Using MineMeld with MISP

[vhgambit]

How can I pull the IOCs from MISP to MinMeld Plattform ?

Exist any extension to get the IOCs from MISP ?

[Tony101]

Hi thanks for the previous answer, it was really helpful.. I have another question re the output FEED BASE URL:

appending ?v=mwg&t=regex to the feed base url gives me the format i require e.g..

type=regex
"hxxp://badsite[.]biz/malware.html" "comment"

But what i really want to achieve is an * wildcard at the end of the string e.g.

"hxxp://badsite[.]biz/malware.html*" "comment"

Any ideas if this is do-able?

[Negin-Amou]

Hi

we have recently installed MineMeld on our Linux server and after adding the MISP extension on MineMeld, I don't understand what it means by add your MISP URL. Is this URL found from MISP website or is it a URL we get after installing MISP. Between we haven't installed MISP as well. Is it required for the miner to work ? 

Another question I have is regarding the dynamic lists on MISP website. Do we add them with MISP miner or regular miners can pull them too?

I'm very new to MineMeld and I don't quite understand how to configure nodes. So I would appreciate if you could provide me a sample of a configuration for MISP feeds.

[TiagoSantos84]

Hi,

MISP url is the address of you MISP instance. So you need to install it, create a sync user and put the key of that user in the miner.

Please follow the links provided in previous posts.

Kind regards,

Tiago

[MScoppettuolo]

Hi guys, but

source name, to identify the origin of the indicators inside MineMeld

 Source name is generic? Can i choose every name?