topic Re: How to use a Taxi Output for SIEM ingestion when MM is hosted by Autofocus in General Topics

How to use a Taxi Output for SIEM ingestion when MM is hosted by Autofocus

sburgin — Mon, 02 Oct 2017 16:27:01 GMT

We have a taxi output in MM that is hosted by Autofocus. Wasn’t able to find a doc on how to pull the stix/taxi feed from MM to a SIEM (Splunk) when its hosted by us.

Anyone done this?

Re: How to use a Taxi Output for SIEM ingestion when MM is hosted by Autofocus

Retired Member — Tue, 03 Oct 2017 22:49:27 GMT

Hi,

For Splunk, you might be looking for this http://docs.splunk.com/Documentation/ES/4.7.2/Admin/Downloadthreatfeed

The output node has the definition of the Taxii feed which in this case is a discovery service.

Regards,

Bertrand

Re: How to use a Taxi Output for SIEM ingestion when MM is hosted by Autofocus

lmori — Wed, 04 Oct 2017 22:47:33 GMT

Also there is this really interesting series of blog posts from @soc_enav on integrating MineMeld and Splunk:

https://scubarda.wordpress.com/2017/07/28/minemeld-threat-intelligence-automation-architecture-and-hardening/

luigi