search

eclecticiq / OpenTAXII

TAXII server implementation in Python from EclecticIQ
BSD 3-Clause "New" or "Revised" License
186 stars 89 forks source link

How to create a service that can be used for multiple purposes. #42

Closed Waseem-farooqui closed 8 years ago

Waseem-farooqui commented 8 years ago

Like hail a taxii server which provides a single service for both discovery and collection management http://hailataxii.com/taxii-discovery-service. I basically want to integrate stix feeds with QRadar using its Threat Intelligence plugin and it called 1 service for both discovery and collection, I followed http://www.opentaxii.org/ in which I can't find any configuration for such purpose. For this purpose what should I do extend the public code API or just need to modify the service configuration file.

traut commented 8 years ago

@Waseem-farooqui at the moment it is not possible to map multiple services on one URL path like HailATAXII does. Every service in OpenTAXII has to have a unique mapping address.

Would you mind elaborating on your usecase? I wonder why this might be necessary.

code040 commented 8 years ago

@Waseem-farooqui when using the discovery service, the application should use the discovered services and their advertised endpoints. In case of the Radar import script, the service paths are 'hardcoded' (e.g. https://github.com/ibm-security-intelligence/data-import/blob/master/stix-import/stix_import.py#L245 ). In order for this to work, the import script should be adjusted to actually use the discovery service to find the poll endpoint (e.g. using cabby http://cabby.readthedocs.org/en/latest/user.html#using-cabby-as-a-python-library).