Threat intel integration

Elastic Security SIEM
1

Team,

I have installed Filebeat 7.14.X agent and have enabled the threatintel module but unable to get feeds from all the threat intel. Could you please help us out on this?

2

You need to go to the filebeat modules folder and set the API keys for each info feed integration, for example: otx.alienvault. If you don't know how, I can explain this in more detail and post some pictures of where to get the API key for each feed site.

Don't forget the "filebeat setup" at the end of the process and restart the service.

3

Hey @wallacepalace,

Thank you for your reply. It would be great if you could share something related to MISP.

1 Like
4

#MeToo - I'm struggling to get the MISP feeds working with my local MISP server.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.