Using MineMeld with MISP

[vhgambit]

How can I pull the IOCs from MISP to MinMeld Plattform ?

Exist any extension to get the IOCs from MISP ?

[slp-security]

Hi,

First, thanks for your help.

OK I solved the issue.

The API key was not correct...

Regards,

HA

[papham]

Have you ever had this issue ? 

- i clone this prototype as a new node : misp.anyEvent

- added the url and the API key from the GUI 

Do i missed something ? 

[TiagoSantos84]

Hi @papham,

Try to confirm your auth key..

Certificates installed on misp? Do you have a self signed certificate?

But it should be straight forward.

Kind Regards.

[Tony101]

My MISP miner seems to work OK, i'm using the IDS check box as the filter to block IoC's - How do I unblock an IoC, is it as simple as unchecking the IDS box in MISP, will that update the EDL?

[TiagoSantos84]

Hi @Tony101 

It really depends on how the receiver deal with data. There is some platforms that will update the list of IoCs after some amount of time. On the other hand you can try to disable IDS flag on the MISP and delete the IoC on the destination that already receive the IoC as black list.

However, you just need to remove IDS flag if you don't have the enforcewarninglist flag active on the query and if you don't have any warninglist feed active.

Please take a look on this:

• https://github.com/MISP/misp-warninglists
• like this example (credits from Dev Team MISP):

  https://your.misp/attributes/restSearch/returnFormat:suricata/publish_timestamp:15d/enforceWarninglist:1

Hope that you can manage it. It's really hard to deal with false positives!