EDR: Unable to integrate FireEye STIX feeds via the STIX/TAXII connector
search cancel

EDR: Unable to integrate FireEye STIX feeds via the STIX/TAXII connector

book

Article ID: 289636

calendar_today

Updated On:

Products

Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Attempts to configure that TAXII connector with FireEye STIX api feeds and authentication fails with a 403

Environment

  • EDR Server: All Versions
  • STIX/TAXII Connctor: 1.6.7 and below
  • FireEye STIX 2.0 services

Cause

FireEye STIX services use STIX version 2.x.

Resolution

  • The Carbon Black TAXII connector currently only supports STIX/TAXII version 1.x
  • Future versions of the connector will be developed to include support for STIX/TAXII version 2.x - CB-34095