topic Re: Anomali Limo Miner Creation in General Topics

Anomali Limo Miner Creation

Jon-Irish — Thu, 12 Jul 2018 18:27:01 GMT

Hello,

First, I am not a programmer, so please keep that in mind 😉 I would like to create a miner for the Anomali Limo TAXII feed. The Anomali documentation is not very good:

You can also get the benefits of Limo without STAXX. Simply:

Configure your TAXII client to point to: https://limo.anomali.com/api/v1/taxii/taxii-discovery-service/
or for STIX/TAXII 2.0 clients: https://limo.anomali.com/taxii
Use guest/guest as username and password
Select which feeds you’d like to access

This doesn't really explain much. If I go to: https://limo.anomali.com/taxii and authenticate, I get this back:

Thus, I am really not sure how I would use any of this information. I was expecting to see data with headers and such. Not only don't I get those, I don't see the feed names themselves as suggested in the Anomali documentation. Thus, I am really not sure how to proceed from here.

Any help would be greatly appreciated!

Jon

Re: Anomali Limo Miner Creation

xhoms — Fri, 13 Jul 2018 06:16:22 GMT

@Jon-Irish,

you just have to create a new TaxiiClient class based prototype and clone it into your engine as a working node.

To create a new TaxiiClient prototype you can use any other TaxiiClient prototype as the base. For example, you can use any from the "hailataxii" series.

Change the "discovery_service" and "collection" class configuration parameters to fit your need. In your case:

discovery_service = https://limo.anomali.com/api/v1/taxii/taxii-discovery-service/
collection: any from the following list:
- Abuse_ch_Ransomware_IPs_F135
- Abuse_ch_Ransomware_Domains_F136
- DShield_Scanning_IPs_F150
- Lehigh_Malwaredomains_F33
- CyberCrime_F41
- Emerging_Threats_C_C_Server_F31
- Malware_Domain_List___Hotlist_F200
- Phish_Tank_F107
- Emerging_Threats___Compromised_F68
- Blutmagie_TOR_Nodes_F209
- Anomali_Weekly_Threat_Briefing_S1

(the list was captured today with the cabby command "taxii-collections --path https://limo.anomali.com/api/v1/taxii/collection_management/ --username guest --password guest")

Re: Anomali Limo Miner Creation

Jon-Irish — Fri, 13 Jul 2018 13:55:00 GMT

Thanks for the great reply! Is it possible to have more than one collection in a miner?

Re: Anomali Limo Miner Creation

Jon-Irish — Fri, 13 Jul 2018 14:52:39 GMT

I was able to get the "cabby"docker image working and I replicated your findings. Thanks for pointing this out to me! My only other question is, can I have mor ethan one collection in a data miner?

Thanks!

Jon

Re: Anomali Limo Miner Creation

Jon-Irish — Fri, 13 Jul 2018 15:09:11 GMT

Another thing that I am noticing is that I am not pulling any indicators. Here is the config for the poller:

minemeldlocal.anomali_limo_feed PROTOTYPE

MINER

EXPERIMENTAL

ABOUT minemeldlocal

Local prototype library managed via MineMeld WebUI

ABOUT minemeldlocal.anomali_limo_feed

Anomali Limo data feed

CLASS

minemeld.ft.taxii.TaxiiClient

INDICATOR TYPES

IPv4IPv6domainURL

CONFIG

age_out	default: last_seen+30d sudden_death: false
attributes	confidence: 30 share_level: green
collection	Anomali_Weekly_Threat_Briefing_S1
discovery_service	https://limo.anomali.com/api/v1/taxii/taxii-discovery-service/
password	guest
source_name	limo.anomali.com
username	guest

If I then go to the Nodes view and look at the node, it shows it successfully polling, but no indicators. I must have done something wrong.

anomali_limo_feed NODE

STATUS

CLASS	minemeld.ft.taxii.TaxiiClient
PROTOTYPE	minemeldlocal.anomali_limo_feed
STATE	STARTED
USERNAME	guest
PASSWORD
SERVER CA	Not set
LAST RUN	2018-07-13 10:03:29 -0500 SUCCESS
# INDICATORS	0

OUTPUT	ENABLED
INPUTS	none

Re: Anomali Limo Miner Creation

xhoms — Mon, 23 Jul 2018 09:09:57 GMT

Hi @Jon-Irish,

yes, you're right. Something is wrong. But not on your end (neither on mine) but on Anomali's one.

Using Cabby (instead of MineMeld) to poll the indicators also rise an exception.

<ord guest --discovery https://limo.anomali.com/api/v1/taxii/taxii-discovery-service/ --collection Anomali_Weekly_Threat_Briefing_S1                                                                
2018-07-23 09:07:25,668 INFO: Polling using data binding: ALL
2018-07-23 09:07:25,672 INFO: Sending Discovery_Request to https://limo.anomali.com/api/v1/taxii/taxii-discovery-service/
2018-07-23 09:07:26,569 INFO: 4 services discovered
2018-07-23 09:07:26,571 INFO: Sending Poll_Request to https://limo.anomali.com/api/v1/taxii/poll/
2018-07-23 09:07:27,432 ERROR: HTTP Error: status code 400

I'll try later on to troubleshoot what's wrong in their API.

Re: Anomali Limo Miner Creation

Jon-Irish — Mon, 23 Jul 2018 11:54:52 GMT

Thanks for the update @xhoms... It is good to know that it isn't something that I did wrong.

topic Re: Anomali Limo Miner Creation in General Topics

Anomali Limo Miner Creation

Re: Anomali Limo Miner Creation

Re: Anomali Limo Miner Creation

Re: Anomali Limo Miner Creation

Re: Anomali Limo Miner Creation

minemeldlocal.anomali_limo_feed PROTOTYPE

MINER

EXPERIMENTAL

ABOUT minemeldlocal

ABOUT minemeldlocal.anomali_limo_feed

CLASS

INDICATOR TYPES

TAGS

CONFIG

anomali_limo_feed NODE

STATUS

Re: Anomali Limo Miner Creation

Re: Anomali Limo Miner Creation