Creating Feeds

[Anonymous]

i have been tasked with compiling feeds based on known bad hosts that we receive a list from. The list has 3 parts, ip’s, fqdn’s, hashes.  I’ve been able to compile a feed for the ip information but I am unable to do the same for the hostnames.  Nwconsole fails to compile the .feed file.

Ive done some looking through the administrator documents relating to the feeds but cant seem to find if I am doing it wrong with the language, etc.

thanks

Mark

[JonathanSaxon · Accepted solution]

A feed can fail to compile due to syntax or xml formatting errors. 

Please take a look at Primus article a58924, "Manually Compiling and Deploying Custom Feeds" and Primus atricle a59743, "Creating and Deploying Custom Feeds Using Live Manager 2.x" for additional details.

If you can create a case through SCOL/Case Management we can take a quick look at the feed files and see if there are any obvious errors. 

If the files aren't sensitive, consider posting there as others may be able to review as well. 

Access SCOL at https://knowledge.rsasecurity.com or call 800.995.5095, Option 9. 

[Anonymous]

ok i think i have found the error i didnt have anything for metacallback.

so can i assume that there is no way to search the incoming packet data for md5 hashes?

[RSAAdmin]

If MD5 hashes are transmitted in the payload of a TCP packet, then sure.  But that's not the way the protocol works.  Some applications might communicate that way-  for instance between sandboxes-  and if its a cleartext protocol thats being captured a parser can be created to capture this meta. 

But it is my experience that MD5 hashes on files is not a good way to hunt for malware- 

What is your goal?  To look for new malware?