Ingest Taxii feed into XSOAR 6.12

[TonyZhu]

Hi,

I am trying to ingest our taxii feed into XSOAR 6.12 with following steps:

• installed XSOAR 6.12 on ubuntu 22.0.4 LTS
• launched the web portal, and installed TAXII Feed (1.x) pack from marketplace
• Ingest feed using "Integration Instance Settings"
  
  • Typed in the parameters such as name, discovery service URL, username/password, collection name, poll service url, first fetch time,set Feed Fetch Interval to 10 mins, etc. 
  • Test successful 

With above steps, it was able to pull indicator from the collection I specified, but, it seems every time it only pulls one indicator and the same one over and overall again, the taxii feed provides over thousands of indicators per day, but I only see one indicator on Threat Intel dashboard -> XSOAR Indicators. 

Note, I have also tested the same feeds with other platforms such as ThreatQ and ThreatConnect, from there the feeds are ingested as expected.

Could someone please advise on it?
# XSOAR6.12  #taxii integration 

[chrking]

@TonyZhu  This first response only has a couple of indicators in it, but eyeballing them against the TAXII client code it seems like they should parse OK. At first I was wondering if XSOAR wasn't pulling subsequent pages of the poll response, but from the logs above it looks like it is.

I think you'll need Engineering and (probably) a custom debug version of the taxii client to troubleshoot this, sorry.

[TonyZhu]

Thanks @chrking. Really appreciate it!

There were lots of indicators (over thousands) in response I only kept few of them just for displaying, along with the response header.

Where I can get the customer debug version of the taxii client?