Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Live
- ›
- About rafy92
About rafy92
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
10-29-2018
9Posts
0Likes
0Solutions
Oct 29, 2018Last Visited
User
Activity
User
Profile
Latest posts by rafy92
| Subject | Views | Posted |
|---|---|---|
| 3197 | 10-27-2018 01:44 PM | |
| 3431 | 09-21-2018 01:31 AM | |
| 3646 | 07-06-2018 04:54 AM | |
| 3706 | 07-04-2018 12:40 AM | |
| 3728 | 07-02-2018 08:30 AM |
User Badges
Public Statistics
| Date Registered | 02-13-2018 07:50 AM |
| Date Last Visited | 10-29-2018 09:32 AM |
| Total Messages Posted | 11 |
10-27-2018
01:44 PM
Hi @lmori, sorry for the delay. Today i've doing some test and the results are these: 1. I add to my node some IoCs and the node and the output (Taxii Feed) perform the update correctly. 2. I remove some IoCs from node source and the node perform the update correctly but the output show this result --> Case two image 3. Sometimes the output aging out all IoCs inside even if the node is not empty --> Case three. Let me know pls. Thank you for your support!
... View more
09-21-2018
01:31 AM
Hi @lmori, in Minemeld version 0.9.50 i've the same issue. Could you please support me? Thanks in advance! Regards
... View more
07-06-2018
04:54 AM
Hi @lmori, thank you! Please, let me know when the new release will be released. Regards, R.
... View more
07-04-2018
12:40 AM
Hi @lmori, many thanks for your support but I don't understand why the field "removing" is always equal to 0 if the aging out related to TaxiiDataFeed is by default set to 24h. In addition to the previous point, as you can see in the attached image, the miner do aging out correctly after a timeframe setting by me while the output (stdlib.taxiiDataFeed) not seems to remove the IoCs from feed after 24h. Waiting for your feedback Regards, R.
... View more
07-02-2018
08:30 AM
Hi Guys, using as prototype the "stdlib.taxiiDataFeed" I've exposed through Minemeld a TAXII Feed. Now i've observed that this prototype is the only that can't be aged out, in fact the IoCs collected from the sources comes in addition to those already present in the Feed. Is there a functionality to enable the aging out of the Output ( stdlib.taxiiDataFeed) ? This question is asked me by more customers. Waiting for your feedback. Regards, R.
... View more
06-15-2018
08:31 AM
great, works! I've the last question, how is possible to filter the events on Taxii Feed with an age out settings?
... View more
06-15-2018
04:39 AM
Dear all, today my Taxii Output stopping working, in minemeld-engine.log i see these errors: 2018-06-15T13:23:33 (24179)actorbase._actor_loop ERROR: CyberSOC-taxiiDataFeed-Test - error executing ActorCommand(command='update', kwargs_={u'source': u'MISP_CyberSOC_anyEvents', u'indicator': u'https://pastebin.com/v10rKA6d', u'value': {u'confidence': 70, u'last_seen': 1529056265701L, u'misp_event_tags': [u'family:njRAT', u'type:RAT', u'platform:Windows', u'tlp:green', u'admiralty-scale:source-reliability="a"'], u'misp_event_uuid': u'5b227613-8984-408b-b375-56c5ac110002', u'type': u'URL', u'misp_attribute_uuid': u'5b227617-dfac-4d8c-89c1-55d7ac110002', u'share_level': u'green', u'sources': [u'misp.test'], u'misp_attribute_comment': u'Malware in base64', u'misp_event_org': u'CyberSOC', u'first_seen': 1529056265701L, u'misp_event_orgc': u'CyberSOC', u'misp_event_threat_level_id': u'1', u'misp_event_info': u'20180614_Rat download in base64 from pastebin', u'misp_attribute_category': u'Network activity'}}) Traceback (most recent call last): File "/opt/minemeld/engine/0.9.48/local/lib/python2.7/site-packages/minemeld/ft/actorbase.py", line 54, in _actor_loop method(**acommand.kwargs_) File "/opt/minemeld/engine/0.9.48/local/lib/python2.7/site-packages/minemeld/ft/base.py", line 126, in _counter f(self, *args, **kwargs) File "/opt/minemeld/engine/0.9.48/local/lib/python2.7/site-packages/minemeld/ft/base.py", line 512, in update value=fltvalue File "/opt/minemeld/engine/0.9.48/local/lib/python2.7/site-packages/minemeld/ft/base.py", line 126, in _counter f(self, *args, **kwargs) File "/opt/minemeld/engine/0.9.48/local/lib/python2.7/site-packages/minemeld/ft/taxii.py", line 1628, in filtered_update self._add_indicator(now, indicator, value) File "/opt/minemeld/engine/0.9.48/local/lib/python2.7/site-packages/minemeld/ft/taxii.py", line 1457, in _add_indicator stix.utils.set_id_namespace(nsdict) AttributeError: 'module' object has no attribute 'set_id_namespace' Do you have any suggestion? Thank you all. Regards, R.
... View more
05-12-2018
04:15 PM
Hi all, during the IoC import from Taxii Feed (FS-ISAC) to Minemeld through a Miner Taxii client (minemeld.ft.taxii.TaxiiClient) i've found some issue in minemeld-engine.log: 2018-05-12T15:45:05 (50697)taxii._decode_object_properties ERROR: node-Prova - Unknown IP version: feriavalenciacevisama@yahoo.com 2018-05-12T15:45:05 (50697)taxii._poll_collection INFO: node-Prova - TAXII Content contains observables but no indicators 2018-05-12T15:45:05 (50697)taxii._incremental_poll_collection INFO: node-Prova - polling datetime.datetime(2018, 4, 4, 14, 41, 55, tzinfo=) to datetime.datetime(2018, 4, 5, 14, 41, 55, tzinfo=) 2018-05-12T15:45:07 (50697)taxii._decode_object_properties ERROR: node-Prova - Unknown IP version: service@bcbe.org 2018-05-12T15:45:07 (50697)taxii._poll_collection INFO: node-Prova - TAXII Content contains observables but no indicators 2018-05-12T15:45:07 (50697)taxii._incremental_poll_collection INFO: node-Prova - polling datetime.datetime(2018, 4, 5, 14, 41, 55, tzinfo=) to datetime.datetime(2018, 4, 6, 14, 41, 55, tzinfo=) 2018-05-12T15:45:10 (50697)taxii._decode_object_properties ERROR: node-Prova - no email address listed 2018-05-12T15:45:10 (50697)taxii._decode_object_properties ERROR: node-Prova - unknown type MutexObjectType {'xsi:type': 'MutexObjectType', 'name': 'Global\C::Users:User01:AppData:Local:Microsoft:Windows:Explorer:thumbcache_1024.db!dfMaintainer'} 2018-05-12T15:45:41 (50697)taxii._decode_object_properties ERROR: node-Prova - Unknown IP version: tulm8389@gmail.com 2018-05-12T15:45:41 (50697)taxii._decode_object_properties ERROR: node-Prova - Unknown IP version: maquinadosrango@hotmail.com 2018-05-12T15:45:41 (50697)taxii._decode_object_properties ERROR: node-Prova - Unknown IP version: gerencia.soldmecsrl@hotmail.com 2018-05-12T15:45:41 (50697)taxii._decode_object_properties ERROR: node-Prova - Unknown IP version: montaque37@windowslive.com 2018-05-12T15:45:41 (50697)taxii._decode_object_properties ERROR: node-Prova - Unknown IP version: funniteng74@hotmail.com 2018-05-12T15:45:41 (50697)taxii._decode_object_properties ERROR: node-Prova - Unknown IP version: nanthaphak03@hotmail.com 2018-05-12T15:45:41 (50697)taxii._decode_object_properties ERROR: node-Prova - Unknown IP version: gonter0267@hotmail.com 2018-05-12T15:45:41 (50697)taxii._decode_object_properties ERROR: node-Prova - Unknown IP version: l.d.concannon@gmail.com 2018-05-12T15:45:41 (50697)taxii._decode_object_properties ERROR: node-Prova - Unknown IP version: blessings@perrymaintenance.com 2018-05-12T15:45:41 (50697)taxii._decode_object_properties ERROR: node-Prova - Unknown IP version: montaque37@windowslive.com 2018-05-12T15:45:41 (50697)taxii._decode_object_properties ERROR: node-Prova - Unknown IP version: blessings@perrymaintenance.com 2018-05-12T15:45:41 (50697)taxii._decode_object_properties ERROR: node-Prova - Unknown IP version: gonter0267@hotmail.com 2018-05-12T15:45:41 (50697)taxii._decode_object_properties ERROR: node-Prova - Unknown IP version: l.d.concannon@gmail.com 2018-05-12T15:45:41 (50697)taxii._decode_object_properties ERROR: node-Prova - Unknown IP version: funniteng74@hotmail.com 2018-05-12T15:45:42 (50697)taxii._decode_object_properties ERROR: node-Prova - Unknown IP version: tulm8389@gmail.com 2018-05-12T15:45:42 (50697)taxii._decode_object_properties ERROR: node-Prova - Unknown IP version: gerencia.soldmecsrl@hotmail.com As you can see above the Miner succeed to get all IoC (sha256,md5, IP etc..) exept the e-mail. My Minemeld version is: 0.9.44 Could you please help me? Thank you in advance! Regards, R.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
10-29-2018
09:32 AM
|
Latest Tags
No tags yet
Latest Blogs
Latest Posts
Copyright 2007 - 2020 - Palo Alto Networks
