topic Cannot retrieve indicators from FS-ISAC feed in General Topics

Cannot retrieve indicators from FS-ISAC feed

benime — Tue, 23 Oct 2018 23:30:55 GMT

I recently created a feed over at FS-ISAC for my organization, and I'm able to connect successfully from within MineMeld, however I am not receiving any indicators. My initial_interval is set to 30d and when I test using 'taxii-poll' from the shell I'm able to retrieve indicators that way, so I know the feed I'm publishing is working, but MineMeld shows 0 indicators. Any ideas where to look next? I've checked the engine logs and there are no errors, and the miner has zero logs.

Re: Cannot retrieve indicators from FS-ISAC feed

benime — Wed, 24 Oct 2018 16:07:25 GMT

So, here's the configuration of my TaxiiClient prototype:

age_out:
    default: last_seen+30d
    sudden_death: false
attributes:
    confidence: 100
    share_level: green
client_cert_required: true
collection: <user.feed>
discovery_service: https://analysis.fsisac.com/taxii-discovery-service
initial_interval: 30d
source_name: fsisac.<user.feed>

I've tried this with both last_seen+30d and null, as well as varying initial_interval and setting the feed in FS-ISAC to only IP Watchlist and Indicators, just in case it was an issue parsing certain items, but it still retrieves 0 indicators.

Re: Cannot retrieve indicators from FS-ISAC feed

benime — Mon, 29 Oct 2018 17:43:44 GMT

After turning on verbose logging, I was able to see what was happening when MineMeld retrieved my feed from FS-ISAC. Ultimately, I solved the problem by publishing a feed containing 'observables' and not just indicators.