EDR: Unable to integrate FireEye STIX feeds via the STIX/TAXII connector
book
Article ID: 289636
calendar_today
Updated On:
Products
Carbon Black EDR (formerly Cb Response)
Issue/Introduction
Attempts to configure that TAXII connector with FireEye STIX api feeds and authentication fails with a 403
Environment
- EDR Server: All Versions
- STIX/TAXII Connctor: 1.6.7 and below
- FireEye STIX 2.0 services
Cause
FireEye STIX services use STIX version 2.x.
Resolution
- The Carbon Black TAXII connector currently only supports STIX/TAXII version 1.x
- Future versions of the connector will be developed to include support for STIX/TAXII version 2.x - CB-34095
Feedback
thumb_up
Yes
thumb_down
No