Threat Intel MISP

Elastic Stack Beats
1

I'm trying to use Threat Intel MISP on filebeat and when i start the filebeat i have this error

Aug 17 14:11:20 ubuntuserver filebeat[18895]: {"log.level":"error","@timestamp":"2022-08-17T14:11:20.550Z","log.logger":"input.httpjson-cursor.retryablehttp","log.origin":
{"file.name":"go-retryablehttp@v0.6.6/client.go","file.line":553},"message":"request failed","service.name":"filebeat","id":"81BF425127182E05",
"input_source":"https://192.168.100.62/events/restSearch","input_url":"https://192.168.100.62/events/restSearch",
"error":{"message":"Post "https://192.168.100.62/events/restSearch\": x509: certificate signed by unknown authority"},
"method":"POST","url":"https://192.168.100.62/events/restSearch","ecs.version":"1.6.0"}

I did filebeat test config and filebeat test output and is all good.

Any solution for this problem?

2

This is my configurations:

Filebeat.yml

configuration kibana: host:"192.168.100.60:5601"
configuration elastic:
hosts: ["192.168.100.60:9200"]
protocol: "https"
username: "elastic"
password: "password"
ssl:
enabled: true
ca_trusted_fingerprint: ""

threat Intel MISP:
misp:
enabled: true
var.input: httpjson
var.url: https://192.168.100.62/events/restSearch
var.api_token: 2ovd1ynjIMkEzCd9oA9DvumnQLweeYnCMtKQqtZl
var.first_interval: 200000h
var.interval: 5m

3

Have you used self-signed certificate?

4

I resolve this problem.
Another problem i have is i can't receive the data for my misp instance.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.