category: Data Enrichment & Threat Intelligence
provider: Open Source
sectionorder:
- Connect
- Collect
commonfields:
  id: TAXII Server
  version: -1
configuration:
- defaultvalue: 'true'
  display: Long Running Instance
  name: longRunning
  type: 8
  hidden: true
  section: Connect
  required: false
- display: Certificate (Required for HTTPS)
  name: certificate
  type: 12
  section: Connect
  required: false
- display: Private Key (Required for HTTPS)
  name: key
  type: 14
  section: Connect
  required: false
- display: Username
  name: credentials
  type: 9
  section: Connect
  required: false
- additionalinfo: JSON string of indicator query collections - dictionary of the collection name as the key and the query as the value.
  defaultvalue: |-
    {
       "AWS": "type:CIDR and sourceBrands:\"AWS Feed\""
    }
  display: Collection JSON
  name: collections
  required: true
  type: 12
  section: Collect
- display: TAXII Service URL Address
  additionalinfo: The URL address to set in the TAXII service response. If not set, the integration will try to auto-detect the URL.
  name: service_address
  type: 0
  section: Connect
  required: false
- additionalinfo: Runs the service on this port from within Cortex XSOAR. Requires a unique port for each long-running integration instance. Do not use the same port for multiple instances. (For Cortex XSOAR 8 and Cortex XSIAM) If you do not enter a Listen Port, an unused port for the EDL will automatically be generated when the instance is saved. However, if using an engine, you must enter a Listen Port.
  display: Listen Port
  name: longRunningPort
  required: true
  type: 0
  section: Connect
description: This integration provides TAXII Services for system indicators (Outbound feed).
display: TAXII Server
name: TAXII Server
script:
  dockerimage: demisto/taxii-server:1.0.0.10133006
  longRunning: true
  longRunningPort: true
  script: '-'
  subtype: python3
  type: python
tests:
- TAXII_Feed_Test
fromversion: 5.5.0
triggers:
  - conditions:
      - name: engine
        operator: not_exists
      - name: isEngineGroup
        operator: not_exists
    effects:
      - name: longRunningPort
        action:
          hidden: true
          required: false