https://bootstrap.pypa.io/get-pip.py  
3sudo -H python get-pip.py  
4sudo -H pip install ansible  
5git clone https://github.com/PaloAltoNetworks/minemeld-ansible.git  
6cd minemeld-ansible  
7ansible-playbook -K -i 127.0.0.1, local.yml  
8usermod -a -G minemeld  # add your user to minemeld group, useful for development  

Everything worked fine - I had to retry the playbook once to get it to run, but the install playbook even enabled/started the requisite services. I'd highly recommend this approach over the OVA - it took me ~ 30 minutes in total to get Minemeld up and running in my lab, including the CentOS ISO download.

Anyone else who is doing this may find it useful to know that the usermod above doesn't grant you login access to minemeld - it has its own credential set. Default credentials are admin|minemeld.

My next objective will be to integrate with my lab firewall using EDLs. Here's a preview of it running without any custom miners - eventually I'd like to mine NSX-T's manager to share object groups between systems.