EDR: What are the poll fields in the TAXII connector config used for?

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

What are the following poll fields used for and how do they map to the service being integrated with?

• discovery_path
• collection_management_path
• poll_path

Environment

• EDR Server: All Versions
• Carbon Black TAXII Connector: All Versions

Resolution

The parameters in the config file tmap one-to-one with the different serivces available for a TAXII 1.x client interacting with a STIX/TAXII 1.X server:

• Discovery Service - Used by a TAXII Client to discover available TAXII Services (e.g., “An Inbox Service is located at http://example.com/inbox_service”).
• Collection Management Service - Used by a TAXII Client to request information about available Data Collections or request a subscription.
• Poll Service - Used by a TAXII Client to request information from a TAXII Server.

 

Additional Information

• The discovery path and polling path are required but the collection management service path is not required. If it is not present in the site-level configuration the connector will attempt to use the configured discovery service to find the right collection paths to use.