About Woranon

STAXX still couldn't retrieve feed from MM. The error was shown on STAXX as below;   Task State: Failed HTTP/1.1 500 INTERNAL SERVER ERROR ... View more

It works now. just comment like below;   upstream app_server {     server 127.0.0.1:5000 fail_timeout=0; }   #server { #     listen 80; #     server_name ~(.+)$; #     return 301 https://$1$request_uri; #}   server { #     listen 443 ssl; listen 80;       server_name _; ssl off; #     ssl_certificate /etc/nginx/minemeld.cer; #     ssl_certificate_key /etc/nginx/minemeld.pem; #     ssl_protocols TLSv1 TLSv1.1 TLSv1.2; #     ssl_prefer_server_ciphers on; #     ssl_session_cache shared:SSL:10m; #     ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA';   #     keepalive_timeout 5; wrote: Hi Community,   My Minemeld config file is different from above. It looks like below. I've tried follow above solution by comment (#) all redirect part, but it doesn't work. Any help and guide..     *********************************** upstream app_server {     server 127.0.0.1:5000 fail_timeout=0; }   #server {  #  listen 80;  #   server_name ~(.+)$; #    return 301 https://$1$request_uri; #}   server {   listen 80;   } server {     listen 443 ssl;       server_name _;     ssl_certificate /etc/nginx/minemeld.cer;     ssl_certificate_key /etc/nginx/minemeld.pem;     ssl_protocols TLSv1 TLSv1.1 TLSv1.2;     ssl_prefer_server_ciphers on;     ssl_session_cache shared:SSL:10m;     ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDH E-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128- SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE- ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DH E-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GC M-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT: !DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA';       keepalive_timeout 5;       # path for static files     root /opt/minemeld/www/current;       location = / {         index index.html;         expires off;     }       # first files then proxy to flask app     location / {         @TRY_files $uri @proxy_to_app;     }       location ~* \.html$ {         @TRY_files $uri @proxy_to_app;         expires -1;     }       # for SSE     location /status/events {         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;         proxy_set_header Host $http_host;         proxy_set_header Connection '';         proxy_http_version 1.1;         proxy_redirect off;         proxy_buffering off;         chunked_transfer_encoding off;         proxy_cache off;         proxy_read_timeout 120s;           expires -1;           proxy_pass   http://app_server;             }       # for content that should be handled by mw flask app     @location @proxy_to_app {         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;         proxy_set_header Host $http_host;         proxy_redirect http://$http_host/ https://$http_host/;           proxy_pass   http://app_server;     } }   ... View more

Hi Community,   My Minemeld config file is different from above. It looks like below. I've tried follow above solution by comment (#) all redirect part, but it doesn't work. Any help and guide..     *********************************** upstream app_server {     server 127.0.0.1:5000 fail_timeout=0; }   #server {  #  listen 80;  #   server_name ~(.+)$; #    return 301 https://$1$request_uri; #}   server {   listen 80;   } server {     listen 443 ssl;       server_name _;     ssl_certificate /etc/nginx/minemeld.cer;     ssl_certificate_key /etc/nginx/minemeld.pem;     ssl_protocols TLSv1 TLSv1.1 TLSv1.2;     ssl_prefer_server_ciphers on;     ssl_session_cache shared:SSL:10m;     ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDH E-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128- SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE- ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DH E-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GC M-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT: !DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA';       keepalive_timeout 5;       # path for static files     root /opt/minemeld/www/current;       location = / {         index index.html;         expires off;     }       # first files then proxy to flask app     location / {         try_files $uri @proxy_to_app;     }       location ~* \.html$ {         try_files $uri @proxy_to_app;         expires -1;     }       # for SSE     location /status/events {         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;         proxy_set_header Host $http_host;         proxy_set_header Connection '';         proxy_http_version 1.1;         proxy_redirect off;         proxy_buffering off;         chunked_transfer_encoding off;         proxy_cache off;         proxy_read_timeout 120s;           expires -1;           proxy_pass   http://app_server;             }       # for content that should be handled by mw flask app     location @proxy_to_app {         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;         proxy_set_header Host $http_host;         proxy_redirect http://$http_host/ https://$http_host/;           proxy_pass   http://app_server;     } } ... View more

@xhoms   For my case, I have SIEM (Qradar Threat Intel app) and try to get the feed from Minemeld which providing the output node in  STIX/TAXII format. As I understand, I need to have the Minemeld cert for TAXII server.  Please correct me if im wrong.   I follow this article "https://live.paloaltonetworks.com/t5/MineMeld-Articles/Integrating-MineMeld-with-IBM-QRadar/ta-p/143293"  ... View more