EDR: What are the poll fields in the TAXII connector config used for?
search cancel

EDR: What are the poll fields in the TAXII connector config used for?

book

Article ID: 289864

calendar_today

Updated On:

Products

Carbon Black EDR (formerly Cb Response)

Issue/Introduction

What are the following poll fields used for and how do they map to the service being integrated with?
  • discovery_path
  • collection_management_path
  • poll_path

Environment

  • EDR Server: All Versions
  • Carbon Black TAXII Connector: All Versions

Resolution

The parameters in the config file tmap one-to-one with the different serivces available for a TAXII 1.x client interacting with a STIX/TAXII 1.X server:

  • Discovery Service - Used by a TAXII Client to discover available TAXII Services (e.g., “An Inbox Service is located at http://example.com/inbox_service”).
  • Collection Management Service - Used by a TAXII Client to request information about available Data Collections or request a subscription.
  • Poll Service - Used by a TAXII Client to request information from a TAXII Server.

 

Additional Information

  • The discovery path and polling path are required but the collection management service path is not required. If it is not present in the site-level configuration the connector will attempt to use the configured discovery service to find the right collection paths to use.