Taxii Connector to RecordedFuture gives an Error "Unable to connect to server...Unexepted Response".

Products

• Carbon Black EDR

Issue/Introduction

When starting the taxii connector services after configuring RecordFuture connection, the following error is seen. 

ERROR - taxii - Unable to connect to server... Unexpected Response. Got Content-Type: 'text/html;charset=utf-8' for Accept: 'application/taxii+json;version=2.1'

Environment

• Carbon Black EDR: All Supported Versions
• Carbon Black Taxii Connector: All Supported Versions

Cause

Configuration is incorrect and Recorded Future is responding with an text/html content type rather than an taxii+json. 

Resolution

Use the following configuration which points to the correct discovery and poll path in /etc/cb/integrations/cbtaxii/cbtaxii.conf

[recordedfuture]
site=api.recordedfuture.com
discovery_path=/taxii
poll_path=/taxii
output_path=/usr/share/cb/integrations/cbtaxii/feeds/
icon_link=/usr/share/cb/integrations/cbtaxii/taxii-logov2.png
username=<recorded future username>
password=<recorded future password>
feeds_enable=true
start_date=2016-11-01 00:00:00
minutes_to_advance=1440