TAXII 2 Feed

category: Data Enrichment & Threat Intelligence
provider: Open Source
commonfields:
  id: TAXII 2 Feed
  version: -1
configuration:
- defaultvalue: 'true'
  display: Fetch indicators
  name: feed
  type: 8
  required: false
  section: Collect
- additionalinfo: Indicators from this integration instance will be marked with this reputation.
  display: Indicator Reputation
  name: feedReputation
  options:
  - None
  - Good
  - Suspicious
  - Bad
  type: 18
  required: false
  section: Collect
- additionalinfo: Reliability of the source providing the intelligence data.
  display: Source Reliability
  name: feedReliability
  options:
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
  required: true
  type: 15
  section: Collect
- additionalinfo: The Traffic Light Protocol (TLP) designation to apply to indicators fetched from the feed.
  display: Traffic Light Protocol Color
  name: tlp_color
  options:
  - RED
  - AMBER
  - GREEN
  - WHITE
  type: 15
  defaultvalue: 'WHITE'
  required: false
  section: Collect
- display: ''
  name: feedExpirationPolicy
  options:
  - never
  - interval
  - indicatorType
  - suddenDeath
  type: 17
  required: false
  section: Collect
  advanced: true
- display: ''
  name: feedExpirationInterval
  type: 1
  required: false
  section: Collect
  advanced: true
- defaultvalue: '240'
  display: Feed Fetch Interval
  name: feedFetchInterval
  type: 19
  required: false
  section: Collect
  advanced: true
- additionalinfo: When selected, the exclusion list is ignored for indicators from this feed. This means that if an indicator from this feed is on the exclusion list, the indicator might still be added to the system.
  display: Bypass exclusion list
  name: feedBypassExclusionList
  type: 8
  required: false
  section: Collect
  advanced: true
- display: Discovery Service URL (e.g. https://example.net/taxii2)
  name: url
  required: true
  type: 0
  section: Connect
- display: Username / API Key
  name: credentials
  type: 9
  required: false
  section: Connect
- additionalinfo: The API root to use (for example default or public). If left empty, the server default API root is used. If the server has no default root, the first available API root is used instead.
  display: API Root to Use
  name: default_api_root
  type: 0
  required: false
  section: Connect
- additionalinfo: Indicators will be fetched from this collection. Run "taxii2-get-collections" command to get a valid value. If left empty, the instance will try to fetch from all the collections in the given discovery service.
  display: Collection Name To Fetch Indicators From
  name: collection_to_fetch
  type: 0
  required: false
  section: Connect
- additionalinfo: Incremental feeds pull only new or modified indicators that have been sent from the integration. As the determination if the indicator is new or modified happens on the 3rd-party vendor's side, and only indicators that are new or modified are sent to Cortex XSOAR, all indicators coming from these feeds are labeled new or modified.
  defaultvalue: 'false'
  display: Incremental Feed
  name: feedIncremental
  type: 8
  required: false
  section: Collect
  advanced: true
- additionalinfo: When enabled, fetch-indicators will try to fetch the entire feed for every fetch. When disabled, fetch-indicators will try to fetch just the latest entries (since the last fetch).
  display: Full Feed Fetch
  name: fetch_full_feed
  type: 8
  required: false
  defaultvalue: 'true'
  section: Collect
  advanced: true
- additionalinfo: The maximum number of indicators that can be fetched per fetch. If this field is left empty, there will be no limit on the number of indicators fetched.
  display: Max Indicators Per Fetch (disabled for Full Feed Fetch)
  name: limit
  type: 0
  required: false
  section: Collect
- display: First Fetch Time
  name: initial_interval
  defaultvalue: 1 year
  type: 0
  required: false
  additionalinfo: 'The time interval for the first retroactive fetch, formatted as <time unit of type minute/hour/day/year>. For example: 1 minute, 12 hours.'
  section: Collect
- display: STIX Objects To Fetch
  name: objects_to_fetch
  type: 16
  required: false
  defaultvalue: indicator,report,malware,campaign,attack-pattern,course-of-action,intrusion-set,tool,threat-actor,infrastructure
  options:
  - indicator
  - report
  - malware
  - campaign
  - attack-pattern
  - course-of-action
  - intrusion-set
  - tool
  - threat-actor
  - infrastructure
  - autonomous-system
  - domain-name
  - email-addr
  - file
  - ipv4-addr
  - ipv6-addr
  - mutex
  - url
  - user-account
  - windows-registry-key
  - identity
  - location
  - vulnerability
  - x509-certificate
  - software
  additionalinfo: 'Choose which STIX object types to fetch from the TAXII server. If left empty, all available object types will be fetched.'
  section: Collect
- display: Certificate File as Text
  name: creds_certificate
  type: 9
  required: false
  displaypassword: Key File as Text
  section: Connect
- additionalinfo: Add a certificate file as text to connect to the TAXII server
  display: Certificate File as Text
  name: certificate
  type: 12
  hidden: true
  required: false
  section: Connect
- additionalinfo: Add a key file as text to connect to the TAXII server
  display: Key File as Text
  name: key
  type: 4
  required: false
  hidden: true
  section: Connect
- additionalinfo: Set the number of stix object that will be requested with each taxii poll (http request). A single fetch is made of several taxii polls. Changing this setting can help speed up fetches, or fix issues on slower networks. Please note server restrictions may apply, overriding and limiting the "requested limit".
  defaultvalue: '100'
  display: Max STIX Objects Per Poll
  name: limit_per_request
  type: 0
  required: false
  section: Collect
- additionalinfo: "Choose how to handle complex observations. Two or more observation expressions may be combined using a complex observation operator such as \"AND\" or \"OR\". For example: [ IP = 'b' ] AND [ URL = 'd' ]"
  display: Complex Observation Mode
  name: observation_operator_mode
  type: 15
  required: false
  defaultvalue: Skip indicators with more than a single observation
  options:
  - Create indicator for each observation
  - Skip indicators with more than a single observation
  section: Collect
  advanced: true
- display: Update custom fields
  name: update_custom_fields
  type: 8
  required: false
  additionalinfo: "Choose whether to import Cortex XSOAR custom fields. Note: this may overwrite data pulled from other sources."
  section: Collect
  advanced: true
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
  advanced: true
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
  advanced: true
- additionalinfo: Supports CSV values.
  display: Tags
  name: feedTags
  type: 0
  required: false
  section: Collect
  advanced: true
- display: Enrichment Excluded
  name: enrichmentExcluded
  type: 8
  required: false
  defaultvalue: 'false'
  additionalinfo: Select this option to exclude the fetched indicators from the enrichment process.
  hidden:
  - xsoar_on_prem
  section: Collect
description: Ingests indicator feeds from TAXII 2.0 and 2.1 servers.
display: TAXII 2 Feed
name: TAXII 2 Feed
script:
  commands:
  - arguments:
    - auto: PREDEFINED
      defaultValue: 'false'
      description: Will return only the rawJSON of the indicator object.
      name: raw
      predefined:
      - 'true'
      - 'false'
    - defaultValue: '10'
      description: Maximum number of indicators to fetch.
      name: limit
    - description: Fetch only indicators that were added to the server after the given time. Please provide a <number> and <time unit> of type minute/hour/day. For example, 1 minute, 12 hour, 24 days.
      name: added_after
    description: Allows you to test your feed and to make sure you can fetch indicators successfuly.
    name: taxii2-get-indicators
    outputs:
    - contextPath: TAXII2.Indicators.type
      description: Indicator type.
      type: String
    - contextPath: TAXII2.Indicators.value
      description: Indicator value.
      type: String
    - contextPath: TAXII2.Indicators.rawJSON
      description: Indicator rawJSON.
      type: String
  - description: Gets the list of collections from the discovery service.
    name: taxii2-get-collections
    outputs:
    - contextPath: TAXII2.Collections.ID
      description: Collection ID.
      type: String
    - contextPath: TAXII2.Collections.Name
      description: Collection Name.
      type: String
  - deprecated: true
    description: 'WARNING: This command will reset your fetch history.'
    name: taxii2-reset-fetch-indicators
  dockerimage: demisto/taxii2:1.0.0.11040999
  feed: true
  runonce: false
  script: '-'
  subtype: python3
  type: python
tests:
- TAXII 2 Feed Test
fromversion: 5.5.0
sectionorder:
- Connect
- Collect