taxii subscription management error

[KVasiliy]

Hello!

I have a problem with subscription to taxii collection deployed in my MineMeld instance.

When I try to subscribe to collection or get its status I get an error (cabby taxii client have been used for this request):

taxii-subscription --verify no -v --discovery https://xxx.xxx.xxx.xxx/taxii-discovery-service --user xxxxx --password xxxxxxxxxx -c xxxxxxxx -a status

2017-06-20 08:59:47,650 cabby.dispatcher INFO: Sending Discovery_Request to https://xxx.xxx.xxx.xxx/taxii-discovery-service
2017-06-20 08:59:47,651 cabby.dispatcher DEBUG: Request:
<taxii_11:Discovery_Request xmlns:taxii="http://taxii.mitre.org/messages/taxii_xml_binding-1" xmlns:taxii_11="http://taxii.mitre.org/messages/taxii_xml_binding-1.1" xmlns:tdq="http://taxii.mitre.org/query/taxii_default_query-1" message_id="27541c49-18e8-40ab-a91e-49070466064b"/>

2017-06-20 08:59:47,654 requests.packages.urllib3.connectionpool DEBUG: Starting new HTTPS connection (1): xxx.xxx.xxx.xxx
2017-06-20 08:59:47,666 py.warnings WARNING: /usr/local/lib/python2.7/dist-packages/requests/packages/urllib3/connectionpool.py:852: InsecureRequestWarning: Unverified HTTPS request is being made. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#ssl-warnings
InsecureRequestWarning)

2017-06-20 08:59:47,717 requests.packages.urllib3.connectionpool DEBUG: https://xxx.xxx.xxx.xxx:443 "POST /taxii-discovery-service HTTP/1.1" 200 1646
2017-06-20 08:59:47,721 cabby.dispatcher DEBUG: Response:
<taxii_11:Discovery_Response xmlns:taxii="http://taxii.mitre.org/messages/taxii_xml_binding-1" xmlns:taxii_11="http://taxii.mitre.org/messages/taxii_xml_binding-1.1" xmlns:tdq="http://taxii.mitre.org/query/taxii_default_query-1" message_id="7504145709356130571" in_response_to="27541c49-18e8-40ab-a91e-49070466064b">
<taxii_11:Service_Instance service_type="DISCOVERY" service_version="urn:taxii.mitre.org:services:1.1" available="true">
<taxii_11:Protocol_Binding>urn:taxii.mitre.org:protocol:http:1.0</taxii_11:Protocol_Binding>
<taxii_11:Address>https://xxx.xxx.xxx.xxx/taxii-discovery-service</taxii_11:Address>
<taxii_11:Message_Binding>urn:taxii.mitre.org:message:xml:1.1</taxii_11:Message_Binding>
</taxii_11:Service_Instance>
<taxii_11:Service_Instance service_type="COLLECTION_MANAGEMENT" service_version="urn:taxii.mitre.org:services:1.1" available="true">
<taxii_11:Protocol_Binding>urn:taxii.mitre.org:protocol:http:1.0</taxii_11:Protocol_Binding>
<taxii_11:Address>https://xxx.xxx.xxx.xxx/taxii-collection-management-service</taxii_11:Address>
<taxii_11:Message_Binding>urn:taxii.mitre.org:message:xml:1.1</taxii_11:Message_Binding>
</taxii_11:Service_Instance>
<taxii_11:Service_Instance service_type="POLL" service_version="urn:taxii.mitre.org:services:1.1" available="true">
<taxii_11:Protocol_Binding>urn:taxii.mitre.org:protocol:http:1.0</taxii_11:Protocol_Binding>
<taxii_11:Address>https://xxx.xxx.xxx.xxx/taxii-poll-service</taxii_11:Address>
<taxii_11:Message_Binding>urn:taxii.mitre.org:message:xml:1.1</taxii_11:Message_Binding>
</taxii_11:Service_Instance>
</taxii_11:Discovery_Response>

2017-06-20 08:59:47,723 cabby.client11.Client11 INFO: 3 services discovered
2017-06-20 08:59:47,725 cabby.dispatcher INFO: Sending Subscription_Management_Request to https://xxx.xxx.xxx.xxx/taxii-collection-management-service
2017-06-20 08:59:47,725 cabby.dispatcher DEBUG: Request:
<taxii_11:Subscription_Management_Request xmlns:taxii="http://taxii.mitre.org/messages/taxii_xml_binding-1" xmlns:taxii_11="http://taxii.mitre.org/messages/taxii_xml_binding-1.1" xmlns:tdq="http://taxii.mitre.org/query/taxii_default_query-1" message_id="f4e03f07-9e61-48cc-b1d5-10e6275cdf1b" collection_name="xxxxxxxx" action="STATUS"/>

2017-06-20 08:59:47,728 requests.packages.urllib3.connectionpool DEBUG: Starting new HTTPS connection (1): xxx.xxx.xxx.xxx
2017-06-20 08:59:47,737 py.warnings WARNING: /usr/local/lib/python2.7/dist-packages/requests/packages/urllib3/connectionpool.py:852: InsecureRequestWarning: Unverified HTTPS request is being made. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#ssl-warnings
InsecureRequestWarning)

2017-06-20 08:59:47,781 requests.packages.urllib3.connectionpool DEBUG: https://xxx.xxx.xxx.xxx:443 "POST /taxii-collection-management-service HTTP/1.1" 400 37
2017-06-20 08:59:47,782 cabby.dispatcher DEBUG: Response:
Invalid message, invalid Message Type
2017-06-20 08:59:47,783 cabby.cli.commons ERROR: HTTP Error: status code 400
Traceback (most recent call last):
File "/usr/local/lib/python2.7/dist-packages/cabby/cli/commons.py", line 164, in run_client
run_func(client, args.uri, args)
File "/usr/local/lib/python2.7/dist-packages/cabby/cli/subscriptions.py", line 48, in _runner
uri=uri)
File "/usr/local/lib/python2.7/dist-packages/cabby/client11.py", line 82, in get_subscription_status
uri=uri)
File "/usr/local/lib/python2.7/dist-packages/cabby/client11.py", line 43, in __subscription_status_request
service_type=const.SVC_COLLECTION_MANAGEMENT)
File "/usr/local/lib/python2.7/dist-packages/cabby/abstract.py", line 202, in _execute_request
taxii_binding=self.taxii_binding)
File "/usr/local/lib/python2.7/dist-packages/cabby/dispatcher.py", line 66, in send_taxii_request
raise_http_error(response.status_code, response.raw)
File "/usr/local/lib/python2.7/dist-packages/cabby/dispatcher.py", line 30, in raise_http_error
raise HTTPError(status_code)
HTTPError: HTTP Error: status code 400

[lmori]

Hi @KVasiliy,

TAXII subscriptions are not supported by MineMeld, you should directly use the taxii-poll from cabby instead.

[KVasiliy]

Thanks a lot!