An Inbound TAXII™ Exchange Feed ingests STIX™ (Structured Threat Information eXpression)–formatted data from a TAXII server.
- Log in with an Owner account valid for the desired Source.
- On the top navigation bar (Figure 1), click POSTS to access the Posts screen (Figure 2).
- From the HOME dropdown menu, or from the Intelligence Sources menu on the left-hand side of the page, select a Source, and the Source Profile screen will appear (Figure 3).
- Click on the Source Config icon, and the Source Config screen will appear with the Attribute Types tab selected (Figure 4).
- Click the Data tab, and the Data screen will appear (Figure 5).
- Click the + NEW INBOUND button, and the Configure Inbound TAXII Exchange window will appear with the TAXII tab highlighted (Figure 6).
- Name: Click inside the box to enter a name.
- URL: Click inside the box to enter a URL.
- Discovery URL: Click inside the box, if applicable, to enter a Discovery URL.
- Stix Parser: Use the dropdown menu to choose the STIX parser to use in the feed. The default option is the legacy Native Parser, which replaces Attributes. STIX 1.1.1 Parser also replaces Attributes. STIX 1.1.1 Parser (Attribute Merge) appends Attributes. See STIX and CybOX Parser Data Mappings for the data mappings that apply to the STIX 1.1.1 parser.
- Parser Version: If an option other than Native Parser has been selected under the Stix Parser dropdown menu, then this field will not be available. If Native Parser has been selected, click the dropdown menu to choose the parser version. STIX 1.1.1 Indicators TC_V1 (Legacy Parser) is used for parsing STIX indicators generated by Soltra or STIX Indicators whose cybox:objects are located in separate STIX packages and connecting them via idref. STIX 1.1.1 Indicators TC_V2 is used for parsing ThreatConnect outbound TAXII server data.
- Exchange is Active: Click on the gray rectangle to toggle between Yes and No.
- TAXII Version 1.0: Click on the gray rectangle to toggle between No and Yes. A selection of No indicates that TAXII Version 1.1 is to be used.
- Default Threat Rating: Click the checkbox to enter a default Threat Rating. Five skulls will appear. Select the number of skulls to assign a Threat Rating.
NOTE: It is highly recommended to assign a Default Threat Rating value at this time for follow-on analyst workflows, applications, or Playbooks that may need to query for Indicators.
- Default Confidence Rating: Click the checkbox to enter a default Confidence Rating. A slide will appear. Move the button to assign a Confidence Rating.
NOTE: It is highly recommended to assign a Default Confidence Rating value at this time for follow-on analyst workflows, applications, Indicator deprecation, or Playbooks that may need to query for Indicators.
- URL: Verify that the URL displayed is the one entered in the previous step.
- Username and Password: Click in the boxes to enter each field.
- Enable 2-way Authentication: Click on the gray rectangle and toggle to Yes to provide a Certificate. Provide the Private Key and Certificate found in the .pem certificate file. If the certificate in the .pem certificate file is not in Private Key PKCS#8 format, then it will need to be converted before it is entered into ThreatConnect.
- TEST CONNECTION: Click on this button to test the connection if the remote TAXII server allows for connection testing.
- If the connection was tested and successful, the Available Services table will be populated. Select the appropriate Service if applicable.
- Feed: If applicable, click inside the box to enter the desired feed name or the feed name provided by the administrator of the remote TAXII server. If no feed name has been entered, clicking on Check for available feeds and then selecting a feed from the table will populate this field.
- Subscription: If applicable, click inside the box to enter a subscription ID.
- Check for available feeds: If the remote TAXII server allows for this functionality, click on the blue text to view a table of available feeds. Choose a feed from the table and then click the Select Feed button to populate the Feed field with the information for that feed.
- Next Execution Time: This field determines the date on which the TAXII server will start polling data. Click in the box, and a calendar will pop up to select the date and time.
- Collection Interval: This field defines the time period for which information is to be pulled during the polling request. Click inside the box to manually change the time, or use the plus and minus signs to set the time (in hours).
- Initialize Data From: This field overrides the Collection Interval to pull in data from the given date in the initial request. It is typically left blank, but can be set if required. Click in the box, and a calendar will pop up to select the date.
NOTE: Do not choose an initial date that will cause the data retrieved to exceed the import limit for file size. See the ThreatConnect System Administration Guide or consult your System Administrator for more information about file size limits for import.
- Log Document Name: Click in the box to enter a name.
- Would you like to save all inbound messages: If document storage has been allocated for the Source, click on the gray rectangle to toggle it to Yes.
CybOX™, STIX™, and TAXII™ are trademarks of The MITRE Corporation.