I have a MISP server set up. I then use a REST API endpoint to get a STIX feed from that server. This portion appears to be working fine. I then try to add that STIX feed to LogRhythms Threat Intelligence Service manager. It tells me that it is successful and the "Test" button returns a positive result but I cannot see any of the indicators from my feed in LogRhythms list of lists. Where are they located? Which lists? Do I need to create the list somehow?
1 Answer
I figured it out. Basically the version that the Threat Intelligence Manager expects is something like 1.0.1 and the version that MISP supplies is something like 1.1.1. There is no way to adjust the version of the output on MISP, and there is no way to adjust the version of the input on the Threat Intelligence Manager that I can see.
What I ended up doing is writing a script that fetches the IoCs from the REST API, parses the file, and stores the IoCs in a text file in LogRhythm's feed import folder located at Program Files\LogRhythm\LogRhythm Job Manager\config\list_import. Then you need to add lists in LogRhythm's Console by going to the list manager and configuring the list to auto-import from the text file with IoCs in Program Files\LogRhythm\LogRhythm Job Manager\config\list_import.
