Minemeld configuration via TAXII output to Qradar

macintos — Wed, 12 Feb 2020 16:28:11 GMT

Hi All,

i've been trying to configure the taxiii output in minemeld following the tutorial of Qradar posted here but with no success.

I am running docker minemeld version, everything is fine until i try to add the url: https://hostname/taxii-discovery-service from Qradar TI module and get the following error: There is a problem connecting to the TAXII server. Verify that the TAXII server is available. Get list of collections failed

I ve been using Cabby for service discovery and finds the three services as available but when i try to pool the URL i get the following error:

ERROR: HTTPConnectionPool(host='hostname--https', port=80): Max retries exceeded with url: /taxii-discovery-service (Caused by NewConnectionError('<urllib3.connection.HTTPConnection object at 0x10868d910>: Failed to establish a new connection: [Errno 8] nodename nor servname provided, or not known'))

Basically i am stuck at this point. Any help is much apreciated

Re: Minemeld configuration via TAXII output to Qradar

macintos — Thu, 23 Apr 2020 15:33:21 GMT

Any help with this guys ? I am dead stuck

topic Re: Minemeld configuration via TAXII output to Qradar in General Topics

Minemeld configuration via TAXII output to Qradar

Re: Minemeld configuration via TAXII output to Qradar