Splunk Enterprise Security

Splunk ES - Threat Intelligence TAXII feed not Working in Splunk Cloud


Hey Guys,

We are in a Splunk Cloud environment with ES, and we have added our own TAXII feed as well as some open source TAXII feeds and we can see that they start "polling" but we never see them download any collection sets or fail in the event logs so it doesn't appear to be working.

Has anyone else configured this in Splunk Cloud and if so do you know if there is something else we need to enable for our TAXII feeds to work?




Not a solution, but I noticed this while trying to integrate taxii feed from MITRE:

The taxii2client in Splunk ES tries to download by default with the latest taxii protocol version (v21?), and MITRE supported only v20.

Tried to download from a Python script using v20 and worked.

New Member

Not intending to drag up an old topic, but I'm interested in knowing what "taxii2client" is referencing?

It's my understanding that the latest versions of Splunk ES do not natively support TAXII v2.

Is this in reference to a custom install of taxii2client from OASIS Open onto a Splunk ES instance, and somehow configuring it to work with feed ingestion to the Intelligence framework/collections?

I've recently been trying to identify the best supported solution for STIX 2.1 feeds, which require TAXII 2 communications, into Splunk ES, so I'm curious about the points made in this discussion and what options have been working.

0 Karma


I'm currently facing the same issue, have you resolved this already? Would you mind sharing the solution if ever? Thanks.

0 Karma
Get Updates on the Splunk Community!

Splunk APM & RUM | Upcoming Planned Maintenance

There will be planned maintenance of the streaming infrastructure for Splunk APM and Splunk RUM in the coming ...

Part 2: Diving Deeper With AIOps

Getting the Most Out of Event Correlation and Alert Storm Detection in Splunk IT Service Intelligence   Watch ...

User Groups | Upcoming Events!

If by chance you weren't already aware, the Splunk Community is host to numerous User Groups, organized ...