MITRE Attack Integration is running for more than 30 mins | Enterprise ATT&CK TAXII Collection Integration Timing Out - Known Error

MITRE Attack Integration is running for more than 30 mins | Enterprise ATT&CK TAXII Collection Integration Timing Out Description MITRE Attack Integration fails with error as javax.json.JsonException: Cannot auto-detect encoding, not enough chars ( scheduled import job: MITRE Collection Import) in the import set. and there might be an entry in the 'Quarantined Files' table as well under 'Antivirus' --> 'Quarantine' Steps to Reproduce

1. Configure a TAXII profile with https://raw.githubusercontent.com/mitre/cti/master/enterprise-attack/enterprise-attack.json as the endpoint. 2. Run the job. 3. The processing will be failed with error: javax.json.JsonException: Cannot auto-detect encoding, not enough chars ( scheduled import job: MITRE Collection Import)

Workaround MITRE ATTACK Integration uses sn_sec_cmn_integration_process table to store the attachments. As a workaround exclude sn_sec_cmn_integration_process from antivirus scan.

Exclude from the Antivirus scan by adding them to the List of Tables Excluded. Navigate to System Definition → Dictionary Search for the table, sn_sec_cmn_integration_process to exclude from the scan and select the table with Type set to collection. In the Attributes tab, select New. Add exclude_from_antivirus_scan in the Attributes field and enter true in the Value field. Select Submit. https://docs.servicenow.com/bundle/vancouver-platform-security/page/administer/security/task/configure-antivirus-protection.html Related Problem: PRB1715183