Synchronise OpenCTI with Netwitness

[BaptOnfroy]

Hello,

I have a threat intelligence platform based on OpenCTI. I would like to synchronise my indicators with my Netwitness platform but Netwitness does not support TAXII V2.

Do you have any solutions?

Thanks,

[JeremyKerwin]

I have a similar situation with OpenCTI and MISP.

The only way I've found is to export the indicators as a CSV file and host it on a webserver somewhere, then import that as a custom feed into NetWitness as a recurring feed.

[BaptOnfroy]

It's terrible that a solution like Netwitness does not support TAXII V2 ...

I think I'll have to use the same methodology as you

[JeremyKerwin]

Totally agree, we can only hope that it's on their radar to implement in a future release.... hopefully not a too far off release.

[BaptOnfroy]

I opened a support case on this topic and received the following information

I have checked internally and I can confirm that we have plans to support STIX/TAXII 2 in our future release. So far which version is not yet decided.
We have created an RFE to track its progress (Reference Number ASOC-131761). 

Wait and see ...

[JeremyKerwin]

Haha. That sounds like the typical response to get you off their backs.