Description field mapping limitation for TAXII 2 threat intelligence feeds

Applicability

Description

When threat intelligence is ingested using the TAXII 2 protocol, the `description` attribute contained within the STIX objects is not mapped to the corresponding `description` field in the threat intelligence KV store collections (e.g., `ip_intel`). While the raw logs confirm the data is received from the threat source, the internal STIX parser used for TAXII 2 does not currently support this mapping.

Investigation

1. Confirm the presence of description data in the raw logs for the TAXII 2 download.

2. Inspect the threat intelligence collection using the following command:

| inputlookup ip_intel

3. Observe that the `description` field is empty for indicators associated with the TAXII 2 feed.

4. Verify if the same behavior occurs with TAXII 1; typically, TAXII 1 feeds correctly map the description field.

5. Confirm that custom regex or field extractions are not being applied to the internal threat intelligence ingestion process, as these methods do not affect the internal STIX parser logic.

Resolution

Note that there is currently no alternative mapping configuration or workaround within the TAXII 2 modular input to force the population of the description field.

Related Links

Configure threat intelligence sources in Splunk Enterprise Security