# How to configure a open source IT feeds in graylog **URL:** \ **Category:** Graylog Central (peer support)\ **Created:** [December 4, 2018, 11:07am UTC](https://community.graylog.org/t/how-to-configure-a-open-source-it-feeds-in-graylog/7889 "2018-12-04T11:07:13Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![prakasha](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/prakasha/32/3422_2.png) [@prakasha](https://community.graylog.org/u/prakasha)\ **Post date:** [December 4, 2018, 11:07am UTC](https://community.graylog.org/t/how-to-configure-a-open-source-it-feeds-in-graylog/7889/1 "2018-12-04T11:07:13Z")
Dear All, I need to configure third-party opensource in our Graylog server. I am using graylog 2.5 in my environment. I want to implement a below framework in my graylog. Someone, please confirm how to do this. I am new in the graylog application. _C1fApp_ _Megatron_ _Cymon_ _VirusTotal_ Thanks. ---
**Author:** ![Totally\_Not\_A\_Robot](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/totally_not_a_robot/32/3353_2.png) [@Totally\_Not\_A\_Robot](https://community.graylog.org/u/Totally_Not_A_Robot)\ **Post date:** [December 4, 2018, 11:42am UTC](https://community.graylog.org/t/how-to-configure-a-open-source-it-feeds-in-graylog/7889/2 "2018-12-04T11:42:20Z")
I’m very interested in what your possible use-case is here. It looks like you’re wanting to gather threat intelligence into Graylog. But what exactly is it that you need? Are you looking to correlate things like IP addresses to known bad actors? Or do you want their daily information feeds? Etc. ---
**Author:** ![prakasha](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/prakasha/32/3422_2.png) [@prakasha](https://community.graylog.org/u/prakasha)\ **Post date:** [December 4, 2018, 12:21pm UTC](https://community.graylog.org/t/how-to-configure-a-open-source-it-feeds-in-graylog/7889/3 "2018-12-04T12:21:36Z")
Yes, i want to gather threat intelligence to graylog, need daily information feeds. ---
**Author:** ![Totally\_Not\_A\_Robot](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/totally_not_a_robot/32/3353_2.png) [@Totally\_Not\_A\_Robot](https://community.graylog.org/u/Totally_Not_A_Robot)\ **Post date:** [December 4, 2018, 1:08pm UTC](https://community.graylog.org/t/how-to-configure-a-open-source-it-feeds-in-graylog/7889/4 "2018-12-04T13:08:08Z")
Well, not to be too blunt, but here’s your best place to start: > **[LMGTFY](http://lmgtfy.com/?q=graylog+%22threat+intelligence%22+feed)** > > LMGTFY ---
**Author:** ![prakasha](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/prakasha/32/3422_2.png) [@prakasha](https://community.graylog.org/u/prakasha)\ **Post date:** [December 5, 2018, 6:05am UTC](https://community.graylog.org/t/how-to-configure-a-open-source-it-feeds-in-graylog/7889/5 "2018-12-05T06:05:19Z")
Dear @Totally_Not_A_Robot , Thank you for your quick reply 👍. Here I have to mention Threat intelligence feed configuration. I have a created a Pipeline called “Threat Intelligence Lookup” and added streams and timeline as per the TI feed and added a new rule called “Threat Intelligence Lookups: EventID”. To search for EventID matches, I run the following query: EventID\_threat\_indicated: true as per the [https://www.graylog.org/post/integrating-threat-intelligence-with-graylog](https://www.graylog.org/post/integrating-threat-intelligence-with-graylog) URL. But in search logs are not displaying. What I have missed. Is anything I have done wrong. Here I have an attached a pipeline and rules snapshot for your reference. ![TI-Rule%20](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/f/f86ce7660d243b0509cc8b82d6dc45ef9dd5de5b.png) ---
**Author:** ![Totally\_Not\_A\_Robot](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/totally_not_a_robot/32/3353_2.png) [@Totally\_Not\_A\_Robot](https://community.graylog.org/u/Totally_Not_A_Robot)\ **Post date:** [December 5, 2018, 8:14am UTC](https://community.graylog.org/t/how-to-configure-a-open-source-it-feeds-in-graylog/7889/6 "2018-12-05T08:14:59Z")
> [@prakasha](#): > > To search for EventID matches, I run the following query: EventID\_threat\_indicated: true as per the [https://www.graylog.org/post/integrating-threat-intelligence-with-graylog](https://www.graylog.org/post/integrating-threat-intelligence-with-graylog) URL. Aha! So you are using the built-in TI plugin. That’s an important detail; based on your opening post it looked like you wanted to use those four companies’ feeds and was asking how to get their data in. Now, was the plugin configured with an API key for AlienVault OTX? Because it seems that this is currently the only TI feed used by the plugin. Have you verified that this connection works and that the plugin can actually retrieve data from AlienVault? ---
**Author:** ![prakasha](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/prakasha/32/3422_2.png) [@prakasha](https://community.graylog.org/u/prakasha)\ **Post date:** [December 5, 2018, 9:55am UTC](https://community.graylog.org/t/how-to-configure-a-open-source-it-feeds-in-graylog/7889/7 "2018-12-05T09:55:44Z")
Dear @Totally_Not_A_Robot, I want to implement those as well. but i am trying default plugins for TI feed reference configuration. OTX API key has been added the same. ![OTX%20API%20Key](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/8/88e05702769715f4291e9478b2c9aeaeb4bf77c7.png) ---
**Author:** ![Totally\_Not\_A\_Robot](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/totally_not_a_robot/32/3353_2.png) [@Totally\_Not\_A\_Robot](https://community.graylog.org/u/Totally_Not_A_Robot)\ **Post date:** [December 5, 2018, 10:27am UTC](https://community.graylog.org/t/how-to-configure-a-open-source-it-feeds-in-graylog/7889/8 "2018-12-05T10:27:00Z")
Then one extra test you can do is see whether the API connection actually works from the Graylog box. Can you use `curl` or `wget` from the command line to interact with the feed? This will allow you to troubleshoot the network connection from the Graylog host to the OTX API. You’ll verify whether proxies/firewalls/etc are opened up correctly. ---
**Author:** ![benvanstaveren](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/benvanstaveren/32/3398_2.png) [@benvanstaveren](https://community.graylog.org/u/benvanstaveren)\ **Post date:** [December 5, 2018, 9:09pm UTC](https://community.graylog.org/t/how-to-configure-a-open-source-it-feeds-in-graylog/7889/9 "2018-12-05T21:09:14Z")
Actually here’s another test, for shits and giggles. Empty the rule body where you do the threat lookup, and add another stage to the pipeline after the stage where the now-empty threat lookup rule lives. See if that blank stage has any throughput. If it doesn’t, no messages carry an EventID field at the time they enter the pipeline, which would also explain the lack of threat detection. Just as a random late night 2 cent option. ---
**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\ **Post date:** [December 6, 2018, 7:36am UTC](https://community.graylog.org/t/how-to-configure-a-open-source-it-feeds-in-graylog/7889/10 "2018-12-06T07:36:11Z")
For debugging we have the `debug` function: [http://docs.graylog.org/en/2.5/pages/pipelines/functions.html#debug](http://docs.graylog.org/en/2.5/pages/pipelines/functions.html#debug) ---
**Author:** ![prakasha](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/prakasha/32/3422_2.png) [@prakasha](https://community.graylog.org/u/prakasha)\ **Post date:** [December 6, 2018, 1:20pm UTC](https://community.graylog.org/t/how-to-configure-a-open-source-it-feeds-in-graylog/7889/11 "2018-12-06T13:20:26Z")
@benvanstaveren, I tried the same what you suggested, i am getting throughput from the pipeline. ---
**Author:** ![benvanstaveren](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/benvanstaveren/32/3398_2.png) [@benvanstaveren](https://community.graylog.org/u/benvanstaveren)\ **Post date:** [December 6, 2018, 8:56pm UTC](https://community.graylog.org/t/how-to-configure-a-open-source-it-feeds-in-graylog/7889/12 "2018-12-06T20:56:51Z")
Okay, then I’m totally out of ideas, because threat\_intel\_lookup\_\* always returns a true/false so in your case there has to be an EventID\_threat\_indicated field present if you restore the pipeline function to actually do the set\_fields(…) part. Only thing I can think of is that you’re not doing the search correctly but that seems unlikely 🙂 ---
**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\ **Post date:** [December 20, 2018, 8:56pm UTC](https://community.graylog.org/t/how-to-configure-a-open-source-it-feeds-in-graylog/7889/13 "2018-12-20T20:56:55Z")
Closed on December 20, 2018, 8:56pm UTC This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.