MISP to Local_Taxii_Server to feed a SIEM

[misp]

MISP to Local_Taxii_Server to feed a SIEM

[FloatingGhost]

If you're binding to external you shouldn't be using the dev server.

See #25

[TiagoSantos84]

Thank you for your fast repply,

Actually I already try that configuration, however it is not easy for me to see how to connect gunicorn to the MISP database and then pull the event from there (or push from MISP to gunicorn probably with push_published_to_taxii.py).

However the first step is to configure taxii server in a way to be possible to discover services/collections/data from an external client.

So if you can give me an extra light to to that I will appreciate!

[FloatingGhost]

I think you misunderstand.

Gunicorn acts as a WSGI server, it can bind opentaxii's server to a UNIX socket or a port.

Literally follow this

[TiagoSantos84]

Ok, I already get properly answer from Gunicorn.

# taxii-collections --path https://host:9000/services/collection-management
2018-03-02 11:40:00,202 INFO: Sending Collection_Information_Request to https://host:9000/services/collection-management
2018-03-02 11:40:00,206 INFO: Starting new HTTPS connection (1): host
=== Data Collection Information ===
  Collection Name: collection
  Collection Type: DATA_SET
  Available: True
  Collection Description: None
  Supported Content: All
  === Polling Service Instance ===
    Poll Protocol: urn:taxii.mitre.org:protocol:http:1.0
    Poll Address: http://localhost:9000/services/poll
    Message Binding: urn:taxii.mitre.org:message:xml:1.0
    Message Binding: urn:taxii.mitre.org:message:xml:1.1
  === Polling Service Instance ===
    Poll Protocol: urn:taxii.mitre.org:protocol:https:1.0
    Poll Address: https://localhost:9000/services/poll
    Message Binding: urn:taxii.mitre.org:message:xml:1.0
    Message Binding: urn:taxii.mitre.org:message:xml:1.1
  === Subscription Service ===
    Protocol Binding: urn:taxii.mitre.org:protocol:http:1.0
    Address: http://localhost:9000/services/collection-management
    Message Binding: urn:taxii.mitre.org:message:xml:1.0
    Message Binding: urn:taxii.mitre.org:message:xml:1.1
  === Subscription Service ===
    Protocol Binding: urn:taxii.mitre.org:protocol:https:1.0
    Address: https://localhost:9000/services/collection-management
    Message Binding: urn:taxii.mitre.org:message:xml:1.0
    Message Binding: urn:taxii.mitre.org:message:xml:1.1
  === Receiving Inbox Service ===
    Protocol Binding: urn:taxii.mitre.org:protocol:http:1.0
    Address: http://localhost:9000/services/inbox
    Message Binding: urn:taxii.mitre.org:message:xml:1.0
    Message Binding: urn:taxii.mitre.org:message:xml:1.1
    Supported Content: urn:stix.mitre.org:xml:1.1.1
    Supported Content: urn:stix.mitre.org:xml:1.2
  === Receiving Inbox Service ===
    Protocol Binding: urn:taxii.mitre.org:protocol:https:1.0
    Address: https://localhost:9000/services/inbox
    Message Binding: urn:taxii.mitre.org:message:xml:1.0
    Message Binding: urn:taxii.mitre.org:message:xml:1.1
    Supported Content: urn:stix.mitre.org:xml:1.1.1
    Supported Content: urn:stix.mitre.org:xml:1.2
==================================

Looks nice to me...thank you!

Now I need to keep going on the following issue to integrate with qradar

55