About Carlos_Gomes

@folmer i ended up uninstalling minemeld, upgraded to Ubuntu 18.04 and then deployed minemeld-ansible instead or minemeld-core now working a treat with cabby needed. sslv3 handshake errors gone. i cannot start minemeld-web service but that is a different issue altogether for another post. thank you for your reply and help. ... View more

i too have this issue. Installed Ubuntu 18.04 then followed the minemeld-ansible instructions. it was working. i restarted the server and it stopped working. Minemeld-web Fatal.  [2019-10-31 09:33:18 +0000] [4698] [ERROR] Exception in worker process Traceback (most recent call last): File "/opt/minemeld/engine/0.9.64/local/lib/python2.7/site-packages/gunicorn/arbiter.py", line 517, in spawn_worker worker.init_process() File "/opt/minemeld/engine/0.9.64/local/lib/python2.7/site-packages/gunicorn/workers/ggevent.py", line 190, in init_process super(GeventWorker, self).init_process() File "/opt/minemeld/engine/0.9.64/local/lib/python2.7/site-packages/gunicorn/workers/base.py", line 122, in init_process self.load_wsgi() File "/opt/minemeld/engine/0.9.64/local/lib/python2.7/site-packages/gunicorn/workers/base.py", line 132, in load_wsgi self.wsgi = self.app.wsgi() File "/opt/minemeld/engine/0.9.64/local/lib/python2.7/site-packages/gunicorn/app/base.py", line 67, in wsgi self.callable = self.load() File "/opt/minemeld/engine/0.9.64/local/lib/python2.7/site-packages/gunicorn/app/wsgiapp.py", line 65, in load return self.load_wsgiapp() File "/opt/minemeld/engine/0.9.64/local/lib/python2.7/site-packages/gunicorn/app/wsgiapp.py", line 52, in load_wsgiapp return util.import_app(self.app_uri) File "/opt/minemeld/engine/0.9.64/local/lib/python2.7/site-packages/gunicorn/util.py", line 357, in import_app __import__(module) File "/opt/minemeld/engine/core/minemeld/flask/main.py", line 3, in <module> app = create_app() File "/opt/minemeld/engine/core/minemeld/flask/__init__.py", line 67, in create_app from . import metricsapi # noqa File "/opt/minemeld/engine/core/minemeld/flask/metricsapi.py", line 19, in <module> import rrdtool ImportError: librrd.so.4: cannot open shared object file: No such file or directory   what i dont get is that after installation it started and was working fine then rebooted and issue. ... View more

@folmer Correct. i actually didnt have the folder core under opt/minemeld/engine/ so i created to match your instructions. I created the requirements.txt as per minemeld file in their github and changed the requirements for pytz to pytz==2019.3 and libtaxii to libtaxii==1.1.114, i think below its what you meant to write. The errors in minemeld.engine log below as example i get that for every prototype. (26093)loader._initialize_entry_point_group ERROR: minemeld.ft.taxii.TaxiiClient not loadable: pytz==2019.3 not compatible with pytz==2015.4, libtaxii==1.1.114 not compatible with libtaxii==1.1.107   I can try this again but havent had much luck leveraging cabby, i was try to do that as with AlienVault OTX i am getting sslv3 handshake failures.   (26093)config._load_and_validate_config_from_file ERROR: Invalid config /opt/minemeld/local/config/committed-config.yml: Class minemeld.ft.taxii.TaxiiClient in Cyrebro10_OTX_Pulses not safe to load   ... View more

Hi @folmer i tried to get this going as according to your github instructions and doesn't work, i get a lot of errors. For example: oader._initialize_entry_point_group ERROR: minemeld.ft.local.YamlURLFT not loadable: pytz==2019.3 not compatible with pytz==2015.4, libtaxii==1.1.114 not compatible with libtaxii==1.1.107   also the engine now is FATAL and doesnt load properly and i do not see this as an available prototype. ... View more

Actually to add @joris_vd @lmori it appears that minemeld is now broken with Alienvault taxii feeds. I am getting SSLV3 handshake errors and no longer can pull. I have upgraded to latest version 0.9.64 and still not working. ... View more

sorry @joris_vd i didnt initially understand what you were saying. But after reading this https://live.paloaltonetworks.com/t5/MineMeld-Articles/Parameters-for-the-output-feeds/ta-p/146170  i did and it works like a charm. ... View more

@joris_vd thank you for responding however i have that part done it is not what i am asking. What i am asking is how you can have minemeld strip the http and https from the list of indicators as the PaloAlto firewalls are ingesting the list containing http and https for all urls and it is not supported, it needs to be just like google.com for example rather than what minemeld list is holding http://google.com   With a txt/csv file minemeld feed you can manipulate it and tell it to drop the http and https from all URL indicators however i have not been able to find it for taxifeed. ... View more

It seems like you would be on your own as it is not supported. I find the community of minemeld is very small and therefore lack of responses.  ... View more

I do not think that you are running a supported release. I am running Ubuntu 16.04.6 LTS which i believe was the latest approved. You need to follow this article. https://live.paloaltonetworks.com/t5/MineMeld-Articles/Manually-install-MineMeld-on-Ubuntu-Server-16-04/ta-p/253336 ... View more

Use the pem and key files instead. ... View more

i do not think those are arbitrary. I am too running same version and with this config do not have a problem. just click on that prototype you have and click NEW then change the config, save, then add new node using that prototype and you know the rest. will take you 5 minutes. There arent many people it seems to me reading these. I have my question posted on 4 different links and no response on stripping http/https from the taxiclient feed.  ... View more

So if i were i would setup exactly as i have as you do not need minemeld on the source and collection names. TAGS: ConfidenceHigh ShareLevelRed   CONFIG: age_out: default: last_seen+30d sudden_death: false attributes: confidence: 30 share_level: red client_cert_required: true collection: username.FSISAC_FEED discovery_service: https://analysis.fsisac.com/taxii-discovery-service initial_interval: 90d source_name: fs-isac.username.FSISAC_FEED ... View more

Can you share what your prototype config looks like, here is mine. This is working for me without any problems. ... View more

@lmori Has anyone got this working for a taxii client feed instead of a csv file feed? ... View more