Multiple TAXII outputs within a single minemeld instance?

[chtoh82]

Hi,

If I have a configuration of 2 taxii outputs within a node, the output feed discovery service url for both taxii output nodes are the same, in this case, how do we differentiate them? Would authentication with Tags helps? Thanks!

[Simon_10]

Hi Chtoh82,

I have the same problem. Did you find a solution?

Thanks in advance.

[lmori]

In TAXII you don't need a URL per feed, the TAXII Client interrogates the TAXII Discovery Service to discover the available services and then the client interrogates the TAXII Collection Management Service (whose URL is returned by the TAXII Discovery Service) to list the available Data Feeds.

So basically yes, MineMeld does support multiple output TAXII Data Feeds and you just need one URL to access them all. Based on authorization configs (TAGS) different users will see different available feeds.

[Simon_10]

Hi Lmori,

Many thanks for the the clarification!