For details on cookie usage on our site, read our Privacy Policy
DHS AIS Miner
- LIVEcommunity
- Discussions
- General Topics
- DHS AIS Miner
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Printer Friendly Page
DHS AIS Miner
- Mark as New
- Subscribe to RSS Feed
- Permalink
04-19-2018 12:08 PM
Has anyone gotted the DHS AIS Miner working in MineMeld? We have an account with DHS and I configured the Miner with our subscription id as well as our certs. The miner shows all green (see attached screen-shtot), but I am not getting any indicators. Not sure what I am doing wrong, and DHS doesn't support MineMeld. I noticed that Unit 42 wrote the prototype, so I was hoping one of them might be able to answer my post and point me in the right direction.
TIA,
Jon
- Mark as New
- Subscribe to RSS Feed
- Permalink
05-04-2018 01:22 AM
Hi @Jon_Irish,
if you click on the stats of the Miner, do you see error counters incrementing?
luigi
- Mark as New
- Subscribe to RSS Feed
- Permalink
05-07-2018 05:52 AM
Hi Luigi,
No, the error counters typically stay at 2 or 4 and never move from there. I am working with Dan James on this, and it appears that the feed we are getting from DHS has ACS/ISA markings, and MineMeld does not support them. Dan is working on some new code to add the support and he was able to get a subscription to the feed in question, so I think that we will probably get this working shortly.
Jon
- Mark as New
- Subscribe to RSS Feed
- Permalink
05-07-2018 07:51 AM
Hi John how was the integration setup? Are you only pulling data or you are pushing data too. Could you provide quick summary? Cert sharing setup etc.
- Mark as New
- Subscribe to RSS Feed
- Permalink
05-07-2018 08:02 AM
Hello,
Currently we do not have this working. As soon as we get it working, DHS has asked me to write documentation for the process. I will also try to remember to post the write up here as well.
- Panorama Collector Log Forwarding not working in Panorama Discussions
- Session end reason threat traffic allow in General Topics
- Using minemeld to whitelist Oracle Cloud IP ranges? in General Topics
- Prototype and Miner for IPv6 Lists in General Topics
- MISP - Filter events/attributes in General Topics
Show your appreciation!
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
