Hosted EDR: How to Enable the STIX/TAXII Connector
book
Article ID: 291080
calendar_today
Updated On:
Products
Carbon Black EDR (formerly Cb Response)
Issue/Introduction
To enable the STIX/TAXII connector in a Hosted EDR instance for integration with XSOAR products (like FS-ISAC, hailataxii, and Anomali)
Environment
- Hosted EDR: All Versions
- STIX/TAXII connector
- XSOAR integrations
Resolution
- Confirm that an unfiltered TCP path exists between the TAXII endpoint and the Hosted EDR instance.
- The port to be used for communication should be open.
- The firewall exceptions should be added appropriately.
- Open a Carbon Black support case.
- Information to be added to the case:
- Host-name of the Hosted EDR instance
- Port of the TAXII endpoint
- "Discovery_Path" of the TAXII endpoint
- Username and password to authenticate to the endpoint
- (Optional) A self-signed certificate attached to the case
- (Optional) CA-signed certificate with the CA chain of trust both attached to the case
- (Optional) The "collection_management_path"
- (Optional) The "poll_path"
- (Optional) "Collections" for the TAXII endpoint
- Confirm that the TAXII connector is working appropriately after integration.
Additional Information
- The "discovery_path" is typically provided by the TAXII service provider. It is the path where the API discovers the different data sources.
Feedback
thumb_up
Yes
thumb_down
No