Yes your assumption is correct -this should fix the issue when running 6.4 Let me know how you make out . Kristofer ... View more

I have it working on 6.4.1 - see my other post - you need to make a slight change in how python passes the IPS credentials under the new version ... View more

Oh ya and either try connecting with TLSv1_1 or TLSv1 first . ... View more

Are your using Splunk 6.4 ? If so the new python 2.7.11 libs seem to bork out the Base64 password conversion section of pySDEE.py located in: /opt/splunk/etc/apps/Splunk_TA_cisco-ips/bin/pysdee So... here is what I did do change it: Replace 164 of the file with the following: req.add_header('Authorization', "BASIC %s" % (self._b64pass.replace('\n', ''))) Worked like a charm - INFO - Attempting to connect to sensor: ips-2 Wed Apr 27 09:35:57 2016 - INFO - Successfully connected to: -ips-2 Wed Apr 27 09:35:57 2016 - INFO - Checking for existing SubscriptionID on host: ips-1 Wed Apr 27 09:35:57 2016 - INFO - No existing SubscriptionID for host: -ips-1 Wed Apr 27 09:35:57 2016 - INFO - Attempting to connect to sensor: -ips-1 Wed Apr 27 09:35:57 2016 - INFO - Successfully connected to: -ips-1 Wed Apr 27 09:35:59 2016 - INFO - Successfully connected to: ips-1 Wed Apr 27 09:35:59 2016 - INFO - host="candeal-ips-1" SessionID="48436f106cdef9a21176c4151b7bfacd" SubscriptionID="sub-3-5bae0fff" Wed Apr 27 09:35:59 2016 - INFO - Successfully connected to: - INFO - Attempting to connect to sensor: candeal-ips-2 Wed Apr 27 09:35:57 2016 - INFO - Successfully connected to: candeal-ips-2 Wed Apr 27 09:35:57 2016 - INFO - Checking for existing SubscriptionID on host: candeal-ips-1 Wed Apr 27 09:35:57 2016 - INFO - No existing SubscriptionID for host: candeal-ips-1 Wed Apr 27 09:35:57 2016 - INFO - Attempting to connect to sensor: candeal-ips-1 Wed Apr 27 09:35:57 2016 - INFO - Successfully connected to: candeal-ips-1 Wed Apr 27 09:35:59 2016 - INFO - Successfully connected to: candeal-ips-1 Wed Apr 27 09:35:59 2016 - INFO - host="candeal-ips-1" SessionID="48436f106cdef9a21176c4151b7bfacd" SubscriptionID="sub-3-5bae0fff" Wed Apr 27 09:35:59 2016 - INFO - Successfully connected to: ips-2 Wed Apr 27 09:35:59 2016 - INFO - host="candeal-ips-2" SessionID="92422ed39a6138baab166b468b6d532c" SubscriptionID="sub-3-848eb720" Let me know how you make out . ... View more

So yes - Soltra Edge 2.8.x allows you to filter down before you pull , parse and store into Mongo / Splunk ... not just the FS-ISCA feeds but all your STIX feeds . I currently pull form 6 different STIX hubs so it is more than useful . Kristofer ... View more

No not necessarily - With FS-ISAC you set up your initial feed on their side at analysis.fsisac.com rather than system.default. from there set up an Edge box to pull your clean , "tuned" FS-ISAC feed local or near to your Splunk instance . This allows you to set date parameters for the pull as well - so your not pulling the whole repository back from 2014 - say just the last 6 months . One can also select which IOC types you want to bring into your Splunk environment . Additionally on the Edge box that one has set up locally you can add hailataxxi, jigsaw, and Threat Actor as feeds and set parameters for each e.g. only poll the last 24hrs of data starting at a specific date , only pull this subset of IOCs from each STIX repository . In my opinion much more malleable to point Splunk at feeds that one has control over ( especially not have to download no-applicable IOCs and or ones which are older than 6 months as that's a heck of a lot of data especially if one is searching for IOCs automatically across large data sets ) Just my 2 cents - your mileage my vary Kristofer ... View more

If fact I would recommend the Edge Server between all of your feeds including Hailataxxi , jigsaw, and Threat Actor Lab - gives you a lot of control about what you bring in as a PROD Threat feed ... View more

That's a might big feed to pull .. without the Edge box in the middle to set boundaries on dates , times and IOC types you would be pulling quite a bit of data down .. and most of it extraneous . ... View more

Austin , Make sure the user name ( in this case most likely "admin" judging by your feed name admin,IPWatchlist ) and the password are correct in Splunk and that the User ID has rights set up for the feed in Soltra . Additionally can you post any relevant log output ? Log files are a must when trying to debug . Kristofer ... View more

Send me a message with your email if you wish for me to send you the working pySDEE.py file ... View more

This will fix your issue - things it seems are handled a little "differently" in python 2.7.9 . Save this code ( below ) as "pySDEE.py" in your /bin for the IPS app import urllib import urllib2 import base64 import time import types import xml.dom.minidom import httplib from httplib import HTTPConnection, HTTPS_PORT import ssl import socket import ssl class HTTPSConnection(HTTPConnection): default_port = HTTPS_PORT def __init__(self, host, port=None, key_file=None, cert_file=None, strict=None, timeout=socket._GLOBAL_DEFAULT_TIMEOUT, source_address=None, context=None): HTTPConnection.__init__(self, host, port, strict, timeout, source_address) self.key_file = key_file self.cert_file = cert_file def connect(self): sock = socket.create_connection((self.host, self.port), self.timeout, self.source_address) if self._tunnel_host: self.sock = sock self._tunnel() # SSL vs TLS self.sock = ssl.wrap_socket( sock, self.key_file, self.cert_file, ssl_version=ssl.PROTOCOL_TLSv1_1) httplib.HTTPSConnection = HTTPSConnection def parse_open(action, data): doc = xml.dom.minidom.parseString(data) try: sess = doc.getElementsByTagName('env:Header')[0].getElementsByTagName( 'sd:oobInfo')[0].getElementsByTagName('sd:sessionId')[0] sessionid = sess.firstChild.wholeText except: sessionid = "IOS_ROUTER" subscript = doc.getElementsByTagName( 'env:Body')[0].getElementsByTagName('sd:subscriptionId')[0] subscriptionid = subscript.firstChild.wholeText return [sessionid, subscriptionid] def nano(epoch): return int(epoch * 1e9) def epoch(nano): return (nano / 1e9) class SDEE: def __init__(self, **kwargs): try: self._callback = kwargs['callback'] except: self._callback = '' try: self._format = kwargs['format'] except: self._format = 'raw' try: self._timeout = kwargs['timeout'] except: self._timeout = 1 try: self._user = kwargs['user'] except: self._user = '' try: self._password = kwargs['password'] except: self._password = '' try: self._host = kwargs['host'] except: self._host = 'localhost' try: self._method = kwargs['method'] except: self._method = 'https' try: self._resource = kwargs['resource'] except: self._resource = 'cgi-bin/sdee-server' self._uri = "%s://%s/%s" % (self._method, self._host, self._resource) try: self._sessionid = kwargs['sessionid'] except: self._sessionid = '' try: self._subscriptionid = kwargs['subscriptionid'] except: self._subscriptionid = '' try: self._starttime = kwargs['starttime'] except: self._starttime = nano(time.time()) self._b64pass = base64.encodestring( "%s:%s" % (self._user, self._password)) self._response = '' try: self._force = kwargs['force'] except: self._force = 'yes' def data(self): return self._response def Password(self, passwd): self._password = passwd self._b64pass = base64.encodestring( "%s:%s" % (self._user, self._password)) def User(self, username): self._user = username self._b64pass = base64.encodestring( "%s:%s" % (self._user, self._password)) def Host(self, host): self._host = host self._uri = "%s://%s/%s" % (self._method, self._host, self._resource) def Method(self, method): self._method = method self._uri = "%s://%s/%s" % (self._method, self._host, self._resource) def Resource(self, resource): self._resource = resource self._uri = "%s://%s/%s" % (self._method, self._host, self._resource) def _request(self, params, **kwargs): req = urllib2.Request("%s?%s" % (self._uri, params)) req.add_header('Authorization', "BASIC %s" % (self._b64pass)) data = urllib2.urlopen(req) self._response = data.read() if self._action == 'open': self._sessionid, self._subscriptionid = parse_open( self._action, self._response) elif self._action == 'close': print data.read() elif self._action == 'cancel': print data.read() elif self._action == 'get': if isinstance(self._callback, types.FunctionType): self._callback(**kwargs) elif self._action == 'query': pass def open(self, **kwargs): self._action = 'open' param_dict = { "events": "evIdsAlert", "action": "open", "force": self._force} if self._subscriptionid != '': param_dict['subscriptionId'] = self._subscriptionid params = urllib.urlencode(param_dict) self._request(params) def close(self, **kwargs): self._action = 'close' params = urllib.urlencode({"action": "close", "subscriptionId": self._subscriptionid}) self._request(params) def cancel(self, **kwargs): self._action = 'cancel' params = urllib.urlencode({ "action": "cancel", "subscriptionId": self._subscriptionid, "sessionId": self._sessionid}) self._request(params) def get(self, **kwargs): self._action = 'get' params = urllib.urlencode({"confirm": "yes", "timeout": "1", "maxNbrofEvents": "20", "action": self._action, "subscriptionId": self._subscriptionid}) self._request(params, **kwargs) def query(self, **kwargs): pass ... View more

Alright ! If you need any help msg me . ... View more

On the Soltra Edge Server: 1) Create your site : This is your connection to FS-ISAC with your various polling rules - 2) In the Feeds TAB create a new feed - This is what Spunk will connect to e.g create a feed called " MYFEED" http://127.0.0.1/taxii-discovery-service . 3) Make sure you have a user name, password and a trust group established On the Splunk side : 1) your TAXII Server entry= IP address or Host Name of your SOLTRA Box 2) PORT 80 3) /taxii-discovery-service/ e.g. full url would be http://192.xxx.xxx.xxx/taxii-discovery-service/admin.MYFEED 4) Userid = which ever one your created associated to the new feed on Soltra 5) Password = Whatever password Let me know how you make out . ... View more

Thanks Cedric ! That was just the nudge I needed to fin the issue ... turns out the macros.conf was incorrect. Kristofer ... View more

Thanks ! I will give it a try ... View more

Correct - to clarify I am using the old TA's which allow me to retrieve the logs via Syslog . Can I set this up as the same ? Kris ... View more

Try adding the following to you inputs.conf in the "local" directory for the Splunk_TA_cisco-ips. For Linux Indexer add: When adding a sensor please run setup or enable below monitor in this app's local directory for Linux hosts [monitor://$SPLUNK_HOME/etc/apps/Splunk_TA_cisco-ips/var/log/ips_sdee.log*] sourcetype = cisco:ips:syslog disabled = 0 For Windows Indexer Add: When adding a sensor please run setup or enable below monitor in this app's local directory for Windows hosts [monitor://$SPLUNK_HOME\etc\apps\Splunk_TA_cisco-ips\var\log\ips_sdee.log*] sourcetype = cisco:ips:syslog disabled = 0 ... View more

still no joy - will try my Avalanche feed ... View more

Thanks for the response - what version of MongoDB is compatible ? ... View more

I am having the same issue - did you resolve it ? ... View more