TAXII Server

This integration provides TAXII Services for system indicators (Outbound feed).

Data Enrichment & Threat Intelligence · TAXII Server

Details

ID	`TAXII Server`
Provider	Open Source
Category	Data Enrichment & Threat Intelligence
From Version	5.5.0
Docker Image	`demisto/taxii-server:1.0.0.10133006`
Supported Modules	Agentix XSIAM

README

TAXII Service Integration

This integration provides TAXII Services for system indicators (Outbound feed).

The TAXII Service integration is a long-running integration. For more information about long-running integrations, see the Cortex XSOAR 8 Cloud, Cortex XSOAR 8 On-prem or Cortex XSIAM documentation.

Configure Collections

Each TAXII collection in the integration is represented by a Cortex XSOAR indicator query.

The collections are defined by a JSON object in the following format:

{
  "collection_name": "<Cortex XSOAR indicator query>"
}

How to Access the TAXII Service

For Cortex XSOAR 6.x

Use one of the following options to access the TAXII service:

https://<xsoar_address>/instance/execute/<instance_name>/taxii-discovery-service
http://<xsoar_address>:<listen_port>/taxii-discovery-service

For Cortex XSOAR 8 On-prem, Cortex XSOAR 8 Cloud, or Cortex XSIAM

Use one of the following options to access the TAXII service:

https://ext-<tenant>.crtx.<region>.paloaltonetworks.com/xsoar/instance/execute/<instance-name>/<taxii2_api_endpoint>/
When using an engine: http://<xsoar_address>:<listen_port>/<taxii2_api_endpoint>/

Note:
For Cortex XSOAR 8 On-prem, you need to add the ext- FQDN DNS record to map the Cortex XSOAR DNS name to the external IP address.
For example, ext-xsoar.mycompany.com.

Access the TAXII Service by Instance Name

To access the TAXII service by instance name, make sure Instance execute external is enabled.

For Cortex XSOAR 6.x:
1. Navigate to Settings > About > Troubleshooting.
2. In the Server Configuration section, verify that the instance.execute.external key is set to true. If this key does not exist, click + Add Server Configuration and add the instance.execute.external and set the value to true.
Trigger the TAXII Service URL:
- For Cortex XSOAR 6.x:
  <CORTEX-XSOAR-URL>/instance/execute/<INTEGRATION-INSTANCE-NAME>.
  For example, https://my.xsoar.live/instance/execute/taxiiserver.
- For Cortex XSOAR 8 On-prem, Cortex XSOAR 8 Cloud, or Cortex XSIAM:
  https://ext-<tenant>.crtx.<region>.paloaltonetworks.com/xsoar/instance/execute/<instance-name>
  Note:
  The string instance does not refer to the name of your Cortex XSOAR instance, but rather is part of the URL.

How to Use HTTPS

To use HTTPS, a certificate and private key have to be provided in the integration configuration.
The HTTP Server checkbox needs to be unchecked.

Set up Authentication

For Cortex XSOAR 8 Cloud Tenant or Cortex XSIAM Tenant

The TAXII Service integration running on a Cortex XSOAR 8 Cloud tenant or Cortex XSIAM tenant enables using basic authentication in the requests.
To enable basic authentication, a user and password have to be supplied in the Credentials parameters in the integration configuration.
The server then authenticates the requests by the Authorization header, expecting basic authentication encrypted in base64 to match the given credentials.

For Cortex XSOAR On-prem (6.x or 8) or When Using Engines

For Cortex XSOAR On-prem (6.x or 8) or when using engines, you can set up authentication using custom certificates. For more information on setting up a custom certificate for Cortex XSOAR 8 On-prem, see HTTPS with a signed certificate. For more information on setting up a custom certificate for Cortex XSOAR 6.x, see HTTPS with a Signed Certificate.

Troubleshooting

If the URL address returned in the service response is wrong, you can set it in the TAXII Service URL Address integration setting.

Configuration parameters

longRunning — Long Running Instance
certificate — Certificate (Required for HTTPS)
key — Private Key (Required for HTTPS)
credentials — Username
collections — Collection JSON (required)
service_address — TAXII Service URL Address
longRunningPort — Listen Port (required)

Commands (0)

This integration defines no commands.

Source

TAXIIServer.py TAXIIServer_test.py TAXIIServer.yml TAXIIServer_description.md

Download History Raw

category: Data Enrichment & Threat Intelligence
provider: Open Source
sectionorder:
- Connect
- Collect
commonfields:
  id: TAXII Server
  version: -1
configuration:
- defaultvalue: 'true'
  display: Long Running Instance
  name: longRunning
  type: 8
  hidden: true
  section: Connect
  required: false
- display: Certificate (Required for HTTPS)
  name: certificate
  type: 12
  section: Connect
  required: false
- display: Private Key (Required for HTTPS)
  name: key
  type: 14
  section: Connect
  required: false
- display: Username
  name: credentials
  type: 9
  section: Connect
  required: false
- additionalinfo: JSON string of indicator query collections - dictionary of the collection name as the key and the query as the value.
  defaultvalue: |-
    {
       "AWS": "type:CIDR and sourceBrands:\"AWS Feed\""
    }
  display: Collection JSON
  name: collections
  required: true
  type: 12
  section: Collect
- display: TAXII Service URL Address
  additionalinfo: The URL address to set in the TAXII service response. If not set, the integration will try to auto-detect the URL.
  name: service_address
  type: 0
  section: Connect
  required: false
- additionalinfo: Runs the service on this port from within Cortex XSOAR. Requires a unique port for each long-running integration instance. Do not use the same port for multiple instances. (For Cortex XSOAR 8 and Cortex XSIAM) If you do not enter a Listen Port, an unused port for the EDL will automatically be generated when the instance is saved. However, if using an engine, you must enter a Listen Port.
  display: Listen Port
  name: longRunningPort
  required: true
  type: 0
  section: Connect
description: This integration provides TAXII Services for system indicators (Outbound feed).
display: TAXII Server
name: TAXII Server
script:
  dockerimage: demisto/taxii-server:1.0.0.10133006
  longRunning: true
  longRunningPort: true
  script: '-'
  subtype: python3
  type: python
tests:
- TAXII_Feed_Test
fromversion: 5.5.0
triggers:
  - conditions:
      - name: engine
        operator: not_exists
      - name: isEngineGroup
        operator: not_exists
    effects:
      - name: longRunningPort
        action:
          hidden: true
          required: false