Hi Sebastian,
How misp expert bot works?
I want to know more on this.
I have used mispfeed output bot as output to misp but I am not able to see feeds in MISP. Later I have found a expert bot of MISP. Please guide me how that can be used. Also as you prefer not to share screenshots thus not sharing them. Please let me know if needed for reference.
Regards, Drupad Soni KPMG - Cyber Security Embassy Golf Links Business Park, Pebble Beach, 'B' Block, 1st & 2nd Floor, Off Intermediate Ring Road Mobile : +91 8140283894 Know more about our Cyber Security Services https://home.kpmg.com/in/en/home/services/advisory/risk-consulting/it-adviso...
********************************************************************** KPMG (in India) allows reasonable personal use of the e-mail system. Views and opinions expressed in these communications do not necessarily represent those of KPMG (in India).
******************************************************************************************************* DISCLAIMER The information in this e-mail is confidential and may be legally privileged. It is intended solely for the addressee. Access to this e-mail by anyone else is unauthorized. If you have received this communication in error, please address with the subject heading "Received in error," send to postmaster1@kpmg.com, then delete the e-mail and destroy any copies of it. If you are not the intended recipient, any disclosure, copying, distribution or any action taken or omitted to be taken in reliance on it, is prohibited and may be unlawful. Any opinions or advice contained in this e-mail are subject to the terms and conditions expressed in the governing KPMG client engagement letter. Opinions, conclusions and other information in this e-mail and any attachments that do not relate to the official business of the firm are neither given nor endorsed by it.
KPMG cannot guarantee that e-mail communications are secure or error-free, as information could be intercepted, corrupted, amended, lost, destroyed, arrive late or incomplete, or contain viruses.
KPMG, an Indian partnership and a member firm of KPMG International Cooperative ("KPMG International"), a Swiss entity that serves as a coordinating entity for a network of independent firms operating under the KPMG name. KPMG International Cooperative (“KPMG International”) provides no services to clients. Each member firm of KPMG International Cooperative (“KPMG International”) is a legally distinct and separate entity and each describes itself as such.
“Notwithstanding anything inconsistent contained in the meeting invite to which this acceptance pertains, this acceptance is restricted solely to confirming my availability for the proposed call and should not be construed in any manner as acceptance of any other terms or conditions. Specifically, nothing contained herein may be construed as an acceptance (or deemed acceptance) of any request or notification for recording of the call, which can be done only if it is based on my explicit and written consent and subject to the terms and conditions on which such consent has been granted” *******************************************************************************************************
Hi,
On 5/5/21 10:33 AM, Soni, Drupad via IntelMQ-users wrote:
How misp expert bot works?
I want to know more on this.
https://intelmq.readthedocs.io/en/latest/user/bots.html#id13
Queries a MISP instance for the source.ip and adds the MISP Attribute
UUID and MISP Event ID of the newest attribute found.
Does that answer your question?
I have used mispfeed output bot as output to misp but I am not able to see feeds in MISP. Later I have found a expert bot of MISP. Please guide me how that can be used.
Add the bot to your configuration, set the parameters misp_key andmisp_url according to your MISP setup.
Btw: If you have a use-case and you don't know how to implement it, you may also ask here for input and ideas. Probably that saves you a few round of trial-and-error.
Sebastian
Hi Sebastian,
Thanks,
I am working on pushing all feeds of Intelmq to MISP. I am working on this since long unable to crack it. If anyone has worked on this scenario please help me out.
Regards, Drupad Soni KPMG - Cyber Security Embassy Golf Links Business Park, Pebble Beach, 'B' Block, 1st & 2nd Floor, Off Intermediate Ring Road Mobile : +91 8140283894 Know more about our Cyber Security Services https://home.kpmg.com/in/en/home/services/advisory/risk-consulting/it-adviso...
From: Sebastian Wagner wagner@cert.at Sent: Wednesday, May 5, 2021 3:53 PM To: Soni, Drupad drupadsoni@kpmg.com; intelmq-users@lists.cert.at Subject: Re: [IntelMQ-users] MISP Expert bot
Hi,
On 5/5/21 10:33 AM, Soni, Drupad via IntelMQ-users wrote: How misp expert bot works?
I want to know more on this.
https://intelmq.readthedocs.io/en/latest/user/bots.html#id13
Queries a MISP instance for the source.ip and adds the MISP Attribute UUID and MISP Event ID of the newest attribute found.
Does that answer your question? I have used mispfeed output bot as output to misp but I am not able to see feeds in MISP. Later I have found a expert bot of MISP. Please guide me how that can be used.
Add the bot to your configuration, set the parameters misp_key and misp_url according to your MISP setup.
Btw: If you have a use-case and you don't know how to implement it, you may also ask here for input and ideas. Probably that saves you a few round of trial-and-error.
Sebastian
--
// Sebastian Wagner wagner@cert.atmailto:wagner@cert.at - T: +43 676 898 298 7201
// CERT Austria - https://www.cert.at/
// Eine Initiative der nic.at GmbH - https://www.nic.at/
// Firmenbuchnummer 172568b, LG Salzburg
********************************************************************** KPMG (in India) allows reasonable personal use of the e-mail system. Views and opinions expressed in these communications do not necessarily represent those of KPMG (in India).
******************************************************************************************************* DISCLAIMER The information in this e-mail is confidential and may be legally privileged. It is intended solely for the addressee. Access to this e-mail by anyone else is unauthorized. If you have received this communication in error, please address with the subject heading "Received in error," send to postmaster1@kpmg.com, then delete the e-mail and destroy any copies of it. If you are not the intended recipient, any disclosure, copying, distribution or any action taken or omitted to be taken in reliance on it, is prohibited and may be unlawful. Any opinions or advice contained in this e-mail are subject to the terms and conditions expressed in the governing KPMG client engagement letter. Opinions, conclusions and other information in this e-mail and any attachments that do not relate to the official business of the firm are neither given nor endorsed by it.
KPMG cannot guarantee that e-mail communications are secure or error-free, as information could be intercepted, corrupted, amended, lost, destroyed, arrive late or incomplete, or contain viruses.
KPMG, an Indian partnership and a member firm of KPMG International Cooperative ("KPMG International"), a Swiss entity that serves as a coordinating entity for a network of independent firms operating under the KPMG name. KPMG International Cooperative (“KPMG International”) provides no services to clients. Each member firm of KPMG International Cooperative (“KPMG International”) is a legally distinct and separate entity and each describes itself as such.
“Notwithstanding anything inconsistent contained in the meeting invite to which this acceptance pertains, this acceptance is restricted solely to confirming my availability for the proposed call and should not be construed in any manner as acceptance of any other terms or conditions. Specifically, nothing contained herein may be construed as an acceptance (or deemed acceptance) of any request or notification for recording of the call, which can be done only if it is based on my explicit and written consent and subject to the terms and conditions on which such consent has been granted” *******************************************************************************************************
The "expert bot of MISP " (I assume you mean the MISP expansion module?) is just there to enrich MISP events with data which are in the eventdb. That is probably not what you want. I assume what you want is to send IntelMQ data to MISP. However, ... MISP is not designed to process billions of records (IntelMQ can generate quite a lot and fast). So that's where we use a MISP "feed". Which allows correlation of data with MISP data without really importing all of it. Is that what you want? In case it is, I recommend reading the MISP book section on MISP feeds [1]
Best, Aaron.
[1] https://www.circl.lu/doc/misp/managing-feeds/#caching-feeds
On 05.05.2021, at 13:03, Soni, Drupad via IntelMQ-users intelmq-users@lists.cert.at wrote:
Hi Sebastian,
Thanks,
I am working on pushing all feeds of Intelmq to MISP. I am working on this since long unable to crack it. If anyone has worked on this scenario please help me out.
Regards, Drupad Soni KPMG – Cyber Security Embassy Golf Links Business Park, Pebble Beach, 'B' Block, 1st & 2nd Floor, Off Intermediate Ring Road Mobile : +91 8140283894 Know more about our Cyber Security Services https://home.kpmg.com/in/en/home/services/advisory/risk-consulting/it-adviso...
From: Sebastian Wagner wagner@cert.at Sent: Wednesday, May 5, 2021 3:53 PM To: Soni, Drupad drupadsoni@kpmg.com; intelmq-users@lists.cert.at Subject: Re: [IntelMQ-users] MISP Expert bot
Hi,
On 5/5/21 10:33 AM, Soni, Drupad via IntelMQ-users wrote: How misp expert bot works?
I want to know more on this. https://intelmq.readthedocs.io/en/latest/user/bots.html#id13
Queries a MISP instance for the source.ip and adds the MISP Attribute UUID and MISP Event ID of the newest attribute found.
Does that answer your question?
I have used mispfeed output bot as output to misp but I am not able to see feeds in MISP. Later I have found a expert bot of MISP. Please guide me how that can be used. Add the bot to your configuration, set the parameters misp_key and misp_url according to your MISP setup.
Btw: If you have a use-case and you don't know how to implement it, you may also ask here for input and ideas. Probably that saves you a few round of trial-and-error.
Sebastian
-- // Sebastian Wagner wagner@cert.at - T: +43 676 898 298 7201 // CERT Austria - https://www.cert.at/ // Eine Initiative der nic.at GmbH - https://www.nic.at/ // Firmenbuchnummer 172568b, LG Salzburg KPMG (in India) allows reasonable personal use of the e-mail system. Views and opinions expressed in these communications do not necessarily represent those of KPMG (in India).
DISCLAIMER The information in this e-mail is confidential and may be legally privileged. It is intended solely for the addressee. Access to this e-mail by anyone else is unauthorized. If you have received this communication in error, please address with the subject heading "Received in error," send to postmaster1@kpmg.com, then delete the e-mail and destroy any copies of it. If you are not the intended recipient, any disclosure, copying, distribution or any action taken or omitted to be taken in reliance on it, is prohibited and may be unlawful. Any opinions or advice contained in this e-mail are subject to the terms and conditions expressed in the governing KPMG client engagement letter. Opinions, conclusions and other information in this e-mail and any attachments that do not relate to the official business of the firm are neither given nor endorsed by it.
KPMG cannot guarantee that e-mail communications are secure or error-free, as information could be intercepted, corrupted, amended, lost, destroyed, arrive late or incomplete, or contain viruses.
KPMG, an Indian partnership and a member firm of KPMG International Cooperative ("KPMG International"), a Swiss entity that serves as a coordinating entity for a network of independent firms operating under the KPMG name. KPMG International Cooperative (“KPMG International”) provides no services to clients. Each member firm of KPMG International Cooperative (“KPMG International”) is a legally distinct and separate entity and each describes itself as such.
“Notwithstanding anything inconsistent contained in the meeting invite to which this acceptance pertains, this acceptance is restricted solely to confirming my availability for the proposed call and should not be construed in any manner as acceptance of any other terms or conditions. Specifically, nothing contained herein may be construed as an acceptance (or deemed acceptance) of any request or notification for recording of the call, which can be done only if it is based on my explicit and written consent and subject to the terms and conditions on which such consent has been granted”
-- List settings: https://lists.cert.at/cgi-bin/mailman/listinfo/intelmq-users IntelMQ Documentation: https://intelmq.readthedocs.io/
Hi Aron,
So we cannot see feeds manually also? I am able to see feeds as below but unable to access it when I click on view button.
[cid:image001.png@01D741D5.FD50F620]
Regards,
Drupad Soni
KPMG – Cyber Security
Embassy Golf Links Business Park, Pebble Beach, 'B' Block,
1st & 2nd Floor, Off Intermediate Ring Road
Mobile : +91 8140283894
Know more about our Cyber Security Services
https://home.kpmg.com/in/en/home/services/advisory/risk-consulting/it-adviso...
-----Original Message----- From: L. Aaron Kaplan aaron@lo-res.org Sent: Wednesday, May 5, 2021 4:40 PM To: Soni, Drupad drupadsoni@kpmg.com Cc: intelmq-users@lists.cert.at; Shah, Kunal kunalshah3@kpmg.com Subject: Re: [IntelMQ-users] MISP Expert bot
The "expert bot of MISP " (I assume you mean the MISP expansion module?) is just there to enrich MISP events with data which are in the eventdb. That is probably not what you want.
I assume what you want is to send IntelMQ data to MISP. However, ... MISP is not designed to process billions of records (IntelMQ can generate quite a lot and fast). So that's where we use a MISP "feed". Which allows correlation of data with MISP data without really importing all of it.
Is that what you want?
In case it is, I recommend reading the MISP book section on MISP feeds [1]
Best,
Aaron.
[1] https://www.circl.lu/doc/misp/managing-feeds/#caching-feeds
On 05.05.2021, at 13:03, Soni, Drupad via IntelMQ-users <intelmq-users@lists.cert.atmailto:intelmq-users@lists.cert.at> wrote:
Hi Sebastian,
Thanks,
I am working on pushing all feeds of Intelmq to MISP. I am working on this since long unable to crack it. If anyone has worked on this scenario please help me out.
Regards,
Drupad Soni
KPMG – Cyber Security
Embassy Golf Links Business Park, Pebble Beach, 'B' Block, 1st & 2nd
Floor, Off Intermediate Ring Road Mobile : +91 8140283894 Know more
about our Cyber Security Services
https://home.kpmg.com/in/en/home/services/advisory/risk-consulting/it-
advisory-services/cyber-security.html
From: Sebastian Wagner <wagner@cert.atmailto:wagner@cert.at>
Sent: Wednesday, May 5, 2021 3:53 PM
To: Soni, Drupad <drupadsoni@kpmg.commailto:drupadsoni@kpmg.com>; intelmq-users@lists.cert.atmailto:intelmq-users@lists.cert.at
Subject: Re: [IntelMQ-users] MISP Expert bot
Hi,
On 5/5/21 10:33 AM, Soni, Drupad via IntelMQ-users wrote:
How misp expert bot works?
I want to know more on this.
https://intelmq.readthedocs.io/en/latest/user/bots.html#id13
Queries a MISP instance for the source.ip and adds the MISP Attribute UUID and MISP Event ID of the newest attribute found.
Does that answer your question?
I have used mispfeed output bot as output to misp but I am not able to see feeds in MISP. Later I have found a expert bot of MISP. Please guide me how that can be used.
Add the bot to your configuration, set the parameters misp_key and misp_url according to your MISP setup.
Btw: If you have a use-case and you don't know how to implement it, you may also ask here for input and ideas. Probably that saves you a few round of trial-and-error.
Sebastian
--
// Sebastian Wagner <wagner@cert.atmailto:wagner@cert.at> - T: +43 676 898 298 7201 // CERT
Austria - https://www.cert.at/ // Eine Initiative der nic.at GmbH -
https://www.nic.at/ // Firmenbuchnummer 172568b, LG Salzburg KPMG (in
India) allows reasonable personal use of the e-mail system. Views and opinions expressed in these communications do not necessarily represent those of KPMG (in India).
DISCLAIMER
The information in this e-mail is confidential and may be legally privileged. It is intended solely for the addressee. Access to this e-mail by anyone else is unauthorized. If you have received this communication in error, please address with the subject heading "Received in error," send to postmaster1@kpmg.commailto:postmaster1@kpmg.com, then delete the e-mail and destroy any copies of it. If you are not the intended recipient, any disclosure, copying, distribution or any action taken or omitted to be taken in reliance on it, is prohibited and may be unlawful. Any opinions or advice contained in this e-mail are subject to the terms and conditions expressed in the governing KPMG client engagement letter. Opinions, conclusions and other information in this e-mail and any attachments that do not relate to the official business of the firm are neither given nor endorsed by it.
KPMG cannot guarantee that e-mail communications are secure or error-free, as information could be intercepted, corrupted, amended, lost, destroyed, arrive late or incomplete, or contain viruses.
KPMG, an Indian partnership and a member firm of KPMG International Cooperative ("KPMG International"), a Swiss entity that serves as a coordinating entity for a network of independent firms operating under the KPMG name. KPMG International Cooperative (“KPMG International”) provides no services to clients. Each member firm of KPMG International Cooperative (“KPMG International”) is a legally distinct and separate entity and each describes itself as such.
“Notwithstanding anything inconsistent contained in the meeting invite to which this acceptance pertains, this acceptance is restricted solely to confirming my availability for the proposed call and should not be construed in any manner as acceptance of any other terms or conditions. Specifically, nothing contained herein may be construed as an acceptance (or deemed acceptance) of any request or notification for recording of the call, which can be done only if it is based on my explicit and written consent and subject to the terms and conditions on which such consent has been granted”
--
List settings:
https://lists.cert.at/cgi-bin/mailman/listinfo/intelmq-users
IntelMQ Documentation: https://intelmq.readthedocs.io/
********************************************************************** KPMG (in India) allows reasonable personal use of the e-mail system. Views and opinions expressed in these communications do not necessarily represent those of KPMG (in India).
******************************************************************************************************* DISCLAIMER The information in this e-mail is confidential and may be legally privileged. It is intended solely for the addressee. Access to this e-mail by anyone else is unauthorized. If you have received this communication in error, please address with the subject heading "Received in error," send to postmaster1@kpmg.com, then delete the e-mail and destroy any copies of it. If you are not the intended recipient, any disclosure, copying, distribution or any action taken or omitted to be taken in reliance on it, is prohibited and may be unlawful. Any opinions or advice contained in this e-mail are subject to the terms and conditions expressed in the governing KPMG client engagement letter. Opinions, conclusions and other information in this e-mail and any attachments that do not relate to the official business of the firm are neither given nor endorsed by it.
KPMG cannot guarantee that e-mail communications are secure or error-free, as information could be intercepted, corrupted, amended, lost, destroyed, arrive late or incomplete, or contain viruses.
KPMG, an Indian partnership and a member firm of KPMG International Cooperative ("KPMG International"), a Swiss entity that serves as a coordinating entity for a network of independent firms operating under the KPMG name. KPMG International Cooperative (“KPMG International”) provides no services to clients. Each member firm of KPMG International Cooperative (“KPMG International”) is a legally distinct and separate entity and each describes itself as such.
“Notwithstanding anything inconsistent contained in the meeting invite to which this acceptance pertains, this acceptance is restricted solely to confirming my availability for the proposed call and should not be construed in any manner as acceptance of any other terms or conditions. Specifically, nothing contained herein may be construed as an acceptance (or deemed acceptance) of any request or notification for recording of the call, which can be done only if it is based on my explicit and written consent and subject to the terms and conditions on which such consent has been granted” *******************************************************************************************************
Hi Aron,
How does MISP-API o/p bot work? I have gone through documentation shared on INTELMQ DOCUMENTATION. Once it is configured on Intelmq what configurations needs to be done on MISP integration side? Please guide.
Regards, Drupad Soni KPMG – Cyber Security Embassy Golf Links Business Park, Pebble Beach, 'B' Block, 1st & 2nd Floor, Off Intermediate Ring Road Mobile : +91 8140283894 Know more about our Cyber Security Services https://home.kpmg.com/in/en/home/services/advisory/risk-consulting/it-adviso...
From: Soni, Drupad Sent: Wednesday, May 5, 2021 5:42 PM To: L. Aaron Kaplan aaron@lo-res.org Cc: intelmq-users@lists.cert.at; Shah, Kunal kunalshah3@kpmg.com; Thakur, Richu richuthakur@kpmg.com Subject: RE: [IntelMQ-users] MISP Expert bot
Hi Aron,
So we cannot see feeds manually also? I am able to see feeds as below but unable to access it when I click on view button.
[cid:image001.png@01D7464A.B928EBF0]
Regards,
Drupad Soni
KPMG – Cyber Security
Embassy Golf Links Business Park, Pebble Beach, 'B' Block,
1st & 2nd Floor, Off Intermediate Ring Road
Mobile : +91 8140283894
Know more about our Cyber Security Services
https://home.kpmg.com/in/en/home/services/advisory/risk-consulting/it-adviso...
-----Original Message----- From: L. Aaron Kaplan <aaron@lo-res.orgmailto:aaron@lo-res.org> Sent: Wednesday, May 5, 2021 4:40 PM To: Soni, Drupad <drupadsoni@kpmg.commailto:drupadsoni@kpmg.com> Cc: intelmq-users@lists.cert.atmailto:intelmq-users@lists.cert.at; Shah, Kunal <kunalshah3@kpmg.commailto:kunalshah3@kpmg.com> Subject: Re: [IntelMQ-users] MISP Expert bot
The "expert bot of MISP " (I assume you mean the MISP expansion module?) is just there to enrich MISP events with data which are in the eventdb. That is probably not what you want.
I assume what you want is to send IntelMQ data to MISP. However, ... MISP is not designed to process billions of records (IntelMQ can generate quite a lot and fast). So that's where we use a MISP "feed". Which allows correlation of data with MISP data without really importing all of it.
Is that what you want?
In case it is, I recommend reading the MISP book section on MISP feeds [1]
Best,
Aaron.
[1] https://www.circl.lu/doc/misp/managing-feeds/#caching-feeds
On 05.05.2021, at 13:03, Soni, Drupad via IntelMQ-users <intelmq-users@lists.cert.atmailto:intelmq-users@lists.cert.at> wrote:
Hi Sebastian,
Thanks,
I am working on pushing all feeds of Intelmq to MISP. I am working on this since long unable to crack it. If anyone has worked on this scenario please help me out.
Regards,
Drupad Soni
KPMG – Cyber Security
Embassy Golf Links Business Park, Pebble Beach, 'B' Block, 1st & 2nd
Floor, Off Intermediate Ring Road Mobile : +91 8140283894 Know more
about our Cyber Security Services
https://home.kpmg.com/in/en/home/services/advisory/risk-consulting/it-
advisory-services/cyber-security.html
From: Sebastian Wagner <wagner@cert.atmailto:wagner@cert.at>
Sent: Wednesday, May 5, 2021 3:53 PM
To: Soni, Drupad <drupadsoni@kpmg.commailto:drupadsoni@kpmg.com>; intelmq-users@lists.cert.atmailto:intelmq-users@lists.cert.at
Subject: Re: [IntelMQ-users] MISP Expert bot
Hi,
On 5/5/21 10:33 AM, Soni, Drupad via IntelMQ-users wrote:
How misp expert bot works?
I want to know more on this.
https://intelmq.readthedocs.io/en/latest/user/bots.html#id13
Queries a MISP instance for the source.ip and adds the MISP Attribute UUID and MISP Event ID of the newest attribute found.
Does that answer your question?
I have used mispfeed output bot as output to misp but I am not able to see feeds in MISP. Later I have found a expert bot of MISP. Please guide me how that can be used.
Add the bot to your configuration, set the parameters misp_key and misp_url according to your MISP setup.
Btw: If you have a use-case and you don't know how to implement it, you may also ask here for input and ideas. Probably that saves you a few round of trial-and-error.
Sebastian
--
// Sebastian Wagner <wagner@cert.atmailto:wagner@cert.at> - T: +43 676 898 298 7201 // CERT
Austria - https://www.cert.at/ // Eine Initiative der nic.at GmbH -
https://www.nic.at/ // Firmenbuchnummer 172568b, LG Salzburg KPMG (in
India) allows reasonable personal use of the e-mail system. Views and opinions expressed in these communications do not necessarily represent those of KPMG (in India).
DISCLAIMER
The information in this e-mail is confidential and may be legally privileged. It is intended solely for the addressee. Access to this e-mail by anyone else is unauthorized. If you have received this communication in error, please address with the subject heading "Received in error," send to postmaster1@kpmg.commailto:postmaster1@kpmg.com, then delete the e-mail and destroy any copies of it. If you are not the intended recipient, any disclosure, copying, distribution or any action taken or omitted to be taken in reliance on it, is prohibited and may be unlawful. Any opinions or advice contained in this e-mail are subject to the terms and conditions expressed in the governing KPMG client engagement letter. Opinions, conclusions and other information in this e-mail and any attachments that do not relate to the official business of the firm are neither given nor endorsed by it.
KPMG cannot guarantee that e-mail communications are secure or error-free, as information could be intercepted, corrupted, amended, lost, destroyed, arrive late or incomplete, or contain viruses.
KPMG, an Indian partnership and a member firm of KPMG International Cooperative ("KPMG International"), a Swiss entity that serves as a coordinating entity for a network of independent firms operating under the KPMG name. KPMG International Cooperative (“KPMG International”) provides no services to clients. Each member firm of KPMG International Cooperative (“KPMG International”) is a legally distinct and separate entity and each describes itself as such.
“Notwithstanding anything inconsistent contained in the meeting invite to which this acceptance pertains, this acceptance is restricted solely to confirming my availability for the proposed call and should not be construed in any manner as acceptance of any other terms or conditions. Specifically, nothing contained herein may be construed as an acceptance (or deemed acceptance) of any request or notification for recording of the call, which can be done only if it is based on my explicit and written consent and subject to the terms and conditions on which such consent has been granted”
--
List settings:
https://lists.cert.at/cgi-bin/mailman/listinfo/intelmq-users
IntelMQ Documentation: https://intelmq.readthedocs.io/
********************************************************************** KPMG (in India) allows reasonable personal use of the e-mail system. Views and opinions expressed in these communications do not necessarily represent those of KPMG (in India).
******************************************************************************************************* DISCLAIMER The information in this e-mail is confidential and may be legally privileged. It is intended solely for the addressee. Access to this e-mail by anyone else is unauthorized. If you have received this communication in error, please address with the subject heading "Received in error," send to postmaster1@kpmg.com, then delete the e-mail and destroy any copies of it. If you are not the intended recipient, any disclosure, copying, distribution or any action taken or omitted to be taken in reliance on it, is prohibited and may be unlawful. Any opinions or advice contained in this e-mail are subject to the terms and conditions expressed in the governing KPMG client engagement letter. Opinions, conclusions and other information in this e-mail and any attachments that do not relate to the official business of the firm are neither given nor endorsed by it.
KPMG cannot guarantee that e-mail communications are secure or error-free, as information could be intercepted, corrupted, amended, lost, destroyed, arrive late or incomplete, or contain viruses.
KPMG, an Indian partnership and a member firm of KPMG International Cooperative ("KPMG International"), a Swiss entity that serves as a coordinating entity for a network of independent firms operating under the KPMG name. KPMG International Cooperative (“KPMG International”) provides no services to clients. Each member firm of KPMG International Cooperative (“KPMG International”) is a legally distinct and separate entity and each describes itself as such.
“Notwithstanding anything inconsistent contained in the meeting invite to which this acceptance pertains, this acceptance is restricted solely to confirming my availability for the proposed call and should not be construed in any manner as acceptance of any other terms or conditions. Specifically, nothing contained herein may be construed as an acceptance (or deemed acceptance) of any request or notification for recording of the call, which can be done only if it is based on my explicit and written consent and subject to the terms and conditions on which such consent has been granted” *******************************************************************************************************
Hi Soni,
https://github.com/certtools/intelmq/blob/master/intelmq/bots/outputs/misp/o...
Am Dienstag 11 Mai 2021 06:18:02 schrieb Soni, Drupad via IntelMQ-users:
How does MISP-API o/p bot work? I have gone through documentation shared on INTELMQ DOCUMENTATION.
the documentation points to the docstrings of the file for more details, thus see the docstring in https://github.com/certtools/intelmq/blob/master/intelmq/bots/outputs/misp/o... (or the right one for your version)
Once it is configured on Intelmq what configurations needs to be done on MISP integration side?
As far as I remember there are no special configuration settings needed in MISP. The Intelmq-misp-output-api bot will just enter new MSIP events (under the documented conditions) to the user with the configured MISP api key.
To see what is happening, check the logfile of the output_api bot (may need to raise logging levels as documented in the general IntelMQ documentation).
Regards, Bernhard
Hi Bernhard,
I have used MISP-API bot and misp expert bot. I am looking at error as below. I have used auth key and url which are correct. Please guide.
Traceback (most recent call last): File "/usr/lib/python3/dist-packages/intelmq/lib/bot.py", line 164, in __init__ self.init() File "/usr/lib/python3/dist-packages/intelmq/bots/experts/misp/expert.py", line 30, in init self.parameters.http_verify_cert) File "/usr/local/lib/python3.6/dist-packages/pymisp/api.py", line 181, in __init__ raise PyMISPError(f'Unable to connect to MISP ({self.root_url}). Please make sure the API key and the URL are correct (http/https is required): {e}') pymisp.exceptions.PyMISPError: Unable to connect to MISP (https://20.57.10.5/). Please make sure the API key and the URL are correct (http/https is required): HTTPSConnectionPool(host='20.57.10.5', port=443): Max retries exceeded with url: /servers/getPyMISPVersion.json (Caused by SSLError(SSLError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:852)'),))
Regards, Drupad Soni KPMG – Cyber Security Embassy Golf Links Business Park, Pebble Beach, 'B' Block, 1st & 2nd Floor, Off Intermediate Ring Road Mobile : +91 8140283894 Know more about our Cyber Security Services https://home.kpmg.com/in/en/home/services/advisory/risk-consulting/it-adviso...
-----Original Message----- From: IntelMQ-users intelmq-users-bounces@lists.cert.at On Behalf Of Bernhard Reiter Sent: Tuesday, May 11, 2021 2:59 PM To: intelmq-users@lists.cert.at Subject: Re: [IntelMQ-users] MISP Expert bot
Hi Soni,
https://github.com/certtools/intelmq/blob/master/intelmq/bots/outputs/misp/o...
Am Dienstag 11 Mai 2021 06:18:02 schrieb Soni, Drupad via IntelMQ-users:
How does MISP-API o/p bot work? I have gone through documentation shared on INTELMQ DOCUMENTATION.
the documentation points to the docstrings of the file for more details, thus see the docstring in https://github.com/certtools/intelmq/blob/master/intelmq/bots/outputs/misp/o... (or the right one for your version)
Once it is configured on Intelmq what configurations needs to be done on MISP integration side?
As far as I remember there are no special configuration settings needed in MISP. The Intelmq-misp-output-api bot will just enter new MSIP events (under the documented conditions) to the user with the configured MISP api key.
To see what is happening, check the logfile of the output_api bot (may need to raise logging levels as documented in the general IntelMQ documentation).
Regards, Bernhard
-- www.intevation.de/~bernhard +49 541 33 508 3-3 Intevation GmbH, Osnabrück, DE; Amtsgericht Osnabrück, HRB 18998 Geschäftsführer Frank Koormann, Bernhard Reiter, Dr. Jan-Oliver Wagner
********************************************************************** KPMG (in India) allows reasonable personal use of the e-mail system. Views and opinions expressed in these communications do not necessarily represent those of KPMG (in India).
******************************************************************************************************* DISCLAIMER The information in this e-mail is confidential and may be legally privileged. It is intended solely for the addressee. Access to this e-mail by anyone else is unauthorized. If you have received this communication in error, please address with the subject heading "Received in error," send to postmaster1@kpmg.com, then delete the e-mail and destroy any copies of it. If you are not the intended recipient, any disclosure, copying, distribution or any action taken or omitted to be taken in reliance on it, is prohibited and may be unlawful. Any opinions or advice contained in this e-mail are subject to the terms and conditions expressed in the governing KPMG client engagement letter. Opinions, conclusions and other information in this e-mail and any attachments that do not relate to the official business of the firm are neither given nor endorsed by it.
KPMG cannot guarantee that e-mail communications are secure or error-free, as information could be intercepted, corrupted, amended, lost, destroyed, arrive late or incomplete, or contain viruses.
KPMG, an Indian partnership and a member firm of KPMG International Cooperative ("KPMG International"), a Swiss entity that serves as a coordinating entity for a network of independent firms operating under the KPMG name. KPMG International Cooperative (“KPMG International”) provides no services to clients. Each member firm of KPMG International Cooperative (“KPMG International”) is a legally distinct and separate entity and each describes itself as such.
“Notwithstanding anything inconsistent contained in the meeting invite to which this acceptance pertains, this acceptance is restricted solely to confirming my availability for the proposed call and should not be construed in any manner as acceptance of any other terms or conditions. Specifically, nothing contained herein may be construed as an acceptance (or deemed acceptance) of any request or notification for recording of the call, which can be done only if it is based on my explicit and written consent and subject to the terms and conditions on which such consent has been granted” *******************************************************************************************************
Hi Soni,
Am Dienstag 11 Mai 2021 11:49:22 schrieb Soni, Drupad:
Please guide.
in general with Python: Tead the traceback information in detail and start from bottom to top:
Traceback (most recent call last):
[..]
(Caused by SSLError(SSLError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:852)'),))
Expercise left to the reader: What is the likely cause of connection problem and what configuration options could be related to this? ;)
Best Regards, Bernhard
On 5/11/21 1:08 PM, Bernhard Reiter wrote:
(Caused by SSLError(SSLError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:852)'),))
Expercise left to the reader: What is the likely cause of connection problem and what configuration options could be related to this? ;)
There might something useful in the docs: https://intelmq.readthedocs.io/en/latest/user/bots.html#id14
Sebastian
