MineMeld whitelist not working

[folmer]

Hello,

I have the problem that minemeld whitelists don't seem to work on our self-hosted minemeld version.

I have the following setup:removed miner names for privacy reasons

The wlDomeinAggregator contains a few domainnames, so they should be removed from the CEF output node.

When investigating the issue I found out that no 'withdraw' event is triggered in the CEF node when a new whitelist entry is added. I am wondering why this doesn't happen. When an input miner(for example feodetrackr removes an IP) removes an IOC a 'withdraw' event is triggered for that IP.

I tried different setups. I tried adding the input node(generic domain list) to the domainaggregator directly. I tried the localdb miner. Nothing seems to work.

Help would be appreciated.

Best regards,

Folmer

[folmer · Accepted solution]

I think I found a solution to this:

First of all I deleted rabbitmq, it is not necesarry anymore. After that I changed the requirements.txt(/<mm dir>/engine/core) file so newer versions are used:

pip>=9.0.1
amqp==2.5.0
gevent==1.1.1
greenlet==0.4.15
hiredis==0.2.0
PyYAML==3.11
redis==2.10.6
requests==2.20.0
plyvel==0.9
netaddr==0.7.18
antlr4-python2-runtime==4.5.2
jmespath==0.7.1
click==4.1
pan-python==0.10.0
stix==1.2.0.6
cybox==2.1.0.17
six==1.11.0
lxml==4.1.0
stix-edh==1.0.1
libtaxii==1.1.113
pytz==2015.4
certifi
ujson==1.34
filelock==2.0.4
sleekxmpp==1.3.1
beautifulsoup4==4.4.1
cifsdk==2.0.0b7
lz4==0.8.2
networkx==1.11
unicodecsv==0.14.1
Werkzeug==0.12.2
pyzmq==18.0.1

After that cd /<mm dir>/engine/core && /<mm dir>/engine/current/bin/python setup.py install.

For me this seems to work on RedHat 7.6. You can remove traced logs by either mm-traced-purge --all or rm -rf /<mm dir>/local/traced. Restart minemeld with 'service minemeld restart'.

Maybe it is a good idea to update the requirements in the git repository?