IBM Security QRadar

 View Only

Error: Threat Intelligence App TAXII (Rule Action)

  • 1.  Error: Threat Intelligence App TAXII (Rule Action)

    Posted Wed June 10, 2020 01:23 PM
    I'm trying to use Threat Intelligence App Rule Action feature to upload artifacts to X-Force exchange private collection. The discovery and configuration went well but I don't see any indicators gets uploaded.

    To troubleshoot, I tried to edit the Custom Action Script configuration to provide fixed property as input (domainID and sourceip) to test script execution. It provides me following error,

    ------------------
    
    Traceback (most recent call last): File "/usr/lib64/python2.7/runpy.py", line 162, in _run_module_as_main
    
     "__main__", fname, loader, pkg_name)
    
     File "/usr/lib64/python2.7/runpy.py", line 72, in _run_code
    
      exec code in run_globals
    
     File "/custom_action_scripts/customaction_1.script/__main__.py", line 92, in <module>
    
     File "/custom_action_scripts/customaction_1.script/taxii_ctxt.py", line 942, in push_message
    
    NameError: global name 'url' is not defined
    
    ------------


    Has anyone tried using Threat Intelligence App to upload IOC to Taxii server?





    ------------------------------
    Karthik Kumar
    ------------------------------