Replies: 10 comments 3 replies
-
|
How did you install IntelMQ and which operating system do you use? Can you please open the developer tools (Ctrl+Shift+I), switch to the network tab, load or the page triggering the error and paste the response of the request |
Beta Was this translation helpful? Give feedback.
-
|
I am using ubuntu. |
Beta Was this translation helpful? Give feedback.
-
|
Thanks for sharing your observation. If it happens again, the information I mentioned above would be helpful. cc @waldbauer-certat because of Docker |
Beta Was this translation helpful? Give feedback.
-
|
Sure I'll |
Beta Was this translation helpful? Give feedback.
-
|
Request URL: http://127.0.0.1:1337/intelmq/v1/api/login Again got the same error |
Beta Was this translation helpful? Give feedback.
-
|
That's the request from the browser, not the response from the server. Did the webserver logs show anything in the error log? |
Beta Was this translation helpful? Give feedback.
-
|
Thanks for your support I got the issue it was with my docker. I have another confusion. |
Beta Was this translation helpful? Give feedback.
-
What do you miss? The file output bot writes all events to the file that it receives. You configure IntelMQ, i.e. which feeds you want to process yourself. At https://intelmq.readthedocs.io/en/latest/user/feeds.html you can find a big list of possible feeds which you can add to IntelMQ and connecto to your file output bot instance. |
Beta Was this translation helpful? Give feedback.
-
|
I am looking for Indicator of compromise (IOC).
Does INTELMQ provide the IOC in the events file.
I have configured all that already. But I am looking forward to see IOC.
…On Tue, Sep 13, 2022 at 1:03 PM Sebastian ***@***.***> wrote:
I am getting the events file but in events file ioc are missing. Where I
can find the ioc.?
What do you miss?
The file output bot writes all events to the file that it receives. You
configure IntelMQ, i.e. which feeds you want to process yourself. At
https://intelmq.readthedocs.io/en/latest/user/feeds.html you can find a
big list of possible feeds which you can add to IntelMQ and connecto to
your file output bot instance.
—
Reply to this email directly, view it on GitHub
<#2243 (reply in thread)>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/A27QIVIADBT2NPNPIAOP7HLV6AYNVANCNFSM6AAAAAAQLFPPH4>
.
You are receiving this because you authored the thread.Message ID:
***@***.***>
|
Beta Was this translation helpful? Give feedback.
-
|
What Indicators are you looking for? There are many data feeds, see the link that I posted above, all providing different data (= Indicators of Compromise). |
Beta Was this translation helpful? Give feedback.
-
|
[image: Screenshot from 2022-09-13 13-17-47.png]
I have already configured the feeds. And I am getting data from a lot of
different feeds. But I am getting only the event information. Just as like
{"classification.taxonomy": "malicious-code", "classification.type":
"c2-server", "feed.accuracy": 100.0, "feed.name": "Feodo Tracker Browse",
"feed.provider": "Abuse.ch", "feed.url": "
https://feodotracker.abuse.ch/browse", "malware.name": "qakbot",
"source.allocated": "2009-05-06T00:00:00+00:00", "source.as_name":
"WINDSTREAM, US", "source.asn": 7029, "source.geolocation.cc": "US",
"source.ip": "173.189.167.21", "source.network": "173.189.164.0/22",
"source.registry": "ARIN", "status": "Online", "time.observation":
"2022-09-09T12:42:05+00:00", "time.source": "2022-09-08T12:43:34+00:00"}
This is the one the feed I got. I am looking forward to see the Indicator
of Compromise(IOC). But unable to figure out where I can find this.
…On Tue, Sep 13, 2022 at 1:15 PM Sebastian ***@***.***> wrote:
*What* Indicators are you looking for? There are many data feeds, see the
link that I posted above, all providing different data (= Indicators of
Compromise).
What are you trying to achieve in the bigger picture?
—
Reply to this email directly, view it on GitHub
<#2243 (reply in thread)>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/A27QIVNXRAI2FWZEDGEZASTV6AZ2FANCNFSM6AAAAAAQLFPPH4>
.
You are receiving this because you authored the thread.Message ID:
***@***.***>
|
Beta Was this translation helpful? Give feedback.
-
|
The event you posted says: If this is not what you are looking for, what is it? |
Beta Was this translation helpful? Give feedback.
-
|
Thank you for your reply. I was not more familiar with feed.
I got my confusion cleared.
…On Tue, Sep 13, 2022 at 1:23 PM Sebastian ***@***.***> wrote:
The event you posted says:
The device with the IP address 173.189.167.21 is hosting a C2 Server of
the Malware qakbot.
If this is not what you are looking for, what is it?
—
Reply to this email directly, view it on GitHub
<#2243 (reply in thread)>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/A27QIVNSFKVEADJY43FEOTTV6A2YNANCNFSM6AAAAAAQLFPPH4>
.
You are receiving this because you authored the thread.Message ID:
***@***.***>
|
Beta Was this translation helpful? Give feedback.
-
When I start the collectors. For sometime it work fine. But after sometime it keeps on loading. When tried Logout and login. Show this error.
Beta Was this translation helpful? Give feedback.
All reactions