topic MS-ISAC TAXII Feeds in General Topics

MS-ISAC TAXII Feeds

ngagne — Thu, 24 Jun 2021 12:25:02 GMT

Is anyone successfully consuming TAXII feeds from MS-ISAC, specifically, their feeds from taxii-pilot.cisecurity.org? The miner shows success and there are log entries for indicators, but there are no indicators in the counters or graphs.

Re: MS-ISAC TAXII Feeds

ycgmis — Thu, 08 Jul 2021 21:11:43 GMT

I'm working on this now also, let me know if you find success. I'll let you know if I figure out.

Re: MS-ISAC TAXII Feeds

ycgmis — Tue, 20 Jul 2021 16:52:02 GMT

I'm seeing the same issue you are. I've also stood up anomali staxx and am seeing something similar there. It sees the feeds but no observables.

Re: MS-ISAC TAXII Feeds

kvbyal — Wed, 20 Oct 2021 21:55:49 GMT

I am running into the same issue mentioned above with minemeld and staxx. Did either of you find a resolution?

Re: MS-ISAC TAXII Feeds

ngagne — Thu, 21 Oct 2021 11:58:50 GMT

Nope. Minemeld seems to be pretty much dead at this point so there's no point for us in spending time to get it working.

Re: MS-ISAC TAXII Feeds

ycgmis — Thu, 21 Oct 2021 12:30:35 GMT

I reached out to CISA for support. I explained that I was seeing the same issue on two different systems. They pretty much told me I was on my own. The problem I really have is trying to get a straight answer on the intelligence sources. DHS maintains a list, CISA maintains a list and MSISAC now maintains a list. I could never get a straight answer if these are all the same or if there is any overlap. Right now I get DHS and MSISAC. I've given up on CISA's list. MSISACs hosted list is the same as what they send out weekly in spreadsheet form.

Re: MS-ISAC TAXII Feeds

kvbyal — Thu, 21 Oct 2021 16:33:29 GMT

Ycgmis, how did you get MS-ISAC observables in Anomali STAXX? I am having the same issue you posted about in July where everything looks to be configured correctly but the poll never returns any observables.

Re: MS-ISAC TAXII Feeds

ycgmis — Thu, 21 Oct 2021 17:00:58 GMT

I didn't, these are acutally coming from CISA not MSISAC. The MSISAC hosted intel is just a URL to a text file. The CISA list just gives me the lists with no data. Automated Indicator Sharing | CISA

Re: MS-ISAC TAXII Feeds

MatthewJenkins — Thu, 11 May 2023 23:00:21 GMT

I have looked and am unable to find the text feed from MSISAC. I can only find the STIX and TAXII feeds. Can you provide a link to the text file option? Thanks!