How to configure MineMeld to forward Logs to RSA Security Analytics

[vhgambit]

I want to forward the output of output nodes in minemeld to SIEM, I want to see the output indicators in Security Analytics to create rules and when an indicator match generate an alert, actually I have configured PaloAlto Firrewalls with Dynamic List but I would like to send output indicators to SIEM

[lmori]

Hi @vhgambit,

you could try 2 methods:

• use the CEF extension for MineMeld to generate indicators in CEF format and forward them to RSA (https://github.com/PaloAltoNetworks/minemeld-cef)
• starting from 0.9.40, MineMeld supports generating feeds in CSV format. RSA Security Analytics should be able to ingest feeds in CSV (https://community.rsa.com/docs/DOC-54891)

[vhgambit]

Hi Imori thank a lot for your quick response.

In fact I already install CEF extension, and I can create a node with this output

CLASS mmcef.node.Output

PROTOTYPE cef.testCEF

STATE started

# INDICATORS 938

But this node doesn´t not give me a list or other information, I just can see all LOGS of this output in the upper right corner.

What´s next from here, I didn´t find information about that; how can I forward this output to RSA or Where does this logs are stored to see if I can get them and send to RSA

Greetings

[lmori]

Hi @vhgambit,

you should customize the cef.testCEF prototype to specify the host, port and protocol to communicate with your RSA SIEM.

You can do this by:

- click on CONFIG

- click on the hamburger icon in the bottom right corner

- search for  testCEF and click on it

- click on NEW (not CLONE)

- modify the config and specify host, port and protocol of the SIEM

- click OK

- create a new output node with the new prototype