Minemeld TAXII ISAC

[Xavi_Gil]

Hi all,

I have the way to get feeds from ISAC with a TAXII prototype and I want to share with you all. Proabably it can help someone.

Firstly it's necessary to import the minemeld-taxii-ng extension on system>extensions and install extension from git, and activate it,

https://github.com/PaloAltoNetworks/minemeld-taxii-ng.git

Then, clone the taxiing.phishtank prototype and add your user account (collection, discover_service, user and password) with no verify cert param,

age_out:
default: last_seen+30d
sudden_death: false
collection: XXXX-ISAC
discovery_service: https://taxii.XXXX.com/taxii/discovery
password: --------------------
username: ----------
verify_cert: false

The result,

 

I hope you find it interesting!

Regards,

[Hugh.Kelley]

Thank you.   I had imported the extension but didn't realize that "taxiing.phishtank" was the prototype name I should use.    Now that you mention it, I see it in taxiing/prototypes/taxiing.yml,  but it would be helpful to mention it in the GitHub readme too.