Intergrading Minemeld into McAfee ESM SIEM

[john_chua]

My name is john , i am quite new to Minemeld but i am also using McAfee ESM . can anyone teach me step by step , on how i can intergradeMinemeld into SIEM ? i hope to hearfrom you guys  soon.

with regards,

John

[lmori]

Hi @john_chua,

you should a TAXII output on MineMeld to connect to the McAfee SIEM. You can see the McAfee configuration here: https://live.paloaltonetworks.com/twzvq79624/board/message?board.id=MineMeldDiscussions&message.id=3...

Thanks,

luigi 

[SharadAwasthi]

Hi Imori,

My name is Sharad and I am also trying to integrate MineMeld with McAfee ESM. I have gone through the vasious posts on the community for this integration which were helpful. But, while integrating it give the below error:

"Error issuing TAXII request, HTTP response code: 400: Invalid message, unknown feed". 

Can you please help to resolve this as I am not able to find any mention for this error on this community.

Output feed details:

DISCOVERY SERVICE

http://<MineMeld>/taxii-discovery-service

CLASS	minemeld.ft.taxii.DataFeed
PROTOTYPE	stdlib.taxiiDataFeed

Please let me know if you need any further details.

Thanks in advance.

Sharad Awasthi