TAXII Server

Details
Content
Dependencies
Version History

This pack provides TAXII Services for system indicators (Outbound feed).

Integrations

Name	Description
TAXII2 Server	This integration provides TAXII2 Services for system indicators (Outbound feed).
TAXII Server	This integration provides TAXII Services for system indicators (Outbound feed).

Integrations

Name	Description
TAXII2 Server	This integration provides TAXII2 Services for system indicators (Outbound feed).
TAXII Server	This integration provides TAXII Services for system indicators (Outbound feed).

Pack Name	Pack By
Base	By: Cortex XSOAR

Pack Name	Pack By
Base	By: Cortex XSOAR

2.3.10 - 14569367 (November 9, 2026)

Integrations

TAXII Server

Updated the Docker image to: demisto/taxii-server:1.0.0.14323108.

Related pull requests:
- 46525

Download

2.3.9 - 14405957 (November 4, 2026)

Integrations

TAXII2 Server

Fixed an issue where the server intermittently returned HTTP 400 errors that were cached and served to all clients.
Improved the stability of the nginx log monitoring.

Related pull requests:
- 46461

Download

2.3.8 - 14185046 (October 28, 2026)

Integrations

TAXII2 Server

Fixed an issue where the Test button and health check failed with an Address in use error when the integration instance was already running.
Added a check that fails the Test button with a clear error when the Listen Port is already used by a different integration instance.
Improved the Test button health check for a running instance so it no longer waits for a full response from the server.

Related pull requests:
- 46358

Download

2.3.7 - 13994690 (October 21, 2026)

Integrations

TAXII Server

Fixed an issue where polling the outbound TAXII 1 feed could return an HTTP 500 error.
Fixed an issue where File indicators whose value is not a valid MD5/SHA1/SHA256/SHA512 hash (such as file paths, file names, or fuzzy/SSDEEP hashes) were sent to the STIX/CybOX serializer, which produced invalid STIX output that failed schema validation downstream.
Fixed an issue where invalid XML control characters (e.g. NULL bytes) in indicator values caused XML serialization failures when embedded in STIX/CybOX observables.

Related pull requests:
- 46327

Download

2.3.6 - 13920761 (October 19, 2026)

Integrations

TAXII Server

Updated the Docker image to: demisto/taxii-server:1.0.0.13514731.

Related pull requests:
- 46307

Download

2.3.5 - 13620815 (October 7, 2026)

TAXII Server

Documentation and metadata improvements.

Related pull requests:
- 45950

Download

2.3.4 - 13242712 (September 23, 2026)

Integrations

TAXII2 Server

Fixed an issue where fetching objects and manifests was slow when using a high pagination offset.

Related pull requests:
- 45830

Download

2.3.3 - 13134964 (September 17, 2026)

Integrations

TAXII2 Server

Updated the Docker image to: demisto/flask-nginx:1.0.0.12826098.

Related pull requests:
- 45904

Download

2.3.2 - 13122032 (September 16, 2026)

Integrations

TAXII Server

Updated the Docker image to: demisto/taxii-server:1.0.0.12844876.

Related pull requests:
- 45898

Download

2.3.1 - 11786168 (August 9, 2026)

Integrations

TAXII2 Server

Documentation and metadata improvements.

Related pull requests:
- 45167

Download

2.3.0 - 11158821 (July 19, 2026)

Integrations

TAXII2 Server

Deprecated the Cache Lock Timeout and Cache Lock Age parameters.
Improved implementation of cache concurrency control to better handle a high volume of concurrent requests.
Updated the Docker image to demisto/flask-nginx:1.0.0.11047721.

Related pull requests:
- 44829

Download

2.2.12 - 10828903 (July 7, 2026)

Integrations

TAXII2 Server

Updated the Docker image to: demisto/flask-nginx:1.0.0.10133006.

Related pull requests:
- 44905

Download

2.2.11 - 10788200 (July 6, 2026)

Integrations

TAXII Server

Updated the Docker image to: demisto/taxii-server:1.0.0.10133006.

Related pull requests:
- 44879

Download

2.2.10 - 9135808 (May 19, 2026)

Integrations

TAXII2 Server

Maintenance and stability improvements.

Related pull requests:
- 44323

Download

2.2.9 - 9025379 (May 14, 2026)

Integrations

TAXII2 Server

Documentation and metadata improvements.

Related pull requests:
- 44231

Download

2.2.8 - 8923689 (May 11, 2026)

Integrations

TAXII2 Server

Updated the TAXII 2 Server cache mechanism by implementing a background refresh and stale-while-revalidate strategy, ensuring better performance and availability when multiple clients access the service simultaneously.
Updated the Docker image to: demisto/flask-nginx:1.0.0.8240011.

Related pull requests:
- 43793

Download

2.2.7 - 8865647 (May 10, 2026)

Integrations

TAXII2 Server

Added support for the tags field in the indicator's rawJSON according to the change in TAXII2ApiModule.

Related pull requests:
- 44209

Download

2.2.6 - 8592679 (April 29, 2026)

Integrations

TAXII2 Server

Added support for the trafficlightprotocol field in the indicator's rawJSON according to the change in TAXII2ApiModule.

Related pull requests:
- 43703

Download

2.2.5 - 8009783 (March 30, 2026)

Integrations

TAXII2 Server

Updated the TAXII2ApiModule to fix an issue where the labels field was missing custom tags in TAXII 2.1 responses.

Related pull requests:
- 43618
- 43388
- 43616
- 42281
- 43619
- 43569
- 43568
- 43547
- 43567
- 43485
- 43408
- 43625
- 43636

Download

2.2.4 - 7843807 (March 22, 2026)

Documentation and metadata improvements.

Related pull requests:
- 43568

Download

2.2.3 - 7001339 (February 3, 2026)

Integrations

TAXII2 Server

Fixed an issue where the valid_until field was not being extracted correctly.

Related pull requests:
- 42887

Download

2.2.2 - 6744840 (January 18, 2026)

Integrations

TAXII2 Server

Added support for SOFTWARE type indicators from STIX 2.1 bundles.

Related pull requests:
- 42627

Download

2.2.1 - 6332198 (December 18, 2025)

Integrations

TAXII2 Server

Fixed an issue where the tags field was not extracted for all indicator types.

Related pull requests:
- 42300

Download

2.2.0 - 6187133 (December 8, 2025)

Integrations

TAXII2 Server

Optimized pagination to improve overall performance and response times when using the request next parameter.

Related pull requests:
- 41813

Download

2.1.12 - 6154473 (December 5, 2025)

Integrations

TAXII2 Server

Added the Cortex XSOAR Extensions fields in STIX Domain Object (SDO) indicators. Cortex XSOAR now includes custom XSOAR indicator fields as extension properties when generating indicators.
Updated the Docker image to: demisto/flask-nginx:1.0.0.6091652.

Related pull requests:
- 42081

Download

2.3.10 - 14569367 (November 9, 2026)

Integrations

TAXII Server

Updated the Docker image to: demisto/taxii-server:1.0.0.14323108.

Related pull requests:
- 46525

Download

2.3.9 - 14405957 (November 4, 2026)

Integrations

TAXII2 Server

Fixed an issue where the server intermittently returned HTTP 400 errors that were cached and served to all clients.
Improved the stability of the nginx log monitoring.

Related pull requests:
- 46461

Download

2.3.8 - 14185046 (October 28, 2026)

Integrations

TAXII2 Server

Fixed an issue where the Test button and health check failed with an Address in use error when the integration instance was already running.
Added a check that fails the Test button with a clear error when the Listen Port is already used by a different integration instance.
Improved the Test button health check for a running instance so it no longer waits for a full response from the server.

Related pull requests:
- 46358

Download

2.3.7 - 13994690 (October 21, 2026)

Integrations

TAXII Server

Fixed an issue where polling the outbound TAXII 1 feed could return an HTTP 500 error.
Fixed an issue where File indicators whose value is not a valid MD5/SHA1/SHA256/SHA512 hash (such as file paths, file names, or fuzzy/SSDEEP hashes) were sent to the STIX/CybOX serializer, which produced invalid STIX output that failed schema validation downstream.
Fixed an issue where invalid XML control characters (e.g. NULL bytes) in indicator values caused XML serialization failures when embedded in STIX/CybOX observables.

Related pull requests:
- 46327

Download

2.3.6 - 13941772 (October 20, 2026)

Integrations

TAXII Server

Updated the Docker image to: demisto/taxii-server:1.0.0.13514731.

Related pull requests:
- 46307

Download

2.3.5 - R13620815 (October 7, 2026)

TAXII Server

Documentation and metadata improvements.

Related pull requests:
- 45950

Download

2.3.4 - 13242712 (September 23, 2026)

Integrations

TAXII2 Server

Fixed an issue where fetching objects and manifests was slow when using a high pagination offset.

Related pull requests:
- 45830

Download

2.3.3 - 13134964 (September 17, 2026)

Integrations

TAXII2 Server

Updated the Docker image to: demisto/flask-nginx:1.0.0.12826098.

Related pull requests:
- 45904

Download

2.3.2 - 13122032 (September 16, 2026)

Integrations

TAXII Server

Updated the Docker image to: demisto/taxii-server:1.0.0.12844876.

Related pull requests:
- 45898

Download

2.3.1 - 11786168 (August 9, 2026)

Integrations

TAXII2 Server

Documentation and metadata improvements.

Related pull requests:
- 45167

Download

2.3.0 - 11158821 (July 19, 2026)

Integrations

TAXII2 Server

Deprecated the Cache Lock Timeout and Cache Lock Age parameters.
Improved implementation of cache concurrency control to better handle a high volume of concurrent requests.
Updated the Docker image to demisto/flask-nginx:1.0.0.11047721.

Related pull requests:
- 44829

Download

2.2.12 - 10828903 (July 7, 2026)

Integrations

TAXII2 Server

Updated the Docker image to: demisto/flask-nginx:1.0.0.10133006.

Related pull requests:
- 44905

Download

2.2.11 - 10788200 (July 6, 2026)

Integrations

TAXII Server

Updated the Docker image to: demisto/taxii-server:1.0.0.10133006.

Related pull requests:
- 44879

Download

2.2.10 - 9135808 (May 19, 2026)

Integrations

TAXII2 Server

Maintenance and stability improvements.

Related pull requests:
- 44323

Download

2.2.9 - 9025379 (May 14, 2026)

Integrations

TAXII2 Server

Documentation and metadata improvements.

Related pull requests:
- 44231

Download

2.2.8 - 8923689 (May 11, 2026)

Integrations

TAXII2 Server

Updated the TAXII 2 Server cache mechanism by implementing a background refresh and stale-while-revalidate strategy, ensuring better performance and availability when multiple clients access the service simultaneously.
Updated the Docker image to: demisto/flask-nginx:1.0.0.8240011.

Related pull requests:
- 43793

Download

2.2.7 - 8865647 (May 10, 2026)

Integrations

TAXII2 Server

Added support for the tags field in the indicator's rawJSON according to the change in TAXII2ApiModule.

Related pull requests:
- 44209

Download

2.2.6 - 8592679 (April 29, 2026)

Integrations

TAXII2 Server

Added support for the trafficlightprotocol field in the indicator's rawJSON according to the change in TAXII2ApiModule.

Related pull requests:
- 43703

Download

2.2.5 - 8009783 (March 30, 2026)

Integrations

TAXII2 Server

Updated the TAXII2ApiModule to fix an issue where the labels field was missing custom tags in TAXII 2.1 responses.

Related pull requests:
- 43618
- 43388
- 43616
- 42281
- 43619
- 43569
- 43568
- 43547
- 43567
- 43485
- 43408
- 43625
- 43636

Download

2.2.4 - 7850318 (March 23, 2026)

Documentation and metadata improvements.

Related pull requests:
- 43568

Download

2.2.3 - 7001339 (February 3, 2026)

Integrations

TAXII2 Server

Fixed an issue where the valid_until field was not being extracted correctly.

Related pull requests:
- 42887

Download

2.2.2 - 6744840 (January 18, 2026)

Integrations

TAXII2 Server

Added support for SOFTWARE type indicators from STIX 2.1 bundles.

Related pull requests:
- 42627

Download

2.2.1 - 6332198 (December 18, 2025)

Integrations

TAXII2 Server

Fixed an issue where the tags field was not extracted for all indicator types.

Related pull requests:
- 42300

Download

2.2.0 - 6187133 (December 8, 2025)

Integrations

TAXII2 Server

Optimized pagination to improve overall performance and response times when using the request next parameter.

Related pull requests:
- 41813

Download

2.1.12 - 6154473 (December 5, 2025)

Integrations

TAXII2 Server

Added the Cortex XSOAR Extensions fields in STIX Domain Object (SDO) indicators. Cortex XSOAR now includes custom XSOAR indicator fields as extension properties when generating indicators.
Updated the Docker image to: demisto/flask-nginx:1.0.0.6091652.

Related pull requests:
- 42081

Download

PUBLISHER

PLATFORMS

Cortex XSOARCortex XSIAM

INFO

Certification	Certified	Read more
Supported By	Cortex
Created	November 9, 2020
Last Release	November 9, 2026

WORKS WITH THE FOLLOWING INTEGRATIONS:

DISCLAIMER

By downloading or using Marketplace content, you agree to the applicable Terms of Use and End User License Agreement. Third-party content is provided by its publisher, and Palo Alto Networks does not warrant, endorse, support, or assume responsibility for content not expressly identified as owned by Palo Alto Networks.