topic Re: FS-ISAC New STIX/TAXII Feeds (Resolved) in General Topics

FS-ISAC New STIX/TAXII Feeds

Pedro2020 — Thu, 18 Jun 2020 14:18:03 GMT

Good Morning All,

I am trying to configure our minemeld system to use the new FS-ISAC STIX/TAXII feed but its giving me issues. Has anyone successfully configured Minemeld to pull information from FS-ISAC recently? I added a sample of the config settings that I am using and a screenshot of the error message.

Config Settings

age_out:
default: last_seen+30d
sudden_death: false
attributes:
confidence: 50
share_level: green
collection: <feedname>
discovery_service: <fs-isac discovery service>

Error Message

Re: FS-ISAC New STIX/TAXII Feeds (Resolved)

Pedro2020 — Fri, 19 Jun 2020 17:10:21 GMT

Issue resolved by following the link below.

https://github.com/PaloAltoNetworks/minemeld-core/issues/371#issue-642113566

Re: FS-ISAC New STIX/TAXII Feeds (Resolved)

lmori — Wed, 24 Jun 2020 12:59:41 GMT

I have improved the minemeld-taxii-ng extension to improve compatibility with FS-ISAC feeds. You can do this to configure your MineMeld for FS-ISAC:

In System, click on Extensions tab and click on "git"
Use https://github.com/PaloAltoNetworks/minemeld-taxii-ng.git as Repository URL and click Retrieve. Select 0.2a4 as version (or greater). Click Install
Activate the extension
in System, Dashboard restart the API
Now we need to create a prototype, click on Config and then the hamburger icon at the bottom right
Search for the taxiing.phishtank prototype
Click on NEW
Change the configuration removine username and password, and inserting the STIXv1 collection name and TAXII discovery service URL. Click OK when done.
Create a new node from the new prototype by clicking on CLONE. And Commit the config.
Once the engine has restart, click on Nodes and the new Miner. Configure Username and Password for the feed and then click the poll icon

Re: FS-ISAC New STIX/TAXII Feeds (Resolved)

SaiLakshmi — Wed, 01 Jul 2020 14:45:02 GMT

Hi Sir,

We are trying to integrate FS-ISAC threat feeds into Minemeld instance. In the 4th Step,you mentioned to restart the API. I did the same and got Bad Gateway error. I thought of logging out and logging in back again to see if that resolves the issue. However, after logging out of the instance, it is not allowing me to login back again. I am still getting Bad Gateway error. Requesting your quick help here as we have critical data in Minemeld and it is not working.

Re: FS-ISAC New STIX/TAXII Feeds (Resolved)

lmori — Wed, 01 Jul 2020 15:39:17 GMT

Could you check /opt/minemeld/log/minemeld-web.log for errors?

If you don't see anything and you want to quickly restore try this:

/opt/minemeld/engine/current/bin/pip uninstall minemeld_taxii_ng

and then restart the instance

Re: FS-ISAC New STIX/TAXII Feeds (Resolved)

SaiLakshmi — Wed, 01 Jul 2020 16:15:28 GMT

Hi,

Thanks for the quick turn around, I have attached minemeld-web.log to this case. I have removed most of the unnecessary logs and attached the ones that are required for this case. Can you have a look at it and let me know how to proceed further?

Re: FS-ISAC New STIX/TAXII Feeds (Resolved)

lmori — Wed, 01 Jul 2020 16:19:14 GMT

I think the problem is that you are running a pretty old version of MineMeld (0.9.52.post1) and I didn't set the right constraint in the extension.

I would go ahead and uninstall minemeld-taxii-ng using my instructions above.

After upgrading your MineMeld version to a recent one, you will be able to use the extension.

Re: FS-ISAC New STIX/TAXII Feeds (Resolved)

SaiLakshmi — Thu, 02 Jul 2020 04:30:11 GMT

sure, I will try that. Can you give me the instructions for upgrading the MineMeld

Re: FS-ISAC New STIX/TAXII Feeds (Resolved)

SaiLakshmi — Thu, 02 Jul 2020 05:01:08 GMT

I am running ubuntu 14.04.5 LTS, do you suggest to upgrade that as well? if yes, to which version do you suggest to upgrade?

can you give me the instructions on how do I upgrade latest version of Minemeld on Compatible Ubuntu version?

Re: FS-ISAC New STIX/TAXII Feeds (Resolved)

SaiLakshmi — Thu, 02 Jul 2020 09:31:10 GMT

While Trying to uninstall minemeld_taxii_ng, I got the below error.

ubuntu@ip-addresss:/opt/minemeld/engine/current/bin$ pip uninstall minemeld_taxii_ng
Cannot uninstall requirement minemeld-taxii-ng, not installed
Storing debug log for failure in /home/ubuntu/.pip/pip.log

Requesting your help to resolve the error

Re: FS-ISAC New STIX/TAXII Feeds (Resolved)

SaiLakshmi — Sat, 04 Jul 2020 15:11:31 GMT

@lmori did you get a chance to look into this?

Re: FS-ISAC New STIX/TAXII Feeds (Resolved)

SaiLakshmi — Sat, 04 Jul 2020 15:23:02 GMT

@lmori did you get a chance to look into this?

Re: FS-ISAC New STIX/TAXII Feeds (Resolved)

RemiUnum — Fri, 10 Jul 2020 14:38:38 GMT

@SaiLakshmi I was not sure if your question about the Ubuntu OS version was answered. Minemeld works best on Ubuntu 16. Got it running on Ubuntu 16.04.6 LTS server with no problems at all.

Re: FS-ISAC New STIX/TAXII Feeds (Resolved)

fwmike2 — Tue, 08 Dec 2020 18:43:34 GMT

@lmori , there seems to be a possible UI bug with this extension. Sometimes the NODE SETTINGS are not displayed in Chrome and this makes configuring the Username and Password fields impossible. Safari and FF do not seem to have the issue.

MM: 0.9.70

minemeld-taxii-ng: 0.2a4 but also in earlier releases

Chrome: 87.04280.88

FF: 82.03

macOS: 10.15.7

Thanks,

-Mike

Re: FS-ISAC New STIX/TAXII Feeds

ksauer507 — Fri, 21 May 2021 20:28:47 GMT

I need help configuring this. We signed up and the doc they gave us has a Discovery Service, Collection Service, and Poll Serivce URL for TAXII 1.1, 2.0 and 2.1.

Which version do we use? When you say collection: <feedname> what do you put there, the collection service url beginning with https ? Or do you have to pick one of the TAXII1.x collection names (there are 11, 3 are not applicable though legacy,test,na).