How do you setup FS-ISAC STIX/TAXII feeds to minemeld?

ksauer507 — Fri, 28 May 2021 20:42:51 GMT

I was following this thread here:

https://live.paloaltonetworks.com/t5/minemeld-discussions/fs-isac-new-stix-taxii-feeds/td-p/334068

But nobody responded to my question so I'm starting a new thread hopefully to gain some visibility. We've upped our membership with FS-ISAC which comes with an added annual fee, so being that we are paying for this service we want to get it to work with minemeld so we can have dynamic lists pushed into PA firewalls.

If you look at the thread I posted above you can see some configuration guidance, however, a lot of the details are blurred out. I have a quick reference guide from FS-ISAC and it shows 3 URL's for 3 different versions of TAXII.

TAXII 1.1

- Discovery Service

- Collection Service

- Poll Serivce

TAXII 2.0

- Discovery Service

- Collection Service

- Poll Serivce

TAXII 2.1

- Discovery Service

- Collection Service

- Poll Serivce

My first question is which URL(s) am I supposed to use? Which version and which one (Discovery, Collection or poll)?

Next on the second page they have whats called FS-ISAC STIX/TAXII Collections (as of August 4, 2020). They have TAXII1.0 collection names in plain englisth, like automated-high-gw for example. They also have a column for TAXII2.x Collection ID which looks more like a long GUID identifier than anything legible. Finally the third column is a description.

Am I supposed to pick one of these and put its Collection Name and / or ID somewhere? How do you know which one to pick? Something like curated-ragw says "Group packages containing analyst-created cyber threat intelligence with TLP values RED,AMBER,GREEN, and WHITE". Would that be a good one?

Whatever I've tried I just get an error timed out in the last run column in minemeld. I even waited a week for FS-ISAC to get our IP addresses in their ip whitelist.

Appreciate any help you have.

Re: How do you setup FS-ISAC STIX/TAXII feeds to minemeld?

ksauer507 — Tue, 08 Jun 2021 20:20:30 GMT

Wow I must have stumped this forum, or maybe the start of summer everyone is out on vacation or something.

Re: How do you setup FS-ISAC STIX/TAXII feeds to minemeld?

lmori — Mon, 07 Mar 2022 14:46:39 GMT

@ksauer507 you should use the URL of TAXII 1.1 discovery service, and use the TAXII 1.1 collection names.

topic How do you setup FS-ISAC STIX/TAXII feeds to minemeld? in General Topics

How do you setup FS-ISAC STIX/TAXII feeds to minemeld?

Re: How do you setup FS-ISAC STIX/TAXII feeds to minemeld?

Re: How do you setup FS-ISAC STIX/TAXII feeds to minemeld?