category: Data Enrichment & Threat Intelligence
provider: Open Source
sectionorder:
- Connect
- Collect
commonfields:
  id: TAXII2 Server
  version: -1
configuration:
- defaultvalue: 'true'
  display: Long Running Instance
  name: longRunning
  type: 8
  hidden: true
  section: Connect
  advanced: true
  required: false
- display: TAXII2 Server version
  name: version
  defaultvalue: "2.1"
  options:
  - "2.0"
  - "2.1"
  required: true
  type: 15
  section: Connect
- display: Username
  additionalinfo: Credentials to use for the basic authentication.
  name: credentials
  type: 9
  section: Connect
  required: false
- additionalinfo: JSON string of indicator query collections. Dictionary of the collection name as the key and the query as the value.
  defaultvalue: |-
    {
       "Collection1": "type:SomeType and sourceBrands:\"Some Feed\"",
        "Collection2": {"query": "type:SomeType", "description": "IP from Cortex XSOAR Threat Intel" }
    }
  display: Collection JSON
  name: collections
  required: true
  type: 12
  section: Collect
- additionalinfo: Comma-separated fields to return in the extension. Leave empty for no extension fields, 'All' for all existing fields.
  display: Cortex XSOAR Extension fields
  name: fields_filter
  type: 0
  section: Collect
  advanced: true
  required: false
- additionalinfo: Maximum number of items to return.
  defaultvalue: '2000'
  display: Response Size
  name: res_size
  required: true
  type: 0
  section: Collect
- display: Certificate (Required for HTTPS)
  name: certificate
  type: 12
  section: Connect
  advanced: true
  required: false
- display: Private Key (Required for HTTPS)
  name: key
  type: 14
  section: Connect
  advanced: true
  required: false
- display: Add HSTS header
  additionalinfo: When set to true and certificate & private key are provided will add the HSTS header to all requests.
  name: hsts_header
  type: 8
  required: false
  defaultvalue: 'false'
  section: Connect
- additionalinfo: "Full URL address to set in the TAXII2 service response. If not set, the integration will try to auto-detect the URL."
  display: TAXII2 Service URL Address
  name: service_address
  type: 0
  section: Connect
  required: false
- additionalinfo: Will run the TAXII2 Server on this port from within Cortex XSOAR. Requires a unique port for each long-running integration instance. Do not use the same port for multiple instances. (For Cortex XSOAR 8 and Cortex XSIAM) If you do not enter a Listen Port, an unused port for TAXII2 Server will automatically be generated when the instance is saved. However, if using an engine, you must enter a Listen Port.
  display: Listen Port
  name: longRunningPort
  required: true
  type: 0
  section: Connect
- additionalinfo: "NGINX global directives to be passed on the command line using the -g option. Each directive should end with `;`. For example: `worker_processes 4; timer_resolution 100ms;`. Advanced configuration to be used only if instructed by Cortex XSOAR Support."
  display: NGINX Global Directives
  name: nginx_global_directives
  type: 0
  section: Connect
  advanced: true
  required: false
- display: NGINX Server Conf
  name: nginx_server_conf
  type: 12
  additionalinfo: "NGINX server configuration. To be used instead of the default NGINX_SERVER_CONF used in the integration code. Advanced configuration to be used only if instructed by Cortex XSOAR Support."
  section: Connect
- additionalinfo: How often to refresh the list (e.g., less than 1 minute, 5 minutes, 12 hours, 7 days, 3 months, 1 year). For performance reasons, we do not recommend setting this value at less than 1 minute.
  defaultvalue: 30 minutes
  display: Refresh Rate
  name: cache_refresh_rate
  type: 0
  section: Collect
  advanced: true
  required: false
- additionalinfo: 'The parameter is deprecated and no longer used. Cache locking was replaced by a two-tier fail-fast design that rejects excess concurrent cache-building requests instead of queuing them.'
  defaultvalue: 1h
  display: Cache Lock Timeout (Deprecated)
  name: cache_lock_timeout
  type: 0
  section: Connect
  advanced: true
  required: false
  hidden: true
- additionalinfo: 'The parameter is deprecated and no longer used. Cache locking was replaced by a two-tier fail-fast design that rejects excess concurrent cache-building requests instead of queuing them.'
  defaultvalue: 1h
  display: Cache Lock Age (Deprecated)
  name: cache_lock_age
  type: 0
  section: Connect
  advanced: true
  required: false
  hidden: true
- additionalinfo: The TTL for 404 responses in the cache.
  defaultvalue: 1m
  display: Cache 404 TTL
  name: cache_404_ttl
  type: 0
  section: Connect
  advanced: true
  required: false
- additionalinfo: The default TTL for responses in the cache.
  defaultvalue: 1m
  display: Cache Default TTL
  name: cache_default_ttl
  type: 0
  section: Connect
  advanced: true
  required: false
- display: STIX types for STIX indicator Domain Object
  name: provide_as_indicator
  type: 16
  options:
  - ipv4-addr
  - domain-name
  - ipv6-addr
  - user-account
  - email-addr
  - windows-registry-key
  - file
  - url
  - x509-certificate
  additionalinfo: The selected types will be outputted as a "STIX Indicator type" with a STIX pattern instead of an SCO. This may be necessary based on the tool you use to ingest data.
  section: Collect
  advanced: true
  required: false
- display: Search-after cache duration hours
  additionalinfo: Defines how many hours the search-after values is kept in cache so pagination can be faster.
  name: cache_duration_hours
  required: true
  type: 0
  section: Collect
  advanced: true
  defaultvalue: "48"
description: This integration provides TAXII2 Services for system indicators (Outbound feed).
display: TAXII2 Server
name: TAXII2 Server
script:
  commands:
  - description: Returns all the collections.
    name: taxii-server-list-collections
    outputs:
    - contextPath: TAXIIServer.Collection.id
      description: The collection ID.
      type: String
    - contextPath: TAXIIServer.Collection.query
      description: The collection query.
      type: String
    - contextPath: TAXIIServer.Collection.title
      description: The collection title.
      type: String
    - contextPath: TAXIIServer.Collection.description
      description: The collection description.
      type: String
  - description: Returns the TAXII server info, default URL, title, etc.
    name: taxii-server-info
    outputs:
    - contextPath: TAXIIServer.ServerInfo.title
      description: The server title.
      type: String
    - contextPath: TAXIIServer.ServerInfo.api_roots
      description: The server API roots URLs.
      type: Unknown
    - contextPath: TAXIIServer.ServerInfo.default
      description: The default URL.
      type: String
    - contextPath: TAXIIServer.ServerInfo.description
      description: The server description.
      type: String
  dockerimage: demisto/flask-nginx:1.0.0.11047721
  longRunning: true
  longRunningPort: true
  script: '-'
  subtype: python3
  type: python
tests:
- TAXII2 Server Performance Test
fromversion: 6.1.0
triggers:
- conditions:
  - name: engine
    operator: not_exists
  - name: isEngineGroup
    operator: not_exists
  effects:
  - name: longRunningPort
    action:
      hidden: true
      required: false