MineMeld whitelist not working

Reply
L1 Bithead

MineMeld whitelist not working

Hello,

 

I have the problem that minemeld whitelists don't seem to work on our self-hosted minemeld version.

 

I have the following setup:Capture.PNGremoved miner names for privacy reasons

The wlDomeinAggregator contains a few domainnames, so they should be removed from the CEF output node.

 

When investigating the issue I found out that no 'withdraw' event is triggered in the CEF node when a new whitelist entry is added. I am wondering why this doesn't happen. When an input miner(for example feodetrackr removes an IP) removes an IOC a 'withdraw' event is triggered for that IP.

 

I tried different setups. I tried adding the input node(generic domain list) to the domainaggregator directly. I tried the localdb miner. Nothing seems to work.

 

Help would be appreciated.

 

Best regards,

 

Folmer

L1 Bithead

Re: MineMeld whitelist not working

I think I found a solution to this:

First of all I deleted rabbitmq, it is not necesarry anymore. After that I changed the requirements.txt(/<mm dir>/engine/core) file so newer versions are used:

pip>=9.0.1
amqp==2.5.0
gevent==1.1.1
greenlet==0.4.15
hiredis==0.2.0
PyYAML==3.11
redis==2.10.6
requests==2.20.0
plyvel==0.9
netaddr==0.7.18
antlr4-python2-runtime==4.5.2
jmespath==0.7.1
click==4.1
pan-python==0.10.0
stix==1.2.0.6
cybox==2.1.0.17
six==1.11.0
lxml==4.1.0
stix-edh==1.0.1
libtaxii==1.1.113
pytz==2015.4
certifi
ujson==1.34
filelock==2.0.4
sleekxmpp==1.3.1
beautifulsoup4==4.4.1
cifsdk==2.0.0b7
lz4==0.8.2
networkx==1.11
unicodecsv==0.14.1
Werkzeug==0.12.2
pyzmq==18.0.1

 

After that cd /<mm dir>/engine/core && /<mm dir>/engine/current/bin/python setup.py install.

 

For me this seems to work on RedHat 7.6. You can remove traced logs by either mm-traced-purge --all or rm -rf /<mm dir>/local/traced. Restart minemeld with 'service minemeld restart'.

 

Maybe it is a good idea to update the requirements in the git repository?

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!