TAXII feed for SIEM

[Sly_Cooper]

Hi,

I have tried minemeld with few miners and output to the inbounfeedhc i.e. PAN EBL/DBL. It is worked as expected. I would like to push the data to SIEM so that i can perform log analysis based on the indicators. How can i use taxii? I have configured ET.compromisedIP and Dshield miners to send data to new aggregator with output to stllib.feedHCGreen and stdlib.taxiiDataFeed based nodes. I can get data in PAN DBL using stdlib.feedHCGreen output node. What configuration will be needed so that I can configure our SIEM to use taxii based feed? For the taxii based node, I can see current indicators as 1080.

[jhopple]

I'm still not having any luck connecting to the MM TAXII feed from STAXX. Additionally, is there any way to try out that external extension from the Autofocus hosted version of MM?

[lmori]

Hi @jhopple,

MineMeld with the fixed TAXII Miner will be soon available on AutoFocus.

About STAXX integration, do you have somes logs from STAXX you could share to troubleshoot the issue?

luigi

[jhopple]

@lmori

Log from staxx can be found here

https://forum.anomali.com/t/minemeld-feed-returns-internal-server-error/1301/6

[Woranon]

---

STAXX still couldn't retrieve feed from MM. The error was shown on STAXX as below;

Task State: Failed

HTTP/1.1 500 INTERNAL SERVER ERROR

[jhopple]

Any updated thoughts on this? Still getting the internal server error on STAXX. Still no update from STAXX forum either.

[lmori]

Hi @jhopple,

the fix for the TAXII MIner is now available on MM for AutoFocus. Which version of AF/MM are you running on?

Thanks,

luigi

[jhopple]

@lmori

I'm running VERSION: 0.9.44.post1 (AF)

[Deniwton]

Hi @Sly_Cooper and @lmori

I'm trying to configure a output for FS-ISAC miner, and one of previous topic was mentioned about create a aggregator for Taxii feeds using a prototype stdlib.aggregatorIPv4Generic as model . Is it possible to share a aggregator config for example ? 

Also, are you guys using the stdlib.taxiiDataFeed for output or is it a custom output node ? 

Thanks a lot!

[Hugh.Kelley]

I used taxiing.exampleDataFeed as my prototype in MM.    The stdlib.taxiiDataFeed may work too,  I didn't try it.

Then, in Splunk ES, I was able to set up a threat intelligence feed with the following:

• URL:   <MM_SERVER>/taxii-poll-service
• POST arguments:  collection="<NAME_OF_MM_OUTPUT_NODE>"

At least in my experience,  URL can be an IP address, even if you use HTTPS in the URL.   This is handy if you want to share over the internet but don't want to publish a DNS record for "mythreatintelplatform.abc.xyz".