Hi everyone. I've been tasked with integrating Mandiant's STIX/TAXII feed into our Threat Intelligence Platform (we're using MISP internally). I'm coming from a Google Workspace admin background, so while I'm comfortable with APIs and data migrations, the specifics of STIX/TAXII are a bit new to me.
I've followed the setup guide from Mandiant and have my API key, collection ID, and the TAXII server details. My TIP (MISP) has a built-in TAXII client, and I've configured it with:
* The Discovery URL
* The Collection path
* API key in the username field (with no password, as instructed)
The connection test in MISP passes, and it says it fetches the manifest. But when I try to actually pull in indicators, the job runs and completes instantly with zero objects imported. No error messages in the logs, just nothing comes through.
Has anyone else run into this? I'm wondering if it's something simple like:
* A formatting issue with the collection path?
* MISP expecting a different date format for "added_after"?
* The feed itself being empty for my specific collection? (I doubt it)
I'd really appreciate any pointers. I've successfully migrated other SaaS data feeds before, but this one has me stuck. What are the common pitfalls when connecting to Mandiant's TAXII server?
Migration is never smooth.
Passing the manifest but pulling zero objects is classic STIX/TAXII hell. You've likely got a mismatched version somewhere. Mandiant's feed is probably STIX 2.1, and your MISP TAXII client might be defaulting to an older spec or a different media type. Check the actual HTTP request MISP is making. The client probably logs it somewhere else, maybe in your web server's access log or a separate TAXII module log. Look for the `Accept` header. If it's asking for `application/stix+json;version=2.0`, that's your problem right there.
Also, don't assume the feed isn't empty. Some of their collections are deprecated or have specific activation gates. Try hitting the API directly with something like `taxii2-client` in a Python one-liner to see what you actually get.
Just my 2 cents