Configure a new TAXII Feed

  • Release version: Australia
  • Updated March 12, 2026
  • 4 minutes to read

    • You can maintain TAXII feeds for sharing STIX-formatted information. Each TAXII feed contains one or more TAXII collections.

    Before you begin

    Role required: sn_sec_tisc.admin

    Procedure

    1. Navigate to Workspaces > Threat Intelligence Security Center.
    2. Select the Integrations icon.
    3. Select Threat Intel Feeds > STIX TAXII > TAXII Feeds.
      Note:
      Configure TAXII feed to serve as a profile for all the TAXII Collections within.
    4. Select Configure new source.
      The Configure new TAXII Feed page is displayed.
    5. On the form, fill in the fields.
      Table 1. Create Data Source
      Field Description
      Name Name of the feed.
      Description Description of the feed.
      Source Type Type of source provided for the feed. The available source types are:
      • Government
      • ISACs
      • Open Source
      • Premium Source
      • Other Source
      Logo Logo of the source feed.
      Industry Industry category for which the feed data source is applicable.

      Fill in the fields in the Configuration section, as appropriate.

      Table 2. Configuration
      Field Description
      TAXII Version TAXII Version of the TAXII server to be configured. Supported versions are 2.0 and 2.1.
      Configuration Type Configuration type to fetch TAXII collections. Available values are:
      • Discovery Service URL: Choose Discovery Service URL to fetch collections from all available API roots within the discovery service of the TAXII server.
      • API Root URL: Choose API Root URL to fetch collections from the specific API root of the TAXII server.
      Authentication Required option from the list if authentication is required. The available options are:
      • None: Select this option if there is no authentication required.
      • Basic: Select this option to provide username and password.
      • API Key: Select this option to provide an API key.
      • Choose a REST message: Select this option for any other type of authentication. The REST message options are:
        • Use REST Message: Select this check box if you need a REST message to build a pre-build REST Message. If you clear this check box, the system uses the value in the endpoint field. Select the lookup icon, and select the REST message from the list.
        • REST Method: Select this check box if you need a REST method. Select the lookup icon, and select the REST method from the list.
      Note:
      The REST message and REST method fields are set to available when the REST message option is selected.
      URL TAXII Server Discovery Service URL or specific API Root URL based on the selected configuration type.
      Advanced section
      Advanced Check box to choose a different Integration script and Report Processor. Verify the chosen scripts are compatible with the selected TAXII version. Based on the TAXII version and authentication, these scripts are auto populated by default.
      Integration script Invokes a call to the REST Endpoint URL API using authentication parameters. The script fetches observables or indicators STIX data available for the specific feed.
      Note:
      The fetched data is raw data only with no records created. The data is attached to the integration process and can be viewed under the Integration Run section.
      The base system includes custom script includes provisioned within the application for integration scripts:
      • TAXIIV2_0QueryParamAPIKeyIntegrationScript
      • TAXIIV2_0BasicAuthIntegrationScript
      • TAXIIV2_1QueryParamAPIKeyIntegrationScript
      • TAXIIV2_1BasicAuthIntegrationScript
      The default integration script is based on the selected feed type. The script include runs a simple REST call, saves the response as an attachment, and returns the attachment to the processor.
      Report processor The report processor invokes a call to the REST Endpoint URL.

      The base system includes the custom script include TAXIIV2CollectionDataProcessor, which is provisioned within the application for integration scripts.

      Fill in the fields in the Scheduling section, as appropriate.

      Table 3. Scheduling
      Field Description
      Run Frequency of Collections Scheduling interval applied to the TAXII collection records. Run frequency for a TAXII collection can be modified in the TAXII collection form view if required.
      Note:
      This setting is applied as default to all fetched TAXII collections. There is an option to override the setting in TAXII Collections if required. TAXII
      For more information, see Scheduled Jobs and how to Automatically run a script of your choosing.
      Fetch Data From Start date from when the data needs to be fetched. Set this field with the time from when data needs to be ingested from the corresponding source. After setting this field, the next ingestion run fetches data from the configured time and consecutive runs fetch incremental data.

      For example, a source is scheduled to ingest data every hour. If you set Fetch Data From to Jan 12 6:00AM on Jan 12 9:30AM, the ingestion triggering on Jan 12 10:00AM fetches data from Jan 12 6:00AM to Jan 12 10:00AM. The next ingestion at 11:00AM fetches only incremental data from Jan 12 10:00AM to Jan 12 11:00AM.

      Note:
      This means the scheduled runs will fetch data incrementally starting from the specified date onwards.
    6. Select Validate Connection
      An information message is displayed that the TAXII Feed connection is successful. To fetch the collections proceed to the next step.
    7. Select Get TAXII Collections.
      Note:
      If there are any errors, then an error message is displayed that an error occurred while fetching TAXII collections and check logs for more details.

      The TAXII Collections are displayed under the TAXII Collections section, and they are inactive by default.

    8. Enable the TAXII Collections to retrieve the STIX objects available in these TAXII collections.