Qradar couldn't connect MM Taxii output

[Woranon]

Hi Guys,

It seems issue happend at Minemeld side.

This is error from Qradar Threat Intell app "There is a problem connecting to the TAXII server. Verify that the TAXII server is available. Get list of collections failed."

This is error from Minemeld (/opt/minemeld/log/minemeld-web.log)

"POST /taxii-discovery-service HTTP/1.0" 200 1658 "-" "Qradar TI App/1.2.1.20170824002606"

Note: MM is run over HTTP.

[lmori]

Hi @Woranon,

from my experience, the only way to debug QRadar is checking its Threat Intelligence app log from the container.

Have you already looked into it?

luigi

[Nocturnalknight]

Dear woranon,

Bydefault qradar will not trust the internal CA .

As a workaround you can extract the app and disable the SSL verification. 

 i have already done the necessary changes in these files and its working for me. Try and let me know.

Thanks,

Ram

[TiagoSantos84]

Hi,

Let me ask this. And thank you in advance.

If I have a certificate (.key and .crt) that is recognized in the world, where to put in minemeld taxxi server?

Thank you!

Best Regards