Blog Post

Microsoft Sentinel Blog
5 MIN READ

Integrating open source threat feeds with MISP and Sentinel

robeving's avatar
robeving
Icon for Microsoft rankMicrosoft
May 14, 2020
Recently, Microsoft released an open source set of malicious file hash indicators identified as using COVID-19 themed malicious email attachments in attempted attacks against our customers. Office365...
Updated Nov 03, 2021
Version 2.0
detection
hunting
investigation
microsoft sentinel
security
robeving's avatar
Icon for Microsoft rankMicrosoft
Joined April 02, 2020
View Profile
Microsoft Sentinel Blog

Microsoft Sentinel is a cloud-native SIEM, enriched with AI and automation to provide expansive visibility across your digital environment.

AlexReid2200's avatar
AlexReid2200
Copper Contributor
Jun 01, 2022

I am having a strange issue. I have set this up and ran the first run work perfectly. after that it seems to get stuck 

The Output is 

"fetching & parsing data from misp...
/usr/lib/python3/dist-packages/urllib3/connectionpool.py:999: InsecureRequestWarning: Unverified HTTPS request is being made to host '172.17.0.7'. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#ssl-warnings
warnings.warn(
/usr/lib/python3/dist-packages/urllib3/connectionpool.py:999: InsecureRequestWarning: Unverified HTTPS request is being made to host '172.17.0.7'. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#ssl-warnings
warnings.warn(
/usr/lib/python3/dist-packages/urllib3/connectionpool.py:999: InsecureRequestWarning: Unverified HTTPS request is being made to host '172.17.0.7'. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#ssl-warnings
warnings.warn(
/usr/lib/python3/dist-packages/urllib3/connectionpool.py:999: InsecureRequestWarning: Unverified HTTPS request is being made to host '172.17.0.7'. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#ssl-warnings
warnings.warn( "

then is just stops and does not move. 

I have waited over an hour and no movement.

the CPU is not working about 35% the network is low but the disk seems to be working hard. 

the MISP server and the solution server are the same host. is this the issue?

please advise