EDR: What are the poll fields in the TAXII connector config used for?
book
Article ID: 289864
calendar_today
Updated On:
Products
Carbon Black EDR (formerly Cb Response)
Issue/Introduction
What are the following poll fields used for and how do they map to the service being integrated with?
discovery_path
collection_management_path
poll_path
Environment
EDR Server: All Versions
Carbon Black TAXII Connector: All Versions
Resolution
The parameters in the config file tmap one-to-one with the different serivces available for a TAXII 1.x client interacting with a STIX/TAXII 1.X server:
Discovery Service - Used by a TAXII Client to discover available TAXII Services (e.g., “An Inbox Service is located at http://example.com/inbox_service”).
Collection Management Service - Used by a TAXII Client to request information about available Data Collections or request a subscription.
Poll Service - Used by a TAXII Client to request information from a TAXII Server.
Additional Information
The discovery path and polling path are required but the collection management service path is not required. If it is not present in the site-level configuration the connector will attempt to use the configured discovery service to find the right collection paths to use.