Dear All, I need to configure third-party opensource in our Graylog server. I am using graylog 2.5 in my environment. I want to implement a below framework in my graylog. Someone, please confirm how to do this. I am new in the graylog application. C1fApp Megatron Cymon VirusTotal Thanks.

I’m very interested in what your possible use-case is here. It looks like you’re wanting to gather threat intelligence into Graylog. But what exactly is it that you need? Are you looking to correlate things like IP addresses to known bad actors? Or do you want their daily information feeds? Etc.

Yes, i want to gather threat intelligence to graylog, need daily information feeds.

Well, not to be too blunt, but here’s your best place to start: [image] LMGTFY LMGTFY

Dear @Totally_Not_A_Robot , Thank you for your quick reply :+1:. Here I have to mention Threat intelligence feed configuration. I have a created a Pipeline called “Threat Intelligence Lookup” and added streams and timeline as per the TI feed and added a new rule called “Threat Intelligence Lookups:…

[image] prakasha: To search for EventID matches, I run the following query: EventID_threat_indicated: true as per the https://www.graylog.org/post/integrating-threat-intelligence-with-graylog URL. Aha! So you are using the built-in TI plugin. That’s an important detail; based on your opening …

Dear @Totally_Not_A_Robot , I want to implement those as well. but i am trying default plugins for TI feed reference configuration. OTX API key has been added the same. [OTX%20API%20Key]

Then one extra test you can do is see whether the API connection actually works from the Graylog box. Can you use curl or wget from the command line to interact with the feed? This will allow you to troubleshoot the network connection from the Graylog host to the OTX API. You’ll verify whether proxi…

Actually here’s another test, for shits and giggles. Empty the rule body where you do the threat lookup, and add another stage to the pipeline after the stage where the now-empty threat lookup rule lives. See if that blank stage has any throughput. If it doesn’t, no messages carry an EventID field a…

@benvanstaveren , I tried the same what you suggested, i am getting throughput from the pipeline.

How to configure a open source IT feeds in graylog

Graylog Central (peer support)

jan (Jan Doberstein) December 6, 2018, 7:36am 10

For debugging we have the debug function:

http://docs.graylog.org/en/2.5/pages/pipelines/functions.html#debug

Topic		Replies	Views
Threat Intelligence Lookups Supported by Graylog Graylog Central (peer support)	7	1727	October 4, 2022
Threat Intelligence Throughput in Graylog Graylog Central (peer support)	2	441	May 22, 2020
Alienvault OTX Missing - Threat Intel Plugin - Graylog 2.4.4 Graylog Central (peer support)	7	2908	May 22, 2018
Setting up Threat Intelligence To Use OTX in 2.4.x Graylog Add-ons	5	3838	January 25, 2018
Trying to get the Open Threat Exchange - Threat intel plugin working on a Graylog Graylog Central (peer support) pipeline-rules	10	1422	June 25, 2021

How to configure a open source IT feeds in graylog

Related topics