You are configuring a TAXII client to pull indicators from an external threat feed. The client returns a 403 Forbidden error despite valid credentials. Which setting should you verify in the TAXII server configuration?
Trap 1: Verify the Discovery Service URL in the client configuration
This would typically result in a 404 or connection timeout.
Trap 2: Change the polling interval from 60 seconds to 300 seconds
Polling intervals affect performance but do not cause authorization errors.
Trap 3: Validate the TLS handshake certificate chain
TLS issues usually result in a 401 or SSL handshake failure.
- A
Check if the API Key has the 'Read' permission for the specific Collection ID requested
A 403 with valid credentials indicates authorisation, not authentication, has failed. TAXII collections are individually permissioned, so the API key must hold Read access scoped to the specific Collection ID being polled; a key lacking that collection-level grant is rejected regardless of validity.
- B
Verify the Discovery Service URL in the client configuration
Why it fails: This would typically result in a 404 or connection timeout.
- C
Change the polling interval from 60 seconds to 300 seconds
Why it fails: Polling intervals affect performance but do not cause authorization errors.
- D
Validate the TLS handshake certificate chain
Why it fails: TLS issues usually result in a 401 or SSL handshake failure.