This website uses cookies essential to its operation, for analytics, and for personalized content. By continuing to browse this site, you acknowledge the use of cookies.
For details on cookie usage on our site, read our Privacy Policy
For details on cookie usage on our site, read our Privacy Policy
About folmer
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- LIVEcommunity
- About folmer
02-04-2021
13Posts
1Like
2Solutions
Feb 04, 2021Last Visited
User
Activity
User
Profile
Latest posts by folmer
| Subject | Views | Posted |
|---|---|---|
| 3387 | 02-04-2021 04:53 AM | |
| 5870 | 10-30-2019 01:00 AM | |
| 6401 | 07-25-2019 07:18 AM | |
| 6546 | 07-23-2019 06:02 AM | |
| 7219 | 06-26-2019 08:17 AM | |
| 2385 | 06-26-2019 12:43 AM | |
| 7246 | 06-26-2019 12:25 AM | |
| 7646 | 06-24-2019 11:33 PM | |
| 2536 | 06-04-2019 03:05 AM | |
| 2697 | 06-03-2019 11:24 PM |
My Liked Posts
| Subject | Likes | Posted |
|---|---|---|
| 1 Like | 06-03-2019 11:24 PM |
User Badges
Community Statistics
| Member Since | 05-07-2019 06:43 AM |
| Date Last Visited | 02-04-2021 08:14 AM |
| Posts | 13 |
| Total Likes Received | 1 |
02-04-2021
04:53 AM
I solved the dependency issues with an ugly fix. It will work however. I dont know if the developer of minemeld is reading this, but why are minemeld python requirements version specific? For example pytz needs to be version 2015.4, which is pretty old. Also requests needs to be version 2.20 and libtaxii needs to be 1.107. If == could be replaced by >= there would be less dependency issues.
... View more
10-30-2019
01:00 AM
Hello Carlos, did you change the entries for pytz and libtaxii in requirements.txt? Usually requirements.txt contains "pytz==2015.4" and libtaxii"=="1.1.107". However for cabby to work these need to be newer versions. So the requirements have to be changed to "pytz>=2015.4" and libtaxii>="1.1.107". You can probably just restart the service and it should work.
... View more
07-25-2019
07:18 AM
Yes, that is one of the things I want to add in a future version. For now everything seems to be working well, so I don't know when I will work on it.
... View more
07-23-2019
06:02 AM
I created a new stix/taxii miner for MineMeld, it can be found on github: https://github.com/mr-torgue/mmcabby. It was created because I encountered severel problems with the default taxii miner and the ng miner. In general mmcabby is more stable because it uses cabby (from eclecticIQ developers of stix/taxii). It also contains support for certificate based authentication. Improvements/remarks/bug notifications are appreciated.
... View more
06-26-2019
08:17 AM
The minemeld.ft.redis.RedisSet output should show the number of IOC's. I have not worked with the taxii output node, so I don't know about that. Do you see the IOC's when you go to the minemeld.ft.redis.RedisSet output node and click on 'FEED BASE URL'? Palo Alto firewalls should be able to use output miners of the Minemeld.ft.redis.RedisSet class.
... View more
06-26-2019
12:43 AM
How are you collecting the IOC's? What output do you use, standard feed, syslog, CEF? It looks like too many clients are created for redis(memory storage), so probably a new connection is created is made for each IOC. I am not sure why this happens. According to the documentation of redis(https://redis.io/topics/clients) the maxclients can be set using maxclients directive in /etc/redis.conf. Redis checks with the OS how many file descriptors can be openened. The maximum number of filedescriptors can be found using 'ulimit -Sn' (soft limit) and 'ulimit -Hn' (hard limit). I am guessing that either the maxclients is very low (around 150) or the OS limits are very low. Can you post the outputs of 'ulimit -Sn' and 'ulimit -Hn' together with the value of maxclients?
... View more
06-26-2019
12:25 AM
I think it depends on the type of output. The standard outputs (stdlib_feed prototype) work fine. However we also have a CEF output which always displays 0, which might be a bug. What kind of output do you use? I agree that the output should show 200 in your case but I am not sure why it doesn't show it.
... View more
06-24-2019
11:33 PM
The STIX/TAXII client for OTX collects pulses from a user or group. For example the collection user_AlienVault contains all the pulses AlienVault has published. If you want to include other pulses you have several options: 1) poll the user to which the IOC belongs by using collection user_[OTX_username] 2) add the IOC to a group and use collection group_[group_name] The OTX STIX/TAXII implementation is described here: https://otx.alienvault.com/api . Which vendor are you collecting from?
... View more
06-04-2019
03:05 AM
I think I found a solution to this: First of all I deleted rabbitmq, it is not necesarry anymore. After that I changed the requirements.txt(/<mm dir>/engine/core) file so newer versions are used: pip>=9.0.1 amqp==2.5.0 gevent==1.1.1 greenlet==0.4.15 hiredis==0.2.0 PyYAML==3.11 redis==2.10.6 requests==2.20.0 plyvel==0.9 netaddr==0.7.18 antlr4-python2-runtime==4.5.2 jmespath==0.7.1 click==4.1 pan-python==0.10.0 stix==1.2.0.6 cybox==2.1.0.17 six==1.11.0 lxml==4.1.0 stix-edh==1.0.1 libtaxii==1.1.113 pytz==2015.4 certifi ujson==1.34 filelock==2.0.4 sleekxmpp==1.3.1 beautifulsoup4==4.4.1 cifsdk==2.0.0b7 lz4==0.8.2 networkx==1.11 unicodecsv==0.14.1 Werkzeug==0.12.2 pyzmq==18.0.1 After that cd /<mm dir>/engine/core && /<mm dir>/engine/current/bin/python setup.py install. For me this seems to work on RedHat 7.6. You can remove traced logs by either mm-traced-purge --all or rm -rf /<mm dir>/local/traced. Restart minemeld with 'service minemeld restart'. Maybe it is a good idea to update the requirements in the git repository?
... View more
06-03-2019
11:24 PM
1 Kudo
It is still experimental(https://github.com/PaloAltoNetworks/minemeld-ansible). I have it running on RedHat and most functionality works, but for some reason the whitelists don't seem to work on RedHat. If you want stability: run MineMeld on Ubuntu 16.04.
... View more
06-03-2019
11:17 PM
I figured out a way to get rid of the 'module object has no attribute sslwrap' error. The 'gevent' python package has to be updated. If MineMeld is already installed: Go to /<mm>/engine/core edit requirements.txt, change to gevent==1.1.1, greenlet==0.4.15 /<mm>/engine/current/python setup.py install Verify that the right version is installed: /<mm>/engine/current/pip install gevent or /<mm>/engine/current/pip freeze. Restart minemeld: "service minemeld restart". The SSL should now be gone.
... View more
05-07-2019
07:28 AM
Hello, I tried to create a STIX/TAXII miner for otx.alienvault.com. I used the default MineMeld taxii client for this(minemeld.ft.taxii.TaxiiClient) and the new client minemeld-taxii-ng(taxiing.Miner). The first client does returns the error ' module object has no attribute 'sslwrap''. The second returns a 406 client error, which leads me to assume that something is off the accept header. When trying another server like hailataxii.com the second client(ng) works fine. The first client does not give a SSL error but does not load IOC's. In all cases, when I use cabby it works. So my questions are: Why does the first Taxii client not work and why the sslwrap error? Why does the second client return a 406? Since cabby works pretty well: can it be turned into a node? It would remove the need for a custom STIX client. Why does the new Taxii client(ng) not use libtaxii anymore? Cabby uses that as well. Hope you can help me. Best regards, Folmer
... View more
05-07-2019
07:24 AM
Hello, I have the problem that minemeld whitelists don't seem to work on our self-hosted minemeld version. I have the following setup: removed miner names for privacy reasons The wlDomeinAggregator contains a few domainnames, so they should be removed from the CEF output node. When investigating the issue I found out that no 'withdraw' event is triggered in the CEF node when a new whitelist entry is added. I am wondering why this doesn't happen. When an input miner(for example feodetrackr removes an IP) removes an IOC a 'withdraw' event is triggered for that IP. I tried different setups. I tried adding the input node(generic domain list) to the domainaggregator directly. I tried the localdb miner. Nothing seems to work. Help would be appreciated. Best regards, Folmer
... View more
LEGAL NOTICES
Copyright 2007 - 2023 - Palo Alto Networks