topic Intergrading Minemeld into McAfee ESM SIEM in General Topics

Intergrading Minemeld into McAfee ESM SIEM

john_chua — Fri, 08 Dec 2017 23:37:52 GMT

My name is john , i am quite new to Minemeld but i am also using McAfee ESM . can anyone teach me step by step , on how i can intergradeMinemeld into SIEM ? i hope to hearfrom you guys soon.

with regards,

John

Re: Intergrading Minemeld into McAfee ESM SIEM

lmori — Tue, 26 Dec 2017 07:55:18 GMT

Hi @john_chua,

you should a TAXII output on MineMeld to connect to the McAfee SIEM. You can see the McAfee configuration here: https://live.paloaltonetworks.com/twzvq79624/board/message?board.id=MineMeldDiscussions&message.id=307#M307

Thanks,

luigi

Re: Intergrading Minemeld into McAfee ESM SIEM

SharadAwasthi — Tue, 22 May 2018 13:45:34 GMT

Hi Imori,

My name is Sharad and I am also trying to integrate MineMeld with McAfee ESM. I have gone through the vasious posts on the community for this integration which were helpful. But, while integrating it give the below error:

"Error issuing TAXII request, HTTP response code: 400: Invalid message, unknown feed".

Can you please help to resolve this as I am not able to find any mention for this error on this community.

Output feed details:

DISCOVERY SERVICE

http://<MineMeld>/taxii-discovery-service

CLASS	minemeld.ft.taxii.DataFeed
PROTOTYPE	stdlib.taxiiDataFeed

Please let me know if you need any further details.

Thanks in advance.

Sharad Awasthi