AlienVault taxii miner versus prebuilt reputation data miner

[chirss]

AlientVault has the OTX with a taxii feed configuration which looks like it could be handy. However the miner for the alienvault reputation has a link which 404's. Does anyone have any idea if this overlaps?

Also the AlienVault taxii feed would require an API key, I'm not entirely sure how to set up a new miner for taxii which requires an API key.

[chirss]

I'm back on this, a year later. Trying to relate subscribing to a person or pulse to how it gets pulled by the miner, if it does.

[Carlos_Gomes]

Just followed the directions here and on mine the miner under nodes where i go to set the API key then asks for password? But there is no password and it will not work. What would i enter there?

[Carlos_Gomes]

Got this workind. any txt will do it will be ignored anyways. Go figure.

Has anyone successfully stripped http and https from a taxii Feed so that PaloAlto FWs can block those URLs? Currently aggregating the URLs into an output works and PAs can pull them into EDLs however it is pulling them with http and https which PAs then are not able to block those objects, according to PA article any url object cannot contain http:// or https://

I found the example here https://live.paloaltonetworks.com/t5/MineMeld-Articles/Using-MineMeld-to-Create-a-Custom-Miner/tac-p...

It shows how to do it against a csv/txt list but i have not been able to find it for the taxi client feed. I applied the same terminology but that did not work. Anyone else has been able to do this and can share some insight?

[joris_vd]

Hi,

In the EDL Create List window on the firewall you can add the "Source"...

It should be like this :      https://minemeldserver.internal/feeds/OTXURLOutput?v=panosurl

Cheers

Joris

[Carlos_Gomes]

@joris_vd thank you for responding however i have that part done it is not what i am asking. What i am asking is how you can have minemeld strip the http and https from the list of indicators as the PaloAlto firewalls are ingesting the list containing http and https for all urls and it is not supported, it needs to be just like google.com for example rather than what minemeld list is holding http://google.com

With a txt/csv file minemeld feed you can manipulate it and tell it to drop the http and https from all URL indicators however i have not been able to find it for taxifeed.

[Carlos_Gomes]

sorry @joris_vd i didnt initially understand what you were saying. But after reading this https://live.paloaltonetworks.com/t5/MineMeld-Articles/Parameters-for-the-output-feeds/ta-p/146170 

i did and it works like a charm.

[Carlos_Gomes]

Actually to add @joris_vd @lmori it appears that minemeld is now broken with Alienvault taxii feeds. I am getting SSLV3 handshake errors and no longer can pull. I have upgraded to latest version 0.9.64 and still not working.