2023-05-17 05:53 AM
Hello,
I have a threat intelligence platform based on OpenCTI. I would like to synchronise my indicators with my Netwitness platform but Netwitness does not support TAXII V2.
Do you have any solutions?
Thanks,
2023-05-17 07:11 AM
I have a similar situation with OpenCTI and MISP.
The only way I've found is to export the indicators as a CSV file and host it on a webserver somewhere, then import that as a custom feed into NetWitness as a recurring feed.
2023-05-17 07:19 AM
It's terrible that a solution like Netwitness does not support TAXII V2 ...
I think I'll have to use the same methodology as you
2023-05-17 07:32 AM
Totally agree, we can only hope that it's on their radar to implement in a future release.... hopefully not a too far off release.
2023-05-17 07:34 AM
I opened a support case on this topic and received the following information
I have checked internally and I can confirm that we have plans to support STIX/TAXII 2 in our future release. So far which version is not yet decided.
We have created an RFE to track its progress (Reference Number ASOC-131761).
Wait and see ...
2023-05-17 07:39 AM
Haha. That sounds like the typical response to get you off their backs.