running MISP-maltego inside (centralized deployment) container about misp-maltego HOT 5 CLOSED

It's excellent if your Plume is running correctly. That indicates all dependencies and so on are fine.

When running as remote transform (like you plan to do) configuration wise the misp_url, and apikey are set in the Maltego client.
You could choose to change this behaviour, and set the variables in the [MISP_maltego.remote] section of the MISP_maltego.conf file so that all users connect with the parameters you have set. If you wish to do so you will need to do a minor patch in util.py#L82. It's only a few lines of code, so no rocket science, a pull-request is welcome.

When making those changes, you will need to restart plume.

Last, but not least, you will have to configure everything too, on your private CTAS. I would recommend you to look at Paterva's documentation on how to do so.
What I did (for the public transforms hosted in the transform hub)

• Paired Configurations: 1 (see here for my notes)
• Entities: 7
• Transform Settings: 2 (except if you choose to patch the code and provide server-side config support)
• Transforms: 14
• Seeds: 1

Then configure the seed in Maltego.

Here are some screenshots of my configuration for the transform hub transforms:

When all is configured:

from misp-maltego.

Thank you Christophe for all the details above - very helpful!

I did follow the notes in here but I must have missed a step on the iTDS server admin page. Based on your screen shots and comments above, I'll revisit my path. It's probably something simple (e.g. connecting the seed to the config name maybe?)

I was starting to believe that I needed to add the transforms manually, but that doesn't appear to be the case if I do this correctly.

Thanks again - will update here with progress.

from misp-maltego.

Afaik it's manual, but for more info you best liaise with Paterva support.

from misp-maltego.

I was able to get this working with your help above. Part of the effort included co-locating the MISP-maltego container alongside the Maltego iTDS and MISP containers, so we could avoid tweaking Maltego-provided yaml files. In the future, we don't have to worry about merging our changes into updated configs from them. (It also has the added benefits of all traffic remaining on-host between them, on a private docker network and references to container names vs. hosts or IP's - nice for trans-portability between platforms).

We are still contemplating which way we will deploy MISP keys (each desktop providing their own, or a single one inside the container). If we decide to centralize, I'll provide an update and PR for you.

Thank you for your time - both in supporting us, and in developing this tool!

from misp-maltego.

Thank you for the update !

from misp-maltego.