First_Seen Error

[micmel5997]

I am getting a weird error when using a miner to pull in Talos and Firehol threat feeds. It worked fine in my test environment, but in my actual deployment after the initial retrieval anytime the node runs it gets an error. When I hover over this all it states is 'first_seen.'

This traffic goes through the Palo Alto's and I have turned off URL filtering/SSL Decryption from the Minemeld server but this didn't help. The traffic is not going through a Proxy.

[jtschichold]

Hi @micmel5997,
when did you install MineMeld? There was a bug related to this and it was fixed couple of weeks ago. (See PaloAltoNetworks/minemeld-core#343)

Luigi