MineMeld: threat intelligence automation – connect to STIX/TAXII service [5]

This post is the fifth of a series on Threat Intelligence Automation topic.
Post 1: Architecture and Hardening of MineMeld
Post 2: Foundation: write a custom prototype and SOC integration
Post 3: Export internal IoC to the community
Post 4: Search IoC events with SPLUNK

Long time since my last post. I was very busy creating Cyber Saiyan – a non-profit organization – and organizing RomHack 2018, a free cyber security event that will take place in Rome next September 22th.

On the field of threat intelligence automation and info sharing community building, the work continued too.

I’m working hard with italian community and we setup a STIX/TAXII network using a combination of open source sofware: MISP, OpenTAXII and MineMeld. We are now testing a complex consumer/producer network where companies (producers) can push IoC that, after validation, are injected into the consumer network, a TAXII service built on top of MineMeld.

I already covered the IoC export with MineMeld on post 3 but it was a very simple and not scalable setup; I will detail the new setup in a dedicated post when we reach a stable and modular configuration.

In this post I show you how to connect to a STIX/TAXII service using the next-generation (NG) miner that Luigi Mori wrote for us.
The new miner, called minemeld-taxii-ng, is available on github and has two nodes:

  • the miner: taxiing.phishtank
  • the output: taxiing.exampleDataFeed
minemeld-taxii-ng
minemeld-taxii-ng

I just cover the miner usage to collect STIX data from a TAXII service.

First of all we need to install the new miner extension. To do this go to System menu and click on Extensions button (left); then click on git button, add the address https://github.com/PaloAltoNetworks/minemeld-taxii-ng.git and click RETRIEVE.
Choose version 0.1b8 (or a newest available), click INSTALL and activate the extension (by default is disabled). Notice that as of today (31th of March 2018) the shown version is 0.1b6, I sent a PR to fix this.

Install ng extension
Install ng extension

Move to Config / Prototypes page and search for the new installed node (taxiing.phishtank).

taxiing.phishtank miner
taxiing.phishtank miner

Click on the miner, then the NEW button (top-right) and make a new prototype to connect to your STIX/TAXII service. Change following values:

  • NAME: the name of the new prototype
  • DESCRIPTION: a description of the new prototype
  • CONFIG
    • collection: the TAXII collection to pull
    • discovery_service: the FQDN of the TAXII discovery service
    • user: user of TAXII service
    • password: password of TAXII service
ng miner config
ng miner config

On the prototypes page search for the new one (minemeldlocal…).

new ng prototype
new ng prototype

Click and CLONE it using the top-right button (change the NAME to whatever you want).

New cloned ng miner
New cloned ng miner

COMMIT the changes and MineMeld server will restart. On the NODES menu you can check the new miner status (the color goes from gray to green).

ng miner up&running
ng miner up&running

The NG miner starts collectiong STIX IoC that we can use as input for our processors.

ng miner collecting STIX data
ng miner collecting STIX data

I hope someone else can test this new miner with other STIX/TAXII services and send us a feedback, so please use the comment section to do this 🙂

merlos

4 thoughts on “MineMeld: threat intelligence automation – connect to STIX/TAXII service [5]

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

w

Connecting to %s