MISP Taxii Server
#Threat Defense#Threat Management
A list of most queried domains based on passive DNS usage across the Umbrella global network.
A Collection of Configuration Files for EclecticIQ's OpenTAXII
This is a collection of configuration files designed for use with EclecticIQ's OpenTAXII implementation. It also includes a callback mechanism that activates when data is sent to the TAXII Server's inbox.
Installation Instructions
To manually install, start by cloning the repository:
git clone https://github.com/MISP/MISP-Taxii-Server
cd MISP-Taxii-Server
apt-get install libmysqlclient-dev # This is required for mysql_config
pip3 install -r REQUIREMENTS.txt
Next, you need to set up your TAXII database. Since you are using MISP, you probably already have a MySQL environment running.
Run the following command to access MySQL:
mysql -u [database user] -p # Enter your Database password
Then, execute these commands in the MySQL shell:
mysql> create database taxiiauth;
mysql> create database taxiipersist;
mysql> grant all on taxiiauth.* to 'taxii'@'%' identified by 'some_password';
mysql> grant all on taxiipersist.* to 'taxii'@'%' identified by 'some_password';
mysql> exit;
Now, configure your TAXII server by copying the default configuration file:
cp config/config.default.yaml config/config.yaml
After that, open the newly created config.yaml file. Modify the db_connection parameters to align with your environment. While you are editing, also change the auth_api -> parameters -> secret. Don't forget to set the URL of your MISP server and its API key at the bottom of the file. If desired, you can also adjust the TAXII service settings.
