Troubleshooting Scenario Questions

'source_ref'

Why it fails: 'source_ref' identifies the originating object's identifier, not the semantic link type, so a parser cannot determine the relationship's meaning from it. It is tempting because it is mandatory in every Relationship, and would be the correct property to verify when confirming which object the relationship originates from.

'target_ref'

Why it fails: 'target_ref' names the destination object's identifier, not the relationship's semantics, so it cannot tell the parser what kind of link exists. It is tempting because it is mandatory, and would be correct when verifying which object the relationship points to, not the link type.

'spec_version'

Why it fails: 'spec_version' declares the STIX specification version used, not the relationship's semantic type, so it cannot identify the link. It is tempting because version mismatches genuinely break parsing, and would be correct when diagnosing whether the bundle conforms to a supported STIX release.

Update the SSL certificates on the collector.

Why it fails: Expired or untrusted TLS certificates cause handshake failures such as certificate verify failed or SSL errors, not a 403, which arrives after a successful handshake. Certificate renewal is correct when the connector cannot establish HTTPS at all because the remote chain is invalid or expired.

Increase the connector memory allocation.

Why it fails: A 403 response indicates the remote server rejected the request as unauthorised, so credentials, API tokens or user-agent headers need checking. Memory exhaustion would surface as OutOfMemoryError or timeouts, not an HTTP status code. Raising heap is correct when connectors crash while parsing unusually large STIX bundles.

Restart the OpenCTI RabbitMQ service.

Why it fails: RabbitMQ carries messages between OpenCTI components; a broker outage produces connection-refused or queue errors, not a 403 from the remote feed host. Restarting it is correct when ingestion stalls with workers idle and queues backing up, but it cannot alter the remote server's authorisation decision.

Disable all external threat intelligence feeds to reduce noise in the security operations center

Why it fails: Disabling external feeds removes the supplier and third-party indicators that would surface supply chain intrusions earlier, worsening the gap. It is tempting because feed volume genuinely creates alert noise and analyst fatigue, which is the right adjustment when the problem is excessive false positives rather than missing external visibility.

Reassign all malware reverse engineering tasks to helpdesk support personnel

Why it fails: Reassigning reverse engineering to helpdesk support removes the specialist capability needed to characterise supply chain implants, deepening the detection gap. It is tempting because redistributing tasks can relieve analyst workload and cut costs, which is the right adjustment when the shortfall is resource capacity rather than scarce technical expertise.

Increase the budget for automated SIEM log retention from 30 days to 90 days

Why it fails: Extending SIEM log retention addresses forensic reconstruction after an incident, not the direction and planning gaps that let supply chain intrusions go undetected. It is tempting because longer retention genuinely aids post-incident timeline analysis and compliance evidence, which is the right adjustment when the shortfall is investigation depth rather than detection coverage.

Restart the TAXII server service

Why it fails: Restarting the TAXII server cannot fix a STIX 2.1 parsing failure, since the bundle content, not the transport service, causes the error. It is tempting because restarts clear transient TAXII connection faults, and would be correct if the server were unreachable rather than delivering unparseable content.

Check the TLS certificate expiration date

Why it fails: TLS certificate expiry would abort the HTTPS connection to the TAXII server entirely, producing handshake failures rather than a received bundle that fails STIX parsing. Certificate checks are the right diagnostic when transport cannot be established, not when payload content is delivered but rejected as malformed.

Check the firewall rules for port 443

Why it fails: Port 443 blocking would prevent the TAXII collection from being retrieved at all, so no bundle would arrive to parse. Firewall rule checks suit connectivity failures — timeouts, refused connections or empty polls — whereas a bundle that arrives and fails parsing points to STIX schema or version mismatch.

Reinstall the operating system.

Why it fails: Reinstalling the operating system destroys the client configuration and certificates without addressing the connection fault. It is tempting when a host is suspected corrupt, but TAXII failures stem from TLS trust, endpoint URLs, authentication or firewall rules, which OS reinstallation neither diagnoses nor repairs.

Modify the TAXII protocol specification.

Why it fails: The TAXII 2.1 specification is a fixed OASIS standard; clients cannot alter it to fix connectivity. Editing the spec is tempting because protocol mismatches do cause failures, but the correct troubleshooting step is verifying the advertised discovery URL and supported API roots against the server's actual implementation.