I have a MISP server set up. I then use a REST API endpoint to get a STIX feed from that server. This portion appears to be working fine. I then try to add that STIX feed to LogRhythms Threat Intelligence Service manager. It tells me that it is successful and the "Test" button returns a positive result but I cannot see any of the indicators from my feed in LogRhythms list of lists. Where are they located? Which lists? Do I need to create the list somehow?


I figured it out. Basically the version that the Threat Intelligence Manager expects is something like 1.0.1 and the version that MISP supplies is something like 1.1.1. There is no way to adjust the version of the output on MISP, and there is no way to adjust the version of the input on the Threat Intelligence Manager that I can see. What I ended up doing is writing a script which fetches the IoCs from the REST API, parses the file, and stores the IoCs in a text file in LogRhythms feed import folder located at "Program Files\LogRhythm\LogRhythm Job Manager\config\list_import". Then you need to add lists in LogRhythm's Console by going to the list manager and configuring the list to auto-import from the text file with IoCs in "Program Files\LogRhythm\LogRhythm Job Manager\config\list_import".

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.