External Threat Feed: Cisco ESA integration with MISP

[beVa]

Hi all,

I want to access our IOCs on the MISP with the Cisco ESA. The ESA asks me for the "polling path" and the "collection name". Does any one know how to find out this information?

Thank you!

[Nasreen Al Haddad]

Hello ,

You can follow the steps in the below guide  in order to get those details 

https://docs.ces.cisco.com/docs/ecurex-cisco-threat-response-private-intelligence-feeds

Hope this helps 

[Ken Stieers]

That's so MISP can see what you may have created judgements for in SecureX
He's looking for making it so ESA can poll MISP for indicators that it has collected...

[Ken Stieers]

>From what I could tell from a quick look at the MISP documentation, I'm not sure MISP has a TAXII server, but I could be wrong.
You probably want to ask in the MISP community if the platform has a TAXII server and what the path/collection names are.