MS-ISAC TAXII Feeds

[ngagne]

Is anyone successfully consuming TAXII feeds from MS-ISAC, specifically, their feeds from taxii-pilot.cisecurity.org? The miner shows success and there are log entries for indicators, but there are no indicators in the counters or graphs.

   

[ycgmis]

I'm working on this now also, let me know if you find success. I'll let you know if I figure out.

[ycgmis]

I'm seeing the same issue you are. I've also stood up anomali staxx and am seeing something similar there. It sees the feeds but no observables. 

[kvbyal]

I am running into the same issue mentioned above with minemeld and staxx. Did either of you find a resolution?

[ngagne]

Nope. Minemeld seems to be pretty much dead at this point so there's no point for us in spending time to get it working.

[ycgmis]

I reached out to CISA for support. I explained that I was seeing the same issue on two different systems. They pretty much told me I was on my own. The problem I really have is trying to get a straight answer on the intelligence sources. DHS maintains a list, CISA maintains a list and MSISAC now maintains a list. I could never get a straight answer if these are all the same or if there is any overlap. Right now I get DHS and MSISAC. I've given up on CISA's list. MSISACs hosted list is the same as what they send out weekly in spreadsheet form.

[kvbyal]

Ycgmis, how did you get MS-ISAC observables in Anomali STAXX? I am having the same issue you posted about in July where everything looks to be configured correctly but the poll never returns any observables.

[ycgmis]

I didn't, these are acutally coming from CISA not MSISAC. The MSISAC hosted intel is just a URL to a text file. The CISA list just gives me the lists with no data. Automated Indicator Sharing | CISA

[MatthewJenkins]

I have looked and am unable to find the text feed from MSISAC. I can only find the STIX and TAXII feeds. Can you provide a link to the text file option? Thanks!