Minemeld TAXII ISAC

Xavi_Gil — Wed, 30 May 2018 16:10:16 GMT

Hi all,

I have the way to get feeds from ISAC with a TAXII prototype and I want to share with you all. Proabably it can help someone.

Firstly it's necessary to import the minemeld-taxii-ng extension on system>extensions and install extension from git, and activate it,

https://github.com/PaloAltoNetworks/minemeld-taxii-ng.git

Then, clone the taxiing.phishtank prototype and add your user account (collection, discover_service, user and password) with no verify cert param,

age_out:
default: last_seen+30d
sudden_death: false
collection: XXXX-ISAC
discovery_service: https://taxii.XXXX.com/taxii/discovery
password: --------------------
username: ----------
verify_cert: false

The result,

I hope you find it interesting!

Regards,

Re: Minemeld TAXII ISAC

Hugh.Kelley — Tue, 25 Dec 2018 22:53:18 GMT

Thank you. I had imported the extension but didn't realize that "taxiing.phishtank" was the prototype name I should use. Now that you mention it, I see it in taxiing/prototypes/taxiing.yml, but it would be helpful to mention it in the GitHub readme too.

topic Minemeld TAXII ISAC in General Topics

Minemeld TAXII ISAC

Re: Minemeld TAXII ISAC