ThreatIntelligence taxii2_client does not honor the proxy settings

Applicability

Description

User configured “Threat intelligence sources” and Proxy Settings for Threat intelligence.

It was found that all the other source types could go though proxy, but only TAXII2 source type does not honor the proxy settings.

Investigation

Reproduced the issue in a reverse way on a splunk instance with direct internet connection: 

1. configured a dummy, non‑functional proxy.

2. All other source types attempted to use the proxy and failed as expected, but TAXII2 bypassed the proxy entirely and continued downloading feeds directly from the internet.

Resolution

This known issue has been fixed in ES8.5.

User could apply following workaround before the upgrading.

1. switch to splunk user

$ sudo su - splunk

2. navigate to /opt/splunk/etc/apps/SA-ThreatIntelligence/bin/taxii2_client

$ cd /opt/splunk/etc/apps/SA-ThreatIntelligence/bin/taxii2_client

3. make a backup of existing python file

$ cp __init__.py __init__.py.bak

4. edit the file

$ vi __init__.py

5. comment out the line below and add a new line after it. Note: use space instead of tab for indentation.

#proxies = {'http': args['proxy']} if args.get('proxy') else None
proxies = args['proxies'] if args.get('proxies') else None

6. compare the new file and old file

$ diff __init__.py __init__.py.bak

It is expected to see the difference like below:

< #proxies = {'http': args['proxy']} if args.get('proxy') else None
< proxies = args['proxies'] if args.get('proxies') else None
---
> proxies = {'http': args['proxy']} if args.get('proxy') else None

7. monitor the log

$ tail -f threatlist.log

8. disable and enable the taxii2 source