topic Re: MineMeld into Proofpoint TRAP in General Topics

MineMeld into Proofpoint TRAP

Romans6 — Thu, 29 Aug 2019 21:10:04 GMT

I am trying to integrate MineMeld and Proofpoint TRAP. It should be relatively simple and feel I am overlooking something.

The first step was easy. Create an output using stdlib.taxiiDataFeed.

Because this is the community edition auth is turned off by default. (Leaving this off until things are working)

In TRAP you have the following fields:

URL:
https://url.to.minemeld.com/taxii-discovery-service

Feed:
Unique_IP_taxiiDataFeed

TAXII version:
TAXII 1.x

Confidence:
USE STIX

Poll Interval:
Interval Here

Require Auth:
Not Checked (For Now)

Select SSL Client Cert:
None (For Now)

Error: Invalid username or password

Postman works great after turning off SSL verification.
I even change the URL to https://url.to.minemeld.com/taxii-poll-service to no avail.

Re: MineMeld into Proofpoint TRAP

ACMENEWS — Fri, 11 Oct 2019 16:42:18 GMT

For what it is worth, it can be made to work. ProofPoint TRAP has a few issues. You will need to build trust on TRAP of the MineMeld root CA (trust the certificate), set TRAP to poll at 1 hour, not 1 minute, or you will periodically consume all RAM within TRAP and then TRAP will fail. TRAP will stop polling with no indication that it has failed. The feeds will have green icons indicating feeds are updating, though the logs clearly show no activity. This requires watching and rebooting TRAP.

I don 't currently have access to the TRAP box. If I did, I'd share the config. One thing that was more stable was to create an output feed in MineMeld that was a simple HTTP plain text output feed. TRAP appeared to handle that type of a feed with less issues.