topic Re: How to configure MineMeld to forward Logs to RSA Security Analytics in General Topics

How to configure MineMeld to forward Logs to RSA Security Analytics

vhgambit — Thu, 15 Jun 2017 23:35:45 GMT

I want to forward the output of output nodes in minemeld to SIEM, I want to see the output indicators in Security Analytics to create rules and when an indicator match generate an alert, actually I have configured PaloAlto Firrewalls with Dynamic List but I would like to send output indicators to SIEM

Re: How to configure MineMeld to forward Logs to RSA Security Analytics

lmori — Mon, 19 Jun 2017 12:55:32 GMT

Hi @vhgambit,

you could try 2 methods:

use the CEF extension for MineMeld to generate indicators in CEF format and forward them to RSA (https://github.com/PaloAltoNetworks/minemeld-cef)
starting from 0.9.40, MineMeld supports generating feeds in CSV format. RSA Security Analytics should be able to ingest feeds in CSV (https://community.rsa.com/docs/DOC-54891)

Re: How to configure MineMeld to forward Logs to RSA Security Analytics

vhgambit — Wed, 21 Jun 2017 21:55:51 GMT

Hi Imori thank a lot for your quick response.

In fact I already install CEF extension, and I can create a node with this output

CLASS mmcef.node.Output

PROTOTYPE cef.testCEF

STATE started

# INDICATORS 938

But this node doesn´t not give me a list or other information, I just can see all LOGS of this output in the upper right corner.

What´s next from here, I didn´t find information about that; how can I forward this output to RSA or Where does this logs are stored to see if I can get them and send to RSA

Greetings

Re: How to configure MineMeld to forward Logs to RSA Security Analytics

lmori — Thu, 22 Jun 2017 16:25:07 GMT

Hi @vhgambit,

you should customize the cef.testCEF prototype to specify the host, port and protocol to communicate with your RSA SIEM.

You can do this by:

- click on CONFIG

- click on the hamburger icon in the bottom right corner

- search for testCEF and click on it

- click on NEW (not CLONE)

- modify the config and specify host, port and protocol of the SIEM

- click OK

- create a new output node with the new prototype