Hi, we were getting the same error message when implementing our TAXII server. We found out that it was because we were not sending the X-TAXII-Content-Type HTTP header in response to a Splice TAXII Poll Request. Splice is using this header to determine the message type and if it's missing it assumes that it's a Status message and later fails when processing the message with the error you describe. Check that your server returns the correct TAXII headers. Hope this helps. ... View more

Thanks for the answer. We are developing TAXII Poll Service. Both the service and SPLUNK with SPLICE are running in the +01:00 timezone. When SPLICE sends a Taxii Poll request, it always sends Exclusive_Begin_Timestamp with timezone being +00:00. Our service then handles the Poll request and represents the Exclusive_Begin_Timestamp as being one hour in the future. So all the requests return incorrect data because of this time shift. A first version of our TAXII server is about to be launched soon, but no clients using SPLICE can use it unless this timezone problem is fixed so it's a showstopper for us at the moment. Providing the correct timezone in the request would solve our problem. (There are TODO's to add TZ support in the SPLICE souce code.) ... View more