All Apps and Add-ons

Why am I getting the error "TAXII polling: 'StatusMessage object has no attribute 'content_blocks'" from SPLICE app?

New Member

Hello Everyone,

I am getting the following error messages from my SPLICE apps

11-11-2014 13:59:33.449 -0800 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/splice/bin/taxii.py" something went wrong with TAXII polling: 'StatusMessage' object has no attribute 'contentblocks'
11-11-2014 13:59:18.141 -0800 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/splice/bin/taxii.py" something went wrong with TAXII polling: 'StatusMessage' object has no attribute 'content
blocks'
11-11-2014 13:59:03.202 -0800 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/splice/bin/taxii.py" something went wrong with TAXII polling: 'StatusMessage' object has no attribute 'content_blocks'

Any idea?

Thanks,
G.

Tags (3)
0 Karma

New Member

Hello,

Thanks for your reply.
Could you please let me know which file to look for exactly.
I was looking at the ../taxii_services/middleware.py file and the original developer proposed the following , but it did not make any difference:
Regards,
G.

#xta = request.META.get('HTTPXTAXII_ACCEPT', None)^M
**
xta = request.META.get('HTTPXTAXIIACCEPT', 'X-TAXII-Content-Type')^M****
if xta is None: # Can respond with whatever we want. try to use the X-TAXII-Content-Type header to pick^**M
xtct = request.META.get('HTTP
XTAXIICONTENTTYPE', None)^M
if xtct == VID
TAXIIXML10:^M
sm = exception.tostatusmessage10()^M
version = VID
TAXIISERVICES10^M
else: # Well, we tried - use TAXII XML 1.1 as a default^M
sm = exception.tostatusmessage11()^M
version = VID
TAXIISERVICES11^M
elif xta == VIDTAXIIXML10:^M
sm = exception.to
statusmessage10()^M
version = VIDTAXIISERVICES10^M
elif xta == VID
TAXIIXML11:^M
sm = exception.tostatusmessage11()^M
version = VID
TAXIISERVICES11^M
else:^M
# For now, just pretend X-TAXII-Accept was TAXII 1.1^M
# Not 100% sure what the right response is... HTTP Unacceptable?^M
# Squash the exception argument and create a new one for unknown HTTP Accept?^M
sm = exception.tostatusmessage11()^M
version = VID
TAXIISERVICES11^

0 Karma

New Member

Hi,

we were getting the same error message when implementing our TAXII server. We found out that it was because we were not sending the X-TAXII-Content-Type HTTP header in response to a Splice TAXII Poll Request.

Splice is using this header to determine the message type and if it's missing it assumes that it's a Status message and later fails when processing the message with the error you describe.

Check that your server returns the correct TAXII headers.

Hope this helps.

0 Karma