taxii subscription management error

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

taxii subscription management error

L2 Linker

Hello!

I have a problem with subscription to taxii collection deployed in my MineMeld instance.

When I try to subscribe to collection or get its status I get an error (cabby taxii client have been used for this request):

 

 

taxii-subscription --verify no -v --discovery https://xxx.xxx.xxx.xxx/taxii-discovery-service --user xxxxx --password xxxxxxxxxx -c xxxxxxxx -a status


2017-06-20 08:59:47,650 cabby.dispatcher INFO: Sending Discovery_Request to https://xxx.xxx.xxx.xxx/taxii-discovery-service
2017-06-20 08:59:47,651 cabby.dispatcher DEBUG: Request:
<taxii_11:Discovery_Request xmlns:taxii="http://taxii.mitre.org/messages/taxii_xml_binding-1" xmlns:taxii_11="http://taxii.mitre.org/messages/taxii_xml_binding-1.1" xmlns:tdq="http://taxii.mitre.org/query/taxii_default_query-1" message_id="27541c49-18e8-40ab-a91e-49070466064b"/>

2017-06-20 08:59:47,654 requests.packages.urllib3.connectionpool DEBUG: Starting new HTTPS connection (1): xxx.xxx.xxx.xxx
2017-06-20 08:59:47,666 py.warnings WARNING: /usr/local/lib/python2.7/dist-packages/requests/packages/urllib3/connectionpool.py:852: InsecureRequestWarning: Unverified HTTPS request is being made. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#ssl-warnings
InsecureRequestWarning)

2017-06-20 08:59:47,717 requests.packages.urllib3.connectionpool DEBUG: https://xxx.xxx.xxx.xxx:443 "POST /taxii-discovery-service HTTP/1.1" 200 1646
2017-06-20 08:59:47,721 cabby.dispatcher DEBUG: Response:
<taxii_11:Discovery_Response xmlns:taxii="http://taxii.mitre.org/messages/taxii_xml_binding-1" xmlns:taxii_11="http://taxii.mitre.org/messages/taxii_xml_binding-1.1" xmlns:tdq="http://taxii.mitre.org/query/taxii_default_query-1" message_id="7504145709356130571" in_response_to="27541c49-18e8-40ab-a91e-49070466064b">
<taxii_11:Service_Instance service_type="DISCOVERY" service_version="urn:taxii.mitre.org:services:1.1" available="true">
<taxii_11:Protocol_Binding>urn:taxii.mitre.org:protocol:http:1.0</taxii_11:Protocol_Binding>
<taxii_11:Address>https://xxx.xxx.xxx.xxx/taxii-discovery-service</taxii_11:Address>
<taxii_11:Message_Binding>urn:taxii.mitre.org:message:xml:1.1</taxii_11:Message_Binding>
</taxii_11:Service_Instance>
<taxii_11:Service_Instance service_type="COLLECTION_MANAGEMENT" service_version="urn:taxii.mitre.org:services:1.1" available="true">
<taxii_11:Protocol_Binding>urn:taxii.mitre.org:protocol:http:1.0</taxii_11:Protocol_Binding>
<taxii_11:Address>https://xxx.xxx.xxx.xxx/taxii-collection-management-service</taxii_11:Address>
<taxii_11:Message_Binding>urn:taxii.mitre.org:message:xml:1.1</taxii_11:Message_Binding>
</taxii_11:Service_Instance>
<taxii_11:Service_Instance service_type="POLL" service_version="urn:taxii.mitre.org:services:1.1" available="true">
<taxii_11:Protocol_Binding>urn:taxii.mitre.org:protocol:http:1.0</taxii_11:Protocol_Binding>
<taxii_11:Address>https://xxx.xxx.xxx.xxx/taxii-poll-service</taxii_11:Address>
<taxii_11:Message_Binding>urn:taxii.mitre.org:message:xml:1.1</taxii_11:Message_Binding>
</taxii_11:Service_Instance>
</taxii_11:Discovery_Response>

2017-06-20 08:59:47,723 cabby.client11.Client11 INFO: 3 services discovered
2017-06-20 08:59:47,725 cabby.dispatcher INFO: Sending Subscription_Management_Request to https://xxx.xxx.xxx.xxx/taxii-collection-management-service
2017-06-20 08:59:47,725 cabby.dispatcher DEBUG: Request:
<taxii_11:Subscription_Management_Request xmlns:taxii="http://taxii.mitre.org/messages/taxii_xml_binding-1" xmlns:taxii_11="http://taxii.mitre.org/messages/taxii_xml_binding-1.1" xmlns:tdq="http://taxii.mitre.org/query/taxii_default_query-1" message_id="f4e03f07-9e61-48cc-b1d5-10e6275cdf1b" collection_name="xxxxxxxx" action="STATUS"/>

2017-06-20 08:59:47,728 requests.packages.urllib3.connectionpool DEBUG: Starting new HTTPS connection (1): xxx.xxx.xxx.xxx
2017-06-20 08:59:47,737 py.warnings WARNING: /usr/local/lib/python2.7/dist-packages/requests/packages/urllib3/connectionpool.py:852: InsecureRequestWarning: Unverified HTTPS request is being made. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#ssl-warnings
InsecureRequestWarning)

2017-06-20 08:59:47,781 requests.packages.urllib3.connectionpool DEBUG: https://xxx.xxx.xxx.xxx:443 "POST /taxii-collection-management-service HTTP/1.1" 400 37
2017-06-20 08:59:47,782 cabby.dispatcher DEBUG: Response:
Invalid message, invalid Message Type
2017-06-20 08:59:47,783 cabby.cli.commons ERROR: HTTP Error: status code 400
Traceback (most recent call last):
File "/usr/local/lib/python2.7/dist-packages/cabby/cli/commons.py", line 164, in run_client
run_func(client, args.uri, args)
File "/usr/local/lib/python2.7/dist-packages/cabby/cli/subscriptions.py", line 48, in _runner
uri=uri)
File "/usr/local/lib/python2.7/dist-packages/cabby/client11.py", line 82, in get_subscription_status
uri=uri)
File "/usr/local/lib/python2.7/dist-packages/cabby/client11.py", line 43, in __subscription_status_request
service_type=const.SVC_COLLECTION_MANAGEMENT)
File "/usr/local/lib/python2.7/dist-packages/cabby/abstract.py", line 202, in _execute_request
taxii_binding=self.taxii_binding)
File "/usr/local/lib/python2.7/dist-packages/cabby/dispatcher.py", line 66, in send_taxii_request
raise_http_error(response.status_code, response.raw)
File "/usr/local/lib/python2.7/dist-packages/cabby/dispatcher.py", line 30, in raise_http_error
raise HTTPError(status_code)
HTTPError: HTTP Error: status code 400

 

2 REPLIES 2

L7 Applicator

Hi @KVasiliy,

TAXII subscriptions are not supported by MineMeld, you should directly use the taxii-poll from cabby instead.

Thanks a lot!

  • 3067 Views
  • 2 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!