Using ThreatStream as a TAXII Client

Using ThreatStream as a TAXII client enables you to aggregate TAXII data in one location and add it to the intelligence you are already receiving on ThreatStream.

The ThreatStream TAXII client can receive data from TAXII 1.x, 2.0, and 2.1 servers.

Getting started with your ThreatStream TAXII Client requires the following steps:

1. Configure one or more TAXII Feeds. TAXII Feeds are dedicated channels for receiving TAXII data on ThreatStream.

   See Managing TAXII Feeds for further guidance.

2. Add a TAXII source that you have access to as a Site on ThreatStream.

   See Managing TAXII Sites for further guidance.

3. If you want to receive TAXII data from the site, configure the collections of interest as Poll Collections.

   If you want to push TAXII data to the site, configure the collections of interest as Push Collections.

   You can configure ThreatStream to poll or push on a regular interval. The data becomes part of your threat intelligence through one of your TAXII Feeds on ThreatStream.

   See Managing TAXII Site Collections for further guidance.

Managing TAXII Sites

The Sites tab enables you to configure and manage communication between ThreatStream and external TAXII sources to which you have access. Configuring a Site on ThreatStream involves authenticating to a Discovery URL for the site. After you have configured a TAXII server site, you can poll data from available collections on the server.

You can configure Poll Collections to poll data into ThreatStream on a regular interval. You can also configure Push Collections to push data from ThreatStream to collections on the site. Data is pushed at a regular cadence and based on a saved search that you specify.

To configure a site:

1. In the bottom-left corner of the side navigation panel, click > ThreatStream and then click TAXII.
   
2. Under Sites, click Actions > Add Site.
3. Enter a meaningful Name for the site.

4. Select a TAXII Version. You can select TAXII 1.1, TAXII 2.0, or TAXII 2.1.

5. Enter the Discovery URL.

6. (Optional) Select required authentication methods.

   If you will use SSL Verification from the site, select Use Site SSL Verification.

   If the site uses basic authentication, select Basic Authentication and enter your credentials for the site

   If the site requires an SSL Two-Way Certificate, select SSL Two-Way Certificate and upload your certificate.

   Note: ThreatStream supports SSL Two-Way Certificates in P12 and PEM format.

7. Click Add Site. ThreatStream will now discover available TAXII feeds on the site.

8. To view discovered feeds, click . The site details are then displayed.

   

   If feed discovery is unsuccessful an error code is displayed. You can click the error code for more information on why the discovery failed.

Managing TAXII Site Collections

After configuring a TAXII source as a site, ThreatStream discovers the collections that are available for you to poll data from and push data to on the site.

Managing TAXII 2.x Site Collections

TAXII 2.x sites can contain multiple API root URLs. In these cases, API roots contain their own poll and push collections. When you configure a TAXII 2.x site, each root URL is available as a secondary tab in the left site menu.

In some cases, API roots use credentials that are distinct from those configured for the site. Entering specific credentials for the root does not overwrite credentials configured for the site.

To configure credentials for an API root:

1. In the bottom-left corner of the side navigation panel, click > ThreatStream and then click TAXII.
   
   

2. Under Sites, locate the TAXII server of interest and click to expand the site details.

3. In the left site menu, select the API root whose credentials you want to configure.

4. Click Edit next to the Username field.

5. Select User API Root specific credentials.

6. Select the required authentication methods:

   • If you will use SSL Verification from the site, select Use Site SSL Verification.

   • If the site uses basic authentication, select Basic Authentication and enter your credentials for the site

   • If the site requires an SSL Two-Way Certificate, select SSL Two-Way Certificate and upload your certificate.

7. Click Save.

The API root credentials have been configured.

Configuring Poll Collections

After authenticating to a TAXII server site, a list of collections available to poll is displayed under Poll Collections.

To configure a poll collection:

1. In the bottom-left corner of the side navigation panel, click > ThreatStream and then click TAXII.
   
   
2. Under Sites, locate the TAXII server of interest and click to expand the site details.
3. A list of discovered collections is available under Poll Collections. To configure a collection, click Configure.
   
   
4. Select a TAXII Feed to associate with the collection. Incoming data will be added to ThreatStream via the TAXII Feed you select.
5. If required, enter your Subscription ID.
6. Enter an Interval to specify the cadence at which ThreatStream will poll data from the feed.
7. Enter a Start From date. This specifies the furthest timestamp you want to be polled. Click Now to use the current date and time.
8. (Optional) When configuring TAXII 1.x sites, you can add more private tags. The following private tag options are available: Indicator Title, Indicator Description, and Simple Marking (can apply to multiple components).
   
   
9. To finish configuration and poll the feed, click Save and Run Now.

After configuring the collection, you can click the Poll Status to view a complete log of poll activity for the collection. Possible poll status values include:

• Complete: The last task run was completed without errors. Click Complete for details.

• Error: The last task run was not completed due to some errors. Click Error for details.

• Resting: The task run was not completed during the time allowed and will be resumed at the next scheduled time. Click Resting for details.

• Running: The task is currently running.

TAXII collection task logs are retained for a period of one year. To view all collection task logs, click the poll status link (any value).

Configuring Push Collections

You can also push data from ThreatStream to available collections on the TAXII server. Pushes can be configured to run on a regular interval and based on saved search filters. To read more about creating saved search filters, see Saving Observable Search Filters.

To configure a push collection:

1. In the bottom-left corner of the side navigation panel, click > ThreatStream and then click TAXII.
   
   
2. Under Sites, locate the TAXII server of interest and click to expand the site details.
3. Click Push Collections.
4. Click New.
5. Under Collection Name, select the collection on the TAXII server to which you want to push.
6. Enter an Interval to specify the cadence at which ThreatStream will push data to the collection.
7. Enter a Start From date. This specifies the furthest timestamp you want to be polled. Click Now to use the current date and time.
8. Select a Saved Search to specify the data you want to push to the collection.
9. If required, enter your Subscription ID.
10. To save the configuration and push data to the collection, click Save and Run Now.

After configuring the push collection, you can click the Push Status to view a complete log of push activity for the collection. Possible push status values include:

• Complete: The last task run was completed without errors. Click Complete for details.

• Error: The last task run was not completed due to some errors. Click Error for details.

• Resting: The task run was not completed during the time allowed and will be resumed at the next scheduled time. Click Resting for details.

• Running: The task is currently running.

TAXII collection task logs are retained for a period of one year. To view all collection task logs, click the push status link (any value).