Troubleshooting TAXII 2.1 Feed Configuration Errors in Threat Intelligence Management

Applicability

Description

The integration fails when the TAXII client cannot locate credentials in the Credential Management store or when the endpoint points to a discovery root instead of a specific collection. The TAXII 2.x client in the SA-ThreatIntelligence application does not support passing credentials via legacy POST arguments, which were utilized in previous versions. Additionally, the client requires a direct path to a specific collection for successful initialization rather than a discovery root endpoint.

Investigation

1. Review the application logs located at: /opt/splunk/etc/apps/SA-ThreatIntelligence/bin/threatlist.py. Note: Splunk Cloud users may need to access these logs via the Splunk Web UI or by searching the _internal index.
2. Execute the following search to identify relevant errors:
   

   index=_internal sourcetype=splunkd 
   | search "taxii" OR "401" OR "Unauthorized" OR "Invalid url" 
   | table _time, source, log_level, message 
   | sort -_time

3. Verify if the logs contain the message: status="No username and password are found". This indicates the client is attempting to poll without an authorization header.
4. Confirm if the configured URL points to a specific collection path. The integration requires the specific collection path for successful polling.

Resolution

Perform the following steps to correct the configuration:

1. Configure Credentials:

   • Navigate to Configure | General | Credentials.
   • Add a new credential with the appropriate username and password.
   • Select SA-ThreatIntelligence as the application.

2. Update Data Source:

   • Navigate to the Data Sources configuration in the Threat Intelligence Management interface.
   • Select the relevant stanza and click Advanced edit.
   • Remove any username or password entries from the POST arguments field.
   • Remove any brackets (e.g., []) from the Workloads field if present.
   • Ensure the Remote Site User field is populated with the credential created in the previous step.
   • Update the URL field to point to the full collection path, for example: https://<server_address>/ctixapi/ctix21/collections/<collection_id>/

3. Verification:

   • Save the configuration.
   • To confirm successful TAXII polling, use the following SPL query. This search looks for the lifecycle events of the polling process, filtering out errors to isolate successful completion messages:
     

     index=_internal (taxii OR threatlist)
     | search "polling starting" OR "polling finished" OR "successfully"
     | search NOT ("ERROR" OR "Exception" OR "Unauthorized" OR "401")
     | table _time, component, log_level, message
     | sort -_time

Related Links

Add a TAXII 2 feed in Splunk Enterprise Security