After you create the extractor configuration and connection configuration files, you
can push the Hail a TAXII feeds from the TAXII server into HBase.
-
Push the Hail a TAXII feeds from the TAXII server into HBase:
$METRON_HOME/bin/threatintel_taxii_load.sh -b <START_TIME> -c $METRON_HOME/config/threatintel_connection_config.json
-e $METRON_HOME/config/threatintel_extractor_config.json -p <TIME_INTERVAL_MSECS>
For example:$METRON_HOME/bin/threatintel_taxii_load.sh -b "2016-08-01 00:00:00" -c $METRON_HOME/config/threatintel_connection_config.json -e $METRON_HOME/config/threatintel_extractor_config.json -p 10000
-
Remove any non-ASCII invisible characters that might have been included if you
copy and pasted:
iconv -c -f utf-8 -t ascii threatintel_extractor_config_temp.json -o
threatintel_extractor_config.json