topic Re: Multiple TAXII outputs within a single minemeld instance? in General Topics

Multiple TAXII outputs within a single minemeld instance?

chtoh82 — Thu, 10 May 2018 03:58:52 GMT

Hi,

If I have a configuration of 2 taxii outputs within a node, the output feed discovery service url for both taxii output nodes are the same, in this case, how do we differentiate them? Would authentication with Tags helps? Thanks!

Re: Multiple TAXII outputs within a single minemeld instance?

Simon_10 — Fri, 05 Mar 2021 13:57:43 GMT

Hi Chtoh82,

I have the same problem. Did you find a solution?

Thanks in advance.

Re: Multiple TAXII outputs within a single minemeld instance?

lmori — Fri, 05 Mar 2021 14:12:10 GMT

In TAXII you don't need a URL per feed, the TAXII Client interrogates the TAXII Discovery Service to discover the available services and then the client interrogates the TAXII Collection Management Service (whose URL is returned by the TAXII Discovery Service) to list the available Data Feeds.

So basically yes, MineMeld does support multiple output TAXII Data Feeds and you just need one URL to access them all. Based on authorization configs (TAGS) different users will see different available feeds.

Re: Multiple TAXII outputs within a single minemeld instance?

Simon_10 — Fri, 05 Mar 2021 14:16:20 GMT

Hi Lmori,

Many thanks for the the clarification!