FS-ISAC New STIX/TAXII Feeds

[Pedro2020]

Good Morning All,

I am trying to configure our minemeld system to use the new FS-ISAC STIX/TAXII feed but its giving me issues. Has anyone successfully configured Minemeld to pull information from FS-ISAC recently? I added a sample of the config settings that I am using and a screenshot of the error message.

Config Settings

age_out:
default: last_seen+30d
sudden_death: false
attributes:
confidence: 50
share_level: green
collection: <feedname>
discovery_service: <fs-isac discovery service>

Error Message

<urlopen error [SSL: TLSV1_ALERT_INTERNAL_ERROR] TLSV1 ALERT INTERNAL ERROR (_SSL.C:726)>

[Pedro2020 · Accepted solution]

Issue resolved by following the link below.

https://github.com/PaloAltoNetworks/minemeld-core/issues/371#issue-642113566

[lmori]

I have improved the minemeld-taxii-ng extension to improve compatibility with FS-ISAC feeds. You can do this to configure your MineMeld for FS-ISAC:

1. In System, click on Extensions tab and click on "git" 

   

2. Use https://github.com/PaloAltoNetworks/minemeld-taxii-ng.git as Repository URL and click Retrieve. Select 0.2a4 as version (or greater). Click Install

3.  Activate the extension

4. in System, Dashboard restart the API
5. Now we need to create a prototype, click on Config and then the hamburger icon at the bottom right
6. Search for the taxiing.phishtank prototype
7. Click on NEW
8. Change the configuration removine username and password, and inserting the STIXv1 collection name and TAXII discovery service URL. Click OK when done.
9. Create a new node from the new prototype by clicking on CLONE. And Commit the config.
10. Once the engine has restart, click on Nodes and the new Miner. Configure Username and Password for the feed and then click the poll icon

[SaiLakshmi]

Hi Sir,

We are trying to integrate FS-ISAC threat feeds into Minemeld instance. In the 4th Step,you mentioned to restart the API. I did the same and got Bad Gateway error. I thought of logging out and logging in back again to see if that resolves the issue. However, after logging out of the instance, it is not allowing me to login back again. I am still getting Bad Gateway error. Requesting your quick help here as we have critical data in Minemeld and it is not working.

[lmori]

Could you check /opt/minemeld/log/minemeld-web.log for errors?

If you don't see anything and you want to quickly restore try this:

/opt/minemeld/engine/current/bin/pip uninstall minemeld_taxii_ng

and then restart the instance

[SaiLakshmi]

Hi,

Thanks for the quick turn around, I have attached minemeld-web.log to this case. I have removed most of the unnecessary logs and attached the ones that are required for this case. Can you have a look at it and let me know how to proceed further?

[lmori]

I think the problem is that you are running a pretty old version of MineMeld (0.9.52.post1) and I didn't set the right constraint in the extension.

I would go ahead and uninstall minemeld-taxii-ng using my instructions above.

After upgrading your MineMeld version to a recent one, you will be able to use the extension.

[SaiLakshmi]

sure, I will try that. Can you give me the instructions for upgrading the MineMeld

[SaiLakshmi]

I am running ubuntu 14.04.5 LTS, do you suggest to upgrade that as well? if yes, to which version do you suggest to upgrade?

can you give me the instructions on how do I upgrade latest version of Minemeld on Compatible Ubuntu version? 

[SaiLakshmi]

While Trying to uninstall minemeld_taxii_ng, I got the below error. 

ubuntu@ip-addresss:/opt/minemeld/engine/current/bin$ pip uninstall minemeld_taxii_ng
Cannot uninstall requirement minemeld-taxii-ng, not installed
Storing debug log for failure in /home/ubuntu/.pip/pip.log

Requesting your help to resolve the error

[SaiLakshmi]

@lmori did you get a chance to look into this? 

[SaiLakshmi]

@lmori did you get a chance to look into this?

[RemiUnum]

@SaiLakshmi I was not sure if your question about the Ubuntu OS version was answered. Minemeld works best on Ubuntu 16. Got it running on  Ubuntu 16.04.6 LTS server with no problems at all.

[fwmike2]

@lmori , there seems to be a possible UI bug with this extension. Sometimes the NODE SETTINGS are not displayed in Chrome and this makes configuring the Username and Password fields impossible. Safari and FF do not seem to have the issue.

MM: 0.9.70

minemeld-taxii-ng: 0.2a4 but also in earlier releases

Chrome: 87.04280.88

FF: 82.03

macOS: 10.15.7

Thanks,

-Mike

[ksauer507]

I need help configuring this.  We signed up and the doc they gave us has a Discovery Service, Collection Service, and Poll Serivce URL for TAXII 1.1, 2.0 and 2.1.

Which version do we use?  When you say collection: <feedname> what do you put there, the collection service url beginning with https ?  Or do you have to pick one of the TAXII1.x collection names (there are 11, 3 are not applicable though legacy,test,na).