TAXII collector

[ 1 Overview ] [ 2 Devo collector features ] [ 3 Data sources ] [ 4 Flattening preprocessing ] [ 5 Vendor setup ] [ 6 Minimum configuration required for basic pulling ] [ 7 Accepted authentication methods ] [ 8 Run the collector ] [ 9 Collector services detail ] [ 10 Collector operations ] [ 11 Change log ]

Overview

Trusted Automated Exchange of Intelligence Information (TAXII™) is an application protocol for exchanging CTI over HTTPS. TAXII defines a RESTful API (a set of services and message exchanges) and a set of requirements for TAXII Clients and Servers.

Devo collector features

Feature	Details

Feature	Details
Allow parallel downloading (`multipod`)	`not allowed`
Running environments	`collector server` `on-premise`
Populated Devo events	`table`
Flattening preprocessing	`no`

Data sources

Data source	Description	API endpoint	Collector service name	Available from release

Data source

Description

API endpoint

Collector service name

Available from release

Objects and Manifests

STIX Objects data and metadata of objects

collection.get_objects()

collection.get_manifests()

objects_and_manifests

v1.0.0

For more information on how the events are parsed, visit our page.

Flattening preprocessing

Data source	Collector service	Optional	Flattening details

Data source	Collector service	Optional	Flattening details
Objects and Manifests	`objects_and_manifests`	`no`	No flattening

Vendor setup

Several vendors offer the TAXII protocol, this guide uses Cyware as an example. You’ll need:

Access to Cyware TAXII server or any TAXII server with version 2.0 or 2.1
In order to retrieve the data, we need the discovery URL for the TAXII server and the required credentials.

Actions	Screenshots

Actions

Screenshots

Create a Cyware account.

-

Click on Cyware threat intel feed from the profile dropdown in the top right.

Click on Grant access. You will see the credentials on the next screen. Save the credentials, as they will be shown only once.

Minimum configuration required for basic pulling

Important

Before using the collector, it is necessary to find out what version of the protocol the TAXII server is using. We are able to pull data from versions 2.1 and 2.0.

Some servers are able to offer data using both versions, using different URL. Check that there is a correspondence between the URL and the version of the protocol that the collector expects. Although this collector supports advanced configuration, the fields required to retrieve data with basic configuration are defined below.

This minimum configuration refers exclusively to those specific parameters of this integration. There are more required parameters related to the generic behavior of the collector. Check setting sections for details.

Setting	Details

Setting	Details
`discovery_url`	the Discovery URL of the TAXII server
`username`	credential username
`password`	credential password
`taxii_version`	2.0 or 2.1

See the Accepted authentication methods section to verify what settings are required based on the desired authentication method.

Accepted authentication methods

Depending on how you obtained your credentials, you will have to either fill or delete the following properties on the JSON/YAML credentials configuration block.

Authentication method	Username	Password

Authentication method	Username	Password
Username/Password	Required	Required

Run the collector

Collector services detail

This section is intended to explain how to proceed with specific actions for services.

Events service

Collector operations

This section is intended to explain how to proceed with specific operations of this collector.

Change log

Release	Released on	Release type	Details	Recommendations

Release

Released on

Release type

Details

Recommendations

v1.1.0

Apr 15, 2024

iMPROVEMENTS

bug fixes

Upgraded DCSDK from 1.8.0 to 1.11.1:

Refactored Collector Definitions to include metadata and some service specific json schemas
Refactored Base puller to find the right collector variables
Refactored the abstract methods, removing unused ones and updating old ones to match Template1 puller
Updated DevoSDK to v5.1.9
Fixed some bug related to development on MacOS
Added an extra validation and fix when the DCSDK receives a wrong timestamp format
Added an optional config property for use the Syslog timestamp format in a strict way
Updated DevoSDK to v5.1.10
Fix for SyslogSender related to UTF-8
Enhace of troubleshooting. Trace Standardization, Some traces has been introduced.
Introduced a mechanism to detect "Out of Memory killer" situation
Updated DevoSDK to v5.1.9
Fixed some bug related to development on MacOS
Added an extra validation and fix when the DCSDK receives a wrong timestamp format
Added an optional config property for use the Syslog timestamp format in a strict way

Bug Fixes

Fix the issue with Historic time utc which was causing error in API calls

Recommended version

v1.0.0

Jun 22, 2023

NEW FEATURE NEW FEATURE

-

Initial release