crits/crits_services — pull request #18 by maurakilleen (2014-06-19 16:56:36+00:00)
Title: Enable TAXII Service to Communicate With TAXI 1.1 (Should Maintain 1.0 Functionality)

I took a stab at updating the current taxii_service to communicate over 1.1, and tested this with our internal TAXII servers. In order to preserve the existing 1.0 capabilities, I do assume that the server will return a non-200 response to requests with incorrect messaging versions. I know that the ideal way to determine the version would be via the discovery service, but I know of at least one implementation that does not support discovery, and I wanted to make this as flexible as possible. I also enabled the service to communicate over HTTP, so if anyone without access to a private TAXII server wants to test the new functionality out, that can be done with public servers such as taxiitest.mitre.org. To set everything up:

1) Install a version of libtaxii that supports 1.1 messaging, such as https://github.com/TAXIIProject/libtaxii/releases/tag/1.1.101

2) Install the new taxii_service (and remove the old service config entry from mongo, if necessary)

3) Create a source to represent the data feed, add that source to your user account, and mark an event you want to export (and any related content) as releasable to that source

4) Generate any necessary certificates or transfer them onto the CRITs server (you will need at least one to encrypt the exported data)

5) On the Service Configuration page in the Control Panel, enter the hostname (such as "taxiitest.mitre.org"), enter the data feed that you want to poll from (such as "default" on taxiitest.mitre.org), select whether or not to use HTTPS (uncheck for taxiitest.mitre.org), enter the paths to your certfile/keyfile if using HTTPS (leave blank for taxiitest.mitre.org), and enter a comma separated list of your new source, the corresponding feed name, and the path to the encryption certificate on disk

6) Enable the service and run it from the analysis page of your releasable event (it will not be stored by taxiitest.mitre.org)

7) From the main menu, navigate to the Services > Taxii Agent page to request all content since the last successful retrieval (there are two sample documents with indicators on the default feed at taxiitest.mitre.org)

I am sure there must be a few problems here, as there are varying implementations of TAXII and I only tested with the servers that I have access to, but please let me know and I will do my best to make any necessary changes.