TAXII Feed

Details
Content
Dependencies
Version History

Download With Dependencies

Ingest indicator feeds from TAXII 1 and TAXII 2 servers.

Pack Contributors:

barpec12

Contributions are welcome and appreciated. For more info, visit our Contribution Guide.

Pack Contributors:

barpec12

Contributions are welcome and appreciated. For more info, visit our Contribution Guide.

Indicator Fields

Name	Description
STIX Indicator Name
STIX Indicator Description
STIX TTP Title

Integrations

Name	Description
TAXII Feed	Ingests indicator feeds from TAXII 1.x servers.
TAXII 2 Feed	Ingests indicator feeds from TAXII 2.0 and 2.1 servers.

Indicator Fields

Name	Description
STIX Indicator Name
STIX TTP Title
STIX Indicator Description

Integrations

Name	Description
TAXII Feed	Ingests indicator feeds from TAXII 1.x servers.
TAXII 2 Feed	Ingests indicator feeds from TAXII 2.0 and 2.1 servers.

Pack Name	Pack By
Base	By: Cortex XSOAR

Pack Name	Pack By
Base	By: Cortex XSOAR

1.2.31 - 2438447 (February 11, 2025)

Integrations

Fixed an issue where Domain type indicators were not retrieved in the get-indicators and fetch-indicators commands.

TAXII 2 Feed

Fixed an issue where under specific conditions the exported times of the indicators were presented as UTC when they were actually in local time. All the exported times are now correctly parsed into UTC the time zone.

Related pull requests:
- 38349

Download

1.2.29 - 2148169 (February 5, 2025)

Integrations

TAXII 2 Feed

Enhanced the feed to mark indicators as enrichment excluded when the tlp color is red.

TAXII Feed

Enhanced the feed to mark indicators as enrichment excluded when the tlp color is red.

Related pull requests:
- 38308

Download

1.2.28 - R2040490 (January 22, 2025)

Integrations

TAXII Feed

Code functionality improvements.
Updated the Docker image to: demisto/taxii:1.0.0.117607.

Related pull requests:
- 37472

Download

1.2.27 - 1812905 (December 15, 2024)

Integrations

TAXII 2 Feed

Fixed an issue where the fetch-indicators command failed with indicators of type ipv4.

Related pull requests:
- 37417

Download

1.2.26 - 1783218 (December 10, 2024)

Integrations

TAXII Feed

Fixed an issue where some indicators were not parsed correctly.

Related pull requests:
- 37163

Download

1.2.25 - 1775999 (December 9, 2024)

Integrations

TAXII 2 Feed

Updated the parsing logic for the autonomous system indicator. When the indicator value is a number, it will be converted to a string.

Related pull requests:
- 37563
- 37449

Download

1.2.24 - 1741355 (December 3, 2024)

Integrations

TAXII 2 Feed

Fixed an issue where indicators without names were not properly parsed.

Related pull requests:
- 36027

Download

1.2.23 - 1699115 (November 25, 2024)

Integrations

TAXII 2 Feed

Updated the Docker image to: demisto/taxii2:1.0.0.117320.

Related pull requests:
- 37378
- 37355
- 37356
- 37357

Download

1.2.22 - 1679416 (November 20, 2024)

Integrations

TAXII Feed

Updated the Docker image to: demisto/taxii:1.0.0.116749.

Related pull requests:
- 37298
- 37292
- 37293
- 37294

Download

1.2.21 - 1644440 (November 13, 2024)

Integrations

TAXII Feed

Documentation and metadata improvements.

Related pull requests:
- 37200

Download

1.2.20 - 1457639 (October 1, 2024)

Integrations

TAXII 2 Feed

Updated the Docker image to: demisto/taxii2:1.0.0.112358.

Related pull requests:
- 36445

Download

1.2.19 - 1431233 (September 25, 2024)

Integrations

TAXII Feed

Fixed an issue where the Accept header was missing from the request.

Related pull requests:
- 36197

Download

1.2.18 - 1363131 (September 9, 2024)

Integrations

TAXII Feed

Added incremental feed indication to yml file.
Updated the Docker image to: demisto/taxii:1.0.0.108107.

Related pull requests:
- 35937

Download

1.2.17 - 1358619 (September 8, 2024)

Integrations

TAXII 2 Feed

Fixed an issue where the fetch-indicators command failed to parse nested reports indicators correctly in the Unit42v2 Feed.

Related pull requests:
- 35723

Download

1.2.16 - 1269433 (August 13, 2024)

Integrations

TAXII Feed

Removed the When removed from the feed option from the Indicator Expiration Method parameter.
Updated the Docker image to: demisto/taxii:1.0.0.106334.

Related pull requests:
- 35353

Download

1.2.15 - 1248464 (August 6, 2024)

Integrations

TAXII 2 Feed

Added debug log when incorrect Discovery Service URL is provided.
Updated the Docker image to: demisto/taxii2:1.0.0.105766.

Related pull requests:
- 35166

Download

1.2.14 - 1038463 (May 23, 2024)

Integrations

TAXII 2 Feed

Fixed an issue in the TAXII2ApiModule related to TAXII2 server integration.

Related pull requests:
- 34484

Download

1.2.13 - 1027410 (May 20, 2024)

Integrations

TAXII 2 Feed

Fixed an issue in the TAXII2ApiModule related to TAXII2 server integration.

Related pull requests:
- 34434

Download

1.2.12 - 931860 (April 3, 2024)

Integrations

TAXII 2 Feed

Added support for extracting the is_family field from the Malware indicator.
Added support for extracting the sample_refs field from the Registry Key indicator.
Added support for extracting the number_of_subkeys field from the Registry Key indicator.
Added support for extracting the values field from the Registry Key indicator.
Updated the Docker image to: demisto/taxii2:1.0.0.90938.

Related pull requests:
- 33106

Download

1.2.11 - 907391 (March 21, 2024)

Integrations

TAXII 2 Feed

Added support for confidence and languages indicator fields to all IOCs, when applicable.
Fixed an issue where stixid, firstseenbysource, modified, description, trafficlightprotocol and publications were not added to IOCs of type indicator.

Related pull requests:
- 32986

Download

1.2.10 - 904622 (March 20, 2024)

Integrations

TAXII 2 Feed

Updated the TAXII2ApiModule script.

Related pull requests:
- 33361
- 33305

Download

1.2.9 - 876540 (March 7, 2024)

Integrations

TAXII 2 Feed

Updated the feed parameter order and the API root parameter title.
Updated the feed description to add clarity to using different API roots.
Updated the Docker image to: demisto/taxii2:1.0.0.89439.

Related pull requests:
- 33241

Download

1.2.8 - 870683 (March 5, 2024)

Integrations

TAXII 2 Feed

Fixed an issue where the taxii2-get-indicators command would fail when the TAXII Server would response with a different amount of expected objects.

Related pull requests:
- 33061

Download

1.2.7 - 865088 (March 3, 2024)

Integrations

TAXII 2 Feed

Updated the Docker image to: demisto/taxii2:1.0.0.88937.

Related pull requests:
- 33192

Download

1.2.6 - 828628 (February 14, 2024)

Integrations

TAXII 2 Feed

Fixed an issue where fetch-indicators command returned to server the same indicators from previous fetch.

Related pull requests:
- 32783

Download

1.2.5 - 823153 (February 12, 2024)

Integrations

TAXII 2 Feed

Updated the Docker image to: demisto/taxii2:1.0.0.87504.

Related pull requests:
- 32845

Download

1.2.4 - 798475 (February 1, 2024)

Integrations

TAXII 2 Feed

Updated the Docker image to: demisto/taxii2:1.0.0.86437.

Related pull requests:
- 32537

Download

1.2.3 - 769959 (January 18, 2024)

Integrations

TAXII 2 Feed

Added support for returning digested indicators in cases of connectivity issues during the fetch-indicators command.
Updated the Docker image to: demisto/taxii2:1.0.0.84787.

Related pull requests:
- 32143

Download

1.2.2 - 7007194 (November 28, 2023)

Integrations

TAXII Feed

Fixed an issue where TaxiiFeed failed to retrieve all indicators due to wrong extraction from XML blocks.
Updated the Docker image to: demisto/taxii:1.0.0.80809.

Related pull requests:
- 31120

Download

1.2.1 - 6834680 (November 8, 2023)

Integrations

TAXII 2 Feed

Updated the Docker image to: demisto/taxii2:1.0.0.80190.
Updated the default TAXII protocol to 2.1.

Related pull requests:
- 29947

Download

1.2.0 - 6617721 (October 16, 2023)

Integrations

TAXII Feed

Fixed an issue when parsing certain empty indicator objects.
Added an error log when indicator objects failed to parse.
Updated the Docker image to: demisto/taxii:1.0.0.76522.

Related pull requests:
- 30131
- 30054

Download

1.1.33 - 6238121 (September 5, 2023)

Integrations

TAXII 2 Feed

STIX report indicators pulled from the feed will now contain the Report Object References indicator field, which holds the IDs of related indicators.

Related pull requests:
- 29327

Download

1.2.31 - 2438447 (February 11, 2025)

Integrations

TAXII Feed

Fixed an issue where Domain type indicators were not retrieved in the get-indicators and fetch-indicators commands.

TAXII 2 Feed

Related pull requests:
- 38349

Download

1.2.29 - 2148169 (February 5, 2025)

Integrations

TAXII 2 Feed

Enhanced the feed to mark indicators as enrichment excluded when the tlp color is red.

TAXII Feed

Enhanced the feed to mark indicators as enrichment excluded when the tlp color is red.

Related pull requests:
- 38308

Download

1.2.28 - R2040490 (January 22, 2025)

Integrations

TAXII Feed

Code functionality improvements.
Updated the Docker image to: demisto/taxii:1.0.0.117607.

Related pull requests:
- 37472

Download

1.2.27 - 1812905 (December 15, 2024)

Integrations

TAXII 2 Feed

Fixed an issue where the fetch-indicators command failed with indicators of type ipv4.

Related pull requests:
- 37417

Download

1.2.26 - 1783218 (December 10, 2024)

Integrations

TAXII Feed

Fixed an issue where some indicators were not parsed correctly.

Related pull requests:
- 37163

Download

1.2.25 - 1775999 (December 9, 2024)

Integrations

TAXII 2 Feed

Updated the parsing logic for the autonomous system indicator. When the indicator value is a number, it will be converted to a string.

Related pull requests:
- 37563
- 37449

Download

1.2.24 - 1741355 (December 3, 2024)

Integrations

TAXII 2 Feed

Fixed an issue where indicators without names were not properly parsed.

Related pull requests:
- 36027

Download

1.2.23 - 1699115 (November 25, 2024)

Integrations

TAXII 2 Feed

Updated the Docker image to: demisto/taxii2:1.0.0.117320.

Related pull requests:
- 37378
- 37355
- 37356
- 37357

Download

1.2.22 - 1679416 (November 20, 2024)

Integrations

TAXII Feed

Updated the Docker image to: demisto/taxii:1.0.0.116749.

Related pull requests:
- 37298
- 37292
- 37293
- 37294

Download

1.2.21 - 1644440 (November 13, 2024)

Integrations

TAXII Feed

Documentation and metadata improvements.

Related pull requests:
- 37200

Download

1.2.20 - 1457639 (October 1, 2024)

Integrations

TAXII 2 Feed

Updated the Docker image to: demisto/taxii2:1.0.0.112358.

Related pull requests:
- 36445

Download

1.2.19 - 1429144 (September 24, 2024)

Integrations

TAXII Feed

Fixed an issue where the Accept header was missing from the request.

Related pull requests:
- 36197

Download

1.2.18 - 1363131 (September 9, 2024)

Integrations

TAXII Feed

Added incremental feed indication to yml file.
Updated the Docker image to: demisto/taxii:1.0.0.108107.

Related pull requests:
- 35937

Download

1.2.17 - 1358619 (September 8, 2024)

Integrations

TAXII 2 Feed

Fixed an issue where the fetch-indicators command failed to parse nested reports indicators correctly in the Unit42v2 Feed.

Related pull requests:
- 35723

Download

1.2.16 - 1269433 (August 13, 2024)

Integrations

TAXII Feed

Removed the When removed from the feed option from the Indicator Expiration Method parameter.
Updated the Docker image to: demisto/taxii:1.0.0.106334.

Related pull requests:
- 35353

Download

1.2.15 - 1248464 (August 6, 2024)

Integrations

TAXII 2 Feed

Added debug log when incorrect Discovery Service URL is provided.
Updated the Docker image to: demisto/taxii2:1.0.0.105766.

Related pull requests:
- 35166

Download

1.2.14 - 1038463 (May 23, 2024)

Integrations

TAXII 2 Feed

Fixed an issue in the TAXII2ApiModule related to TAXII2 server integration.

Related pull requests:
- 34484

Download

1.2.13 - 1027410 (May 20, 2024)

Integrations

TAXII 2 Feed

Fixed an issue in the TAXII2ApiModule related to TAXII2 server integration.

Related pull requests:
- 34434

Download

1.2.12 - 933455 (April 3, 2024)

Integrations

TAXII 2 Feed

Added support for extracting the is_family field from the Malware indicator.
Added support for extracting the sample_refs field from the Registry Key indicator.
Added support for extracting the number_of_subkeys field from the Registry Key indicator.
Added support for extracting the values field from the Registry Key indicator.
Updated the Docker image to: demisto/taxii2:1.0.0.90938.

Related pull requests:
- 33106

Download

1.2.11 - 907391 (March 21, 2024)

Integrations

TAXII 2 Feed

Added support for confidence and languages indicator fields to all IOCs, when applicable.
Fixed an issue where stixid, firstseenbysource, modified, description, trafficlightprotocol and publications were not added to IOCs of type indicator.

Related pull requests:
- 32986

Download

1.2.10 - 904622 (March 20, 2024)

Integrations

TAXII 2 Feed

Updated the TAXII2ApiModule script.

Related pull requests:
- 33361
- 33305

Download

1.2.9 - 876540 (March 7, 2024)

Integrations

TAXII 2 Feed

Updated the feed parameter order and the API root parameter title.
Updated the feed description to add clarity to using different API roots.
Updated the Docker image to: demisto/taxii2:1.0.0.89439.

Related pull requests:
- 33241

Download

1.2.8 - 870683 (March 5, 2024)

Integrations

TAXII 2 Feed

Fixed an issue where the taxii2-get-indicators command would fail when the TAXII Server would response with a different amount of expected objects.

Related pull requests:
- 33061

Download

1.2.7 - 865088 (March 3, 2024)

Integrations

TAXII 2 Feed

Updated the Docker image to: demisto/taxii2:1.0.0.88937.

Related pull requests:
- 33192

Download

1.2.6 - 828628 (February 14, 2024)

Integrations

TAXII 2 Feed

Fixed an issue where fetch-indicators command returned to server the same indicators from previous fetch.

Related pull requests:
- 32783

Download

1.2.5 - 821588 (February 12, 2024)

Integrations

TAXII 2 Feed

Updated the Docker image to: demisto/taxii2:1.0.0.87504.

Related pull requests:
- 32845

Download

1.2.4 - 795978 (January 31, 2024)

Integrations

TAXII 2 Feed

Updated the Docker image to: demisto/taxii2:1.0.0.86437.

Related pull requests:
- 32537

Download

1.2.3 - 769959 (January 18, 2024)

Integrations

TAXII 2 Feed

Added support for returning digested indicators in cases of connectivity issues during the fetch-indicators command.
Updated the Docker image to: demisto/taxii2:1.0.0.84787.

Related pull requests:
- 32143

Download

1.2.2 - 7007194 (November 28, 2023)

Integrations

TAXII Feed

Fixed an issue where TaxiiFeed failed to retrieve all indicators due to wrong extraction from XML blocks.
Updated the Docker image to: demisto/taxii:1.0.0.80809.

Related pull requests:
- 31120

Download

1.2.1 - 6834680 (November 8, 2023)

Integrations

TAXII 2 Feed

Updated the Docker image to: demisto/taxii2:1.0.0.80190.
Updated the default TAXII protocol to 2.1.

Related pull requests:
- 29947

Download

1.2.0 - 6617721 (October 16, 2023)

Integrations

TAXII Feed

Fixed an issue when parsing certain empty indicator objects.
Added an error log when indicator objects failed to parse.
Updated the Docker image to: demisto/taxii:1.0.0.76522.

Related pull requests:
- 30131
- 30054

Download

1.1.33 - 6238121 (September 5, 2023)

Integrations

TAXII 2 Feed

STIX report indicators pulled from the feed will now contain the Report Object References indicator field, which holds the IDs of related indicators.

Related pull requests:
- 29327

Download

PUBLISHER

PLATFORMS

Cortex XSOARCortex XSIAM

INFO

Certification	Certified	Read more
Supported By	Cortex
Created	July 5, 2020
Last Release	February 11, 2025

WORKS WITH THE FOLLOWING INTEGRATIONS:

DISCLAIMER

Content packs are licensed by the Publisher identified above and subject to the Publisher’s own licensing terms. Palo Alto Networks is not liable for and does not warrant or support any content pack produced by a third-party Publisher, whether or not such packs are designated as “Palo Alto Networks-certified” or otherwise.