Unable to see the feed from TAXII Server

%3CLINGO-SUB%20id%3D%22lingo-sub-1847387%22%20slang%3D%22en-US%22%3EUnable%20to%20see%20the%20feed%20from%20TAXII%20Server%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1847387%22%20slang%3D%22en-US%22%3E%3CP%3EWe%20have%20developed%20the%20TAXII%202.1%20server%20as%20per%20the%20protocol%20mentioned%20in%20the%20documentation%20from%20TAXII%3A%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Foasis-open.github.io%2Fcti-documentation%2Ftaxii%2Fintro.html%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Foasis-open.github.io%2Fcti-documentation%2Ftaxii%2Fintro.html%26nbsp%3B%3C%2FA%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAnd%20we%20successfully%20configured%20our%20TAXII%20in%20the%20Azure%20sentinel%20as%20mentioned%20in%20the%20doc%3A%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fsentinel%2Fimport-threat-intelligence%23adding-threat-indicators-to-azure-sentinel-with-the-threat-intelligence---taxii-data-connector%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fsentinel%2Fimport-threat-intelligence%23adding-threat-indicators-to-azure-sentinel-with-the-threat-intelligence---taxii-data-connector%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EBut%20when%20we%20tried%20to%20look%20at%20the%20incoming%20feeds%2C%20it's%20zero.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ESample%20received%20Feeds%20Looks%20like%20this%3A%3C%2FP%3E%3CP%3E%7B%3CBR%20%2F%3E%22more%22%3A%20true%2C%3CBR%20%2F%3E%22objects%22%3A%20%5B%3CBR%20%2F%3E%7B%3CBR%20%2F%3E%26nbsp%3B%20%23%20Threat%20Feed%3C%2FP%3E%3CP%3E%7D%3CBR%20%2F%3E%5D%2C%3CBR%20%2F%3E%22spec_version%22%3A%20%222.0%22%2C%3CBR%20%2F%3E%22type%22%3A%20%22bundle%22%3CBR%20%2F%3E%7D%3C%2FP%3E%3CP%3E%3CSTRONG%3ENote%3A%20We%20are%20using%20the%20Basic%20Auth%3C%2FSTRONG%3E%3C%2FP%3E%3CP%3ECan%20someone%20please%20assist%20me%20in%20what%20went%20wrong%20and%20how%20I%20can%20fix%20the%20same%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks%20in%20advance.%3C%2FP%3E%3C%2FLINGO-BODY%3E
Occasional Visitor

We have developed the TAXII 2.1 server as per the protocol mentioned in the documentation from TAXII: https://oasis-open.github.io/cti-documentation/taxii/intro.html 

 

And we successfully configured our TAXII in the Azure sentinel as mentioned in the doc: https://docs.microsoft.com/en-us/azure/sentinel/import-threat-intelligence#adding-threat-indicators-... 

 

But when we tried to look at the incoming feeds, it's zero.

 

Sample received Feeds Looks like this:

{
"more": true,
"objects": [
{
  # Threat Feed

}
],
"spec_version": "2.0",
"type": "bundle"
}

Note: We are using the Basic Auth

Can someone please assist me in what went wrong and how I can fix the same?

 

Thanks in advance.

0 Replies