EDR: Unable to integrate FireEye STIX feeds via the STIX/TAXII connector

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Attempts to configure that TAXII connector with FireEye STIX api feeds and authentication fails with a 403

Environment

• EDR Server: All Versions
• STIX/TAXII Connctor: 1.6.7 and below
• FireEye STIX 2.0 services

Cause

FireEye STIX services use STIX version 2.x.

Resolution

• The Carbon Black TAXII connector currently only supports STIX/TAXII version 1.x
• Future versions of the connector will be developed to include support for STIX/TAXII version 2.x - CB-34095