FS-ISAC STIX/TAXII Setup in ServiceNow

Community Alums · ‎05-21-2019

scottlewis · ‎05-21-2019

Thanks for posting Liju. You beat me to it!

s

Community Alums · ‎05-21-2019

Thanks for your help Scott.

(I did not see any search result regarding FS-ISAC in the community earlier.)

kmlutz4sn · ‎08-18-2019

Hello Liju,

Any suggestions or known postings on using data from attack.mitre.org into SN? It seems similar to what you have posted above.

Any suggestions would be appreciated.

Thanks.

Mike_R · ‎07-06-2020

Hi Liju,

Thank you for the very helpful instructions. We followed these instructions last year and it worked perfectly.

Apparently in March, FS-ISAC changed the feed URL to "https://taxii.fsisac.com/ctixapi/taxii/". I tried updating the URL & credentials in ServiceNow but am unable to import the data.

Any suggestions?

Community Alums · ‎07-13-2020

There is a change in the FS-ISAC APIs.

What are the connection parameters for connecting to FS-ISAC’s STIX/TAXII Feed?
• TAXII 1.1:

o Discovery Service: https://taxii.fsisac.com/ctixapi/taxii/
o Collection Service: https://taxii.fsisac.com/ctixapi/taxii/collection/
o Poll Service: https://taxii.fsisac.com/ctixapi/taxii/poll/

• TAXII 2.0:

o Discovery Service: https://taxii.fsisac.com/ctixapi/ctix2/taxii/
o Collection Service: https://taxii.fsisac.com/ctixapi/ctix2/collections/
o Poll Service: https://taxii.fsisac.com/ctixapi/ctix2/collections/<collection_id>/

• TAXII 2.1:

o Discovery Service: https://taxii.fsisac.com/ctixapi/ctix21/taxii2/

o Collection Service: https://taxii.fsisac.com/ctixapi/ctix21/collections/

o Poll Service: https://taxii.fsisac.com/ctixapi/ctix21/collections/<collection_id>/

Community Alums · ‎07-13-2020

TAXII Collections

Community Alums · ‎07-13-2020

Community Alums · ‎07-13-2020

Community Alums · ‎07-13-2020

Poll

Jimmy26 · ‎07-22-2020

Good stuff. I'm going to try this same approach with N-ISAC

Mike_R · ‎09-23-2020

Hi Liju,

Thank you for the detailed instructions. I followed all your steps and was able to generate the 10 Taxii Collections. The collections seem to run with no problems "Successfully completed integration run. No more data to process at this time." but we do not see new data anywhere.

Where is this data stored? With the old setup, the data was going to the Indicators and Observables tables but i don't see any new data with this feed.