EDR: TAXII connector repeatedly pulls the same IOCs.

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• TAXII continues to pull down the same IOCs and does not identify new IOCs.

Environment

• EDR Server: 7.5.0 - 7.6.1
• TAXII: 2.0

Cause

Appears to be an issue where an additional query parameter is needed to pick up only the IOCS added after the last check time or were updated.

Resolution

CB-38343 (2022-02-14) has been created to address the issue.  The expectation is TAXII will pull new or updated IOCs.