STIX and TAXII support

[ScottyAU]

Hi all,

Anyone used minemeld with STIX and TAXII?  While we pretty familure with STIX/TAXII - only just booted minemeld for the first time.

Cheers,

Scotty

[pjames_ucla]

I actually need help setting this up what information do you need to help provide assistance? Thanks for your hlep!

---

@lmori wrote:

Hi Scotty,

yes, there are some MineMeld instances out there retrieving indicators via STIX/TAXII, from TIPs mainly.

There are a couple of prototypes for hailataxii feeds in the prototype library you can check as examples.

Let me know if you need some help in setting up the TAXII Miner.

---

[pjames_ucla]

Good Afternoon, 

Can we please set up a webmeeting today to solve this issue? Thanks for your help!

---

@lmori wrote:

Hi @pjames_ucla,

would you mind sending me the minemeld-engine.log file over at lmori@paloaltonetworks.com ?

I would like to take a look at the error. Or we can set up a webmeeting to troubleshoot it.

Thanks,

luigi

---

[pjames_ucla]

@lmori Thanks for your response can we please set up a webmeeting today to troubleshoot? Thanks for your help!

-P

---

@pjames_ucla wrote:

Good Afternoon, 

Can we please set up a webmeeting today to solve this issue? Thanks for your help!

---

@lmori wrote:

Hi @pjames_ucla,

would you mind sending me the minemeld-engine.log file over at lmori@paloaltonetworks.com ?

I would like to take a look at the error. Or we can set up a webmeeting to troubleshoot it.

Thanks,

luigi

---

---

[pjames_ucla]

@ScottyAU did you ever get this working correctly? If so what was the hangup? I am having similar problems. 

[Sebastiano]

sIs there an updated list of the stix object/vocabulary currently supported by minemeld taxii/stix miner / output nodes?

It will be very useful.

Kind regars.

Sebastiano

[lmori]

Hi @Sebastiano,

sorry for the late reply, as of 0.9.40 (and soon 0.9.42) these are the object supported by the TAXII Miner. Extent of support may vary between different object type:

• DomainNameObjectType
• FileObjectType
• SocketAddressObjectType
• AddressObjectType
• URIObjectType
• LinkObjectType
• EmailMessageObjectType
• ArtifactObjectType
• PDFFileObjectType
• WhoisObjectType
• HTTPSessionObjectType
• PortObjectType
• WindowsExecutableFileObjectType

The TAXII DataFeed output node instead translates into TAXII the following MineMeld indicator types:

• IPv4
• IPv6
• URL
• domain
• sha256
• sha1
• md5

Please let me know if you are looking for support of additional object/indicator types.

[lahiri]

so, i wanted to know how can we integrate ibm x force free feeds to minemeld.

---

@ScottyAU wrote:

Hi all,

Anyone used minemeld with STIX and TAXII?  While we pretty familure with STIX/TAXII - only just booted minemeld for the first time.

Cheers,

Scotty

---