Splunk ES - Threat Intelligence TAXII feed not Working in Splunk Cloud

[sheenay]

Hey Guys,

We are in a Splunk Cloud environment with ES, and we have added our own TAXII feed as well as some open source TAXII feeds and we can see that they start "polling" but we never see them download any collection sets or fail in the event logs so it doesn't appear to be working.

Has anyone else configured this in Splunk Cloud and if so do you know if there is something else we need to enable for our TAXII feeds to work?

Thanks!

[Laszlo_K]

Not a solution, but I noticed this while trying to integrate taxii feed from MITRE:

The taxii2client in Splunk ES tries to download by default with the latest taxii protocol version (v21?), and MITRE supported only v20.

Tried to download from a Python script using v20 and worked.

[Scentri]

Not intending to drag up an old topic, but I'm interested in knowing what "taxii2client" is referencing?

It's my understanding that the latest versions of Splunk ES do not natively support TAXII v2.

Is this in reference to a custom install of taxii2client from OASIS Open onto a Splunk ES instance, and somehow configuring it to work with feed ingestion to the Intelligence framework/collections?

I've recently been trying to identify the best supported solution for STIX 2.1 feeds, which require TAXII 2 communications, into Splunk ES, so I'm curious about the points made in this discussion and what options have been working.

[dantimola]

I'm currently facing the same issue, have you resolved this already? Would you mind sharing the solution if ever? Thanks.