Error in communicating with TAXII server.

Hi Team,

Darktrace is currently facing an issue communicating with the TAXII server. We have raised the issue with the Darktrace Support team, and they have provided the response below.

Could you please review their response and help us troubleshoot and resolve the issue?

Please find the Darktrace Support team's response below.

Hello Shubham,

Thank you for your patience.

We have investigated the issue further and, in summary, it appears to be caused by incorrect information returned by the MITRE ATT&CK TAXII discovery endpoint, as also noted by Robin Hill.

Further details are provided below.

We queried the discovery endpoint referenced in the MITRE documentation:

https://github.com/mitre-attack/attack-workbench-taxii-server/blob/main/docs/USAGE.md#endpoint-discovery

using:

curl --request GET
--url https://attack-taxii.mitre.org/taxii2/
--header 'Accept: application/taxii+json;version=2.1'

The response included /api/v21/attack-11.0-beta as one of the advertised API Roots.

However, when attempting to retrieve the collections available under this API Root using:

curl --request GET
--url https://attack-taxii.mitre.org/api/v21/attack-11.0-beta/collections
--header 'Accept: application/taxii+json;version=2.1'

the request returned a 404 Not Found error.

Based on our findings, this appears to be an issue with the MITRE ATT&CK TAXII service itself, whereby the discovery endpoint is advertising an API Root that is not accessible. Unfortunately, this is external to Darktrace and is therefore not something we can directly remediate.

Thanks,
Shubham

Start by reproducing the two curl requests against the TAXII discovery endpoint and the advertised /api/v21/attack-11.0-beta/collections endpoint. Compare the advertised API Root with the 404 response; done means determining whether attack-stix-data contains a remediation path or whether the issue must be handed to the external TAXII service.