topic Re: Adding new threat list feed into splunk in Getting Data In

Adding new threat list feed into splunk

astatrial — Wed, 30 Sep 2020 02:02:15 GMT

Hello all,
I am having issues with adding AlienVault OTX as a intelligence feed into splunk.
At first, when i didn't configured the threat list as a taxii, it managed to download the threat list as a csv file.
But now, i need to configure it as a taxii for parsing matters and it just stuck on that unhelpful message "TAXII feed polling starting".

My feed configurations are :

Type *
taxii

Description *
Alien Vault OTX feed

URL *
https://otx.alienvault.com/taxii/discovery

Weight *
1

Interval
43200

POST arguments
taxii_username="" taxii_password="poo"

Maximum age
-30d

I am really frustrated and would really appreciate anyone's help.

Thanks

Re: Adding new threat list feed into splunk

astatrial — Mon, 18 Nov 2019 09:28:21 GMT

The problem was with libtaxii 1.1.111, which i changed to 1.1.114. in the path :
/etc/apps/SA-ThreatIntelligence/contrib

Problem fixed.

Re: Adding new threat list feed into splunk

infosec2012074 — Sun, 01 Nov 2020 07:28:06 GMT

Could you please give little bit more detail.

Under contrib directory I see many directories. One of these directories is Directory libtaxii. Do you mean to change this directory completely ? Is there any trusted source to get the libtaxii 1.1.114 ?

Re: Adding new threat list feed into splunk

alexeyglukhov — Wed, 09 Jun 2021 07:10:58 GMT

could you elaborate a bit please

Re: Adding new threat list feed into splunk

alexeyglukhov — Wed, 07 Jul 2021 06:49:43 GMT

I assume that was about this python library update

https://github.com/TAXIIProject/libtaxii

Re: Adding new threat list feed into splunk

HowardGrace — Thu, 08 Jul 2021 17:34:23 GMT

Thx for posting!!