OpenTAXII: Cannot poll feeds from splunk
I am trying to poll data from splunk and here are my configure:
URL: http://<IP>:9000/services/test_all_poll POST arguments: collection="test-all-collection" taxii_username="username" taxii_password="password"
I am sure that the username and the password are correct, but here is what I got back
{"exception": "Traceback (most recent call last):\n File \"/usr/lib64/python2.7/site-packages/flask/app.py\", line 1813, in full_dispatch_request\n rv = self.dispatch_request()\n File \"/usr/lib64/python2.7/site-packages/flask/app.py\", line 1799, in dispatch_request\n return self.view_functions[rule.endpoint](**req.view_args)\n File \"/usr/lib/python2.7/site-packages/opentaxii/middleware.py\", line 76, in wrapper\n raise UnauthorizedException()\nUnauthorizedException: UNAUTHORIZED", "level": "warning", "timestamp": "2018-06-12T05:58:33.217832Z", "logger": "opentaxii.middleware", "event": "Status exception"}
Does anyone know why this would happen? And where can I check the log record? Thanks.
About this issue
- Original URL
- State: closed
- Created 6 years ago
- Comments: 19 (11 by maintainers)
It works! Thanks guys!!! @arcsector I thought typing taxii in Type is an optional choice. Anyway, thanks!
@traut in splunk it’s necessary to put the collection, username, and password as POST arguments, but Splunk passes them differently only if you specify Type as
taxii. See my suggestion above