Filebeat ThreatIntel MISP Module

[AndreiRD (rediasec)]

Hi,

I'm getting this error while trying to use the misp threat intel module:
[input.httpjson-cursor] v2/request.go:186 error processing response: the requested root field is empty {"input_source": "https://X.X.X.X/events/restSearch/", "input_url": "https://X.X.X.X/events/restSearch/"}

This is the config in filebeat.yml:

filebeat.modules:
    - module: threatintel
  abuseurl.enabled: false
  abusemalware.enabled: false
  malwarebazaar.enabled: false
  anomali.enabled: false
  otx.enabled: false
  misp:
    enabled: true
    var.input: httpjson
    var.url: "https://X.X.X.X/events/restSearch"
    var.api_token: APIKEY
    var.ssl.verification_mode: none
    var.filters:
      - type: ["md5", "sha256", "url", "ip-src", "ip-dst", "domain"]
    var.first_interval: 72h
    var.interval: 60m

Any idea what causes it?

[Marius_Iversen]

Hello @AndreiRD . I added an answer to a similar question here, hope this helps!

Threatintel anomali error: the requested root field is empty

Hi, I gave the threatintel module a try. Successfully ingesting abuseurl, abusemalware and otx. I've a problem with getting anomali to work. First I figured, I have to uncomment the username/password fields to send default guest credentials. But then I get: Apr 21 12:14:47 ingester filebeat[29141]: 2021-04-21T12:14:47.524Z#011INFO#011[input.httpjson-cursor]#011v2/input.go:145#011Input stopped because context was cancelled with: context canceled#011{"input_source": "https://limo.anomali.com/…

[AndreiRD (rediasec)]

Thanks Marius!
I managed to make the misp part work by directly configuring the /etc/filebeat/modules.d/threatintel.yml.disabled and then run filebeat modules enable threatintel . Though, if I use the filtering part, the filebeat service fails to start.
Work in progress...