Splunk Enterprise Security

Splunk ES - Threat Intelligence TAXII feed not Working in Splunk Cloud


Hey Guys,

We are in a Splunk Cloud environment with ES, and we have added our own TAXII feed as well as some open source TAXII feeds and we can see that they start "polling" but we never see them download any collection sets or fail in the event logs so it doesn't appear to be working.

Has anyone else configured this in Splunk Cloud and if so do you know if there is something else we need to enable for our TAXII feeds to work?




Not a solution, but I noticed this while trying to integrate taxii feed from MITRE:

The taxii2client in Splunk ES tries to download by default with the latest taxii protocol version (v21?), and MITRE supported only v20.

Tried to download from a Python script using v20 and worked.

New Member

Not intending to drag up an old topic, but I'm interested in knowing what "taxii2client" is referencing?

It's my understanding that the latest versions of Splunk ES do not natively support TAXII v2.

Is this in reference to a custom install of taxii2client from OASIS Open onto a Splunk ES instance, and somehow configuring it to work with feed ingestion to the Intelligence framework/collections?

I've recently been trying to identify the best supported solution for STIX 2.1 feeds, which require TAXII 2 communications, into Splunk ES, so I'm curious about the points made in this discussion and what options have been working.

0 Karma


I'm currently facing the same issue, have you resolved this already? Would you mind sharing the solution if ever? Thanks.

0 Karma
Get Updates on the Splunk Community!

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...