Oasis STIX/TAXII2

OASIS TAXII Connector

This connector integrates OASIS TAXII2 with the Swimlane Turbine Platform.

Capabilities

This connector supports the following capabilities.

Add Objects

Delete Objects (TAXII 2.1 only)

Get Collections

Get Collections by ID

Get Objects

Get Object Manifests

Object Versions (TAXII 2.1 only)

Get Status

Server Discovery

Asset Setup

The Oasis TAXII2 connector currently supports the following authentication methods:

HTTP Basic

This asset requires an URL, Username, and Password for the integration to work.

Additionally, if the Client Side certificates are required for authentication, you may add them as a base64-encoded string.

If you are connecting to a TAXII 2.1 server, set Use TAXII 2.1? to TRUE.

Client Certificate Auth

This asset requires an URL, Client Side Certificate, and Client Side Key for the integration to work.

You have to add them as base64-encoded strings.

If you are connecting to a TAXII 2.1 server, set Use TAXII 2.1? to TRUE.

Tasks Setup

The following tasks have different actions for TAXII 2.0 and TAXII 2.1:

Get Objects

Get Object Manifests

Server Discovery

Use correct action suitable to the TAXII server.

Pagination

In case Playbook throws a Playbook memory limit error while running actions, use available pagination parameters and filter parameters to limit the number of items in each response.

Use limit and next parameters for TAXII 2.1 actions to limit the number of objects per response. For more information, click here

Use the Range header for TAXII 2.0 actions to specify which objects to be present in the response. Example: A response to the request with header Range: items 10-25 will contain objects 10 through 25(inclusive). Note: This header follows 0-based indexing. For more information, click here

Notes

For more information on TAXII 2.0, click here.

For more information on TAXII 2.1, click here.

Additional Documentation

Oasis STIX/TAXII2 Connector Documentation

Oasis STIX/TAXII2 API Documentation

Oasis STIX/TAXII2 Authentication Guide

Configurations

Asset

Authenticates using Client Certificate and Key.

Configuration Parameters

Parameter	Description	Type	Required
url	Root URL for TAXII2 server.	string	Required
verify_ssl	Verify SSL certificate	boolean	Optional
http_proxy	A proxy to route requests through.	string	Optional
client_side_cert	Base64-encoded Client Side Certificate to Taxii2	string	Required
client_side_key	Base64-encoded Client Side Key to Taxii2	string	Required
taxii_21	True, if URL belongs to TAXII2.1 server.	boolean	Required

HTTP Basic Authentication

Authenticates using username and password.

Configuration Parameters

Parameter	Description	Type	Required
url	Root URL for TAXII2 server.	string	Required
verify_ssl	Verify SSL certificate	boolean	Optional
http_proxy	A proxy to route requests through.	string	Optional
username	Username	string	Required
password	Password	string	Required
client_side_cert	Base64-encoded Client Side Certificate to Taxii2	string	Optional
client_side_key	Base64-encoded Client Side Key to Taxii2	string	Optional
taxii_21	True, if URL belongs to TAXII2.1 server.	boolean	Required

Actions

Add Objects

Add Objects to a Collection in TAXII2 server.

Endpoint

URL: /collections/{{collection_id}}/objects/

Method: POST

Input

Argument Name	Type	Required	Description
path_parameters.collection_id	string	Required	Parameters for the Add Objects action
payload	object	Required	A TAXII envelope for TAXII 2.1 or a TAXII bundle for TAXII 2.0 in JSON format.
headers	object	Optional	Request Headers
headers.Content-Type	string	Optional	Custom header for TAXII 2.0 server, if the default application/vnd.oasis.stix+json; version=2.0 is not used.

Input Example

{"path_parameters":{"collection_id":"string"},"payload":{},"headers":{"Content-Type":"string"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
id	string	Unique identifier
status	string	Status value
request_timestamp	string	Output field: request_timestamp
total_count	number	Count value
success_count	number	Whether the operation was successful
successes	array	Whether the operation was successful
successes.id	string	Unique identifier
successes.version	string	Whether the operation was successful
failure_count	number	Count value
failures	array	Output field: failures
failures.id	string	Unique identifier
failures.version	string	Output field: failures.version
failures.message	string	Response message
pending_count	number	Count value
pendings	array	Output field: pendings
pendings.id	string	Unique identifier
pendings.version	string	Output field: pendings.version

Output Example

{"status_code":202,"response_headers":{"Date":"Thu, 13 Jul 2023 16:38:54 GMT","Content-Type":"application/taxii+json;version=2.1","Content-Length":"800","Connection":"close","Allow":"GET, HEAD, OPTIONS","Content-Security-Policy":"img-src https: data: blob:;","Referrer-Policy":"same-origin","Server":"gunicorn","Strict-Transport-Security":"max-age=315360000; includeSubDomains; preload","X-Content-Type-Options":"nosniff, nosniff","X-Frame-Options":"DENY, DENY","X-Krakend":"Version undefined","X-Kra...

Get Collection by ID

Get a Collection by an ID from TAXII2 server.

Endpoint

URL: /collections/{{collection_id}}/

Method: GET

Input

Argument Name	Type	Required	Description
headers	object	Optional	HTTP headers for the request
path_parameters.collection_id	string	Required	Parameters for the Get Collection by ID action

Input Example

{"headers":{},"path_parameters":{"collection_id":"string"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
id	string	Unique identifier
title	string	Output field: title
description	string	Output field: description
can_read	boolean	Output field: can_read
can_write	boolean	Output field: can_write
alias	string	Output field: alias
media_types	array	Type of the resource

Output Example

{"status_code":200,"response_headers":{"Date":"Thu, 13 Jul 2023 16:38:54 GMT","Content-Type":"application/taxii+json;version=2.1","Content-Length":"264","Connection":"keep-alive","Allow":"GET, HEAD, OPTIONS","Content-Security-Policy":"img-src https: data: blob:;","Referrer-Policy":"same-origin","Server":"gunicorn","Strict-Transport-Security":"max-age=315360000; includeSubDomains; preload","X-Content-Type-Options":"nosniff, nosniff","X-Frame-Options":"DENY, DENY","X-Krakend":"Version undefined","...

Get Collections

Get Collections from Taxii2 server.

Endpoint

URL: /collections/

Method: GET

Input

Argument Name	Type	Required	Description
headers	object	Optional	HTTP headers for the request

Input Example

{"headers":{}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
collections	array	Output field: collections
collections.id	string	Unique identifier
collections.title	string	Output field: collections.title
collections.description	string	Output field: collections.description
collections.can_read	boolean	Output field: collections.can_read
collections.can_write	boolean	Output field: collections.can_write
collections.alias	string	Output field: collections.alias
collections.media_types	array	Type of the resource

Output Example

{"status_code":200,"response_headers":{"Date":"Thu, 13 Jul 2023 16:11:41 GMT","Content-Type":"application/taxii+json;version=2.1","Content-Length":"1565","Connection":"keep-alive","Allow":"GET, HEAD, OPTIONS","Content-Security-Policy":"img-src https: data: blob:;","Referrer-Policy":"same-origin","Server":"gunicorn","Strict-Transport-Security":"max-age=315360000; includeSubDomains; preload","X-Content-Type-Options":"nosniff, nosniff","X-Frame-Options":"DENY, DENY","X-Krakend":"Version undefined",...

Get Status

Get status information for a specific status ID.

Endpoint

URL: /status/{{status_id}}/

Method: GET

Input

Argument Name	Type	Required	Description
headers	object	Optional	HTTP headers for the request
path_parameters.status_id	string	Required	Parameters for the Get Status action

Input Example

{"headers":{},"path_parameters":{"status_id":"active"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
id	string	Unique identifier
status	string	Status value
request_timestamp	string	Output field: request_timestamp
total_count	number	Count value
success_count	number	Whether the operation was successful
successes	array	Whether the operation was successful
successes.id	string	Unique identifier
successes.version	string	Whether the operation was successful
failure_count	number	Count value
failures	array	Output field: failures
failures.id	string	Unique identifier
failures.version	string	Output field: failures.version
failures.message	string	Response message
pending_count	number	Count value
pendings	array	Output field: pendings
pendings.id	string	Unique identifier
pendings.version	string	Output field: pendings.version

Output Example

TAXII 2.0 Get Object Manifests

Get manifest information about the contents of a specific Collection in a TAXII 2.0 server.

Endpoint

URL: /collections/{{collection_id}}/manifest/

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.collection_id	string	Required	Parameters for the TAXII 2.0 Get Object Manifests action
parameters.added_after	string	Optional	A timestamp that filters objects to only include those added to the Channel or Collection after the specified timestamp. This parameter is not in any way related to dates or times in a STIX object or any other CTI object.
parameters.match[id]	string	Optional	The identifier of the object(s) that are being requested. When searching for a STIX Object, this is a STIX ID. More than one value can be specified. Values must be comma(,) seperated.
parameters.match[type]	string	Optional	The type of the object(s) that are being requested. More than one value can be specified. Values must be comma(,) seperated.
parameters.match[version]	string	Optional	The version(s) of the object(s) that are being requested from either an object or manifest task. More than one value can be specified. Values must be comma(,) seperated.
headers	object	Optional	Headers
headers.Range	string	Optional	Objects range for pagination. For example value items 10-29, the response will contain objects 10 through 29.

Input Example

{"path_parameters":{"collection_id":"string"},"parameters":{"added_after":"string","match[id]":"string","match[type]":"string","match[version]":"string"},"headers":{"Range":"string"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":206,"response_headers":{"Date":"Fri, 14 Jul 2023 07:13:38 GMT","Content-Type":"application/vnd.oasis.taxii+json; version=2.0","Content-Length":"2429","Connection":"keep-alive","Allow":"GET, HEAD, OPTIONS","Content-Range":"0-15/54707","Content-Security-Policy":"img-src https: data: blob:;","Referrer-Policy":"same-origin","Server":"gunicorn","Strict-Transport-Security":"max-age=315360000; includeSubDomains; preload","X-Content-Type-Options":"nosniff, nosniff","X-Frame-Options":"DENY...

TAXII 2.0 Get Objects

Get Objects of a Collection from a TAXII 2.0 server.

Endpoint

URL: /collections/{{collection_id}}/objects/

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.collection_id	string	Required	Parameters for the TAXII 2.0 Get Objects action
parameters.added_after	string	Optional	A timestamp that filters objects to only include those added to the Channel or Collection after the specified timestamp. This parameter is not in any way related to dates or times in a STIX object or any other CTI object.
parameters.match[id]	string	Optional	The identifier of the object(s) that are being requested. When searching for a STIX Object, this is a STIX ID. More than one value can be specified. Values must be comma(,) seperated.
parameters.match[type]	string	Optional	The type of the object(s) that are being requested. More than one value can be specified. Values must be comma(,) seperated.
parameters.match[version]	string	Optional	The version(s) of the object(s) that are being requested from either an object or manifest task. More than one value can be specified. Values must be comma(,) seperated.
headers	object	Optional	Headers
headers.Range	string	Optional	Objects range for pagination. For example value items 10-29, the response will contain objects 10 through 29.

Input Example

{"path_parameters":{"collection_id":"string"},"parameters":{"added_after":"string","match[id]":"string","match[type]":"string","match[version]":"string"},"headers":{"Range":"string"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
type	string	Type of the resource
id	string	Unique identifier
spec_version	string	Output field: spec_version
objects	array	Output field: objects

Output Example

{"status_code":206,"response_headers":{"Date":"Thu, 13 Jul 2023 18:30:05 GMT","Content-Type":"application/vnd.oasis.taxii+json; version=2.0","Content-Length":"12946","Connection":"keep-alive","Allow":"GET, POST, HEAD, OPTIONS","Content-Range":"90-110/54704","Content-Security-Policy":"img-src https: data: blob:;","Referrer-Policy":"same-origin","Server":"gunicorn","Strict-Transport-Security":"max-age=315360000; includeSubDomains; preload","Vary":"Accept","X-Content-Type-Options":"nosniff, nosniff...

TAXII 2.0 Server Discovery

Discover Server for TAXII 2.0

Endpoint

URL: /taxii/

Method: GET

Input

Argument Name	Type	Required	Description
headers	object	Optional	HTTP headers for the request

Input Example

{"headers":{}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
title	string	Output field: title
description	string	Output field: description
contact	string	Output field: contact
default	string	Output field: default
api_roots	array	Output field: api_roots

Output Example

{"status_code":200,"response_headers":{"Date":"Thu, 13 Jul 2023 16:04:25 GMT","Content-Type":"application/vnd.oasis.taxii+json; version=2.0","Content-Length":"298","Connection":"keep-alive","Allow":"GET, HEAD, OPTIONS","Content-Security-Policy":"img-src https: data: blob:;","Referrer-Policy":"same-origin","Server":"gunicorn","Strict-Transport-Security":"max-age=315360000; includeSubDomains; preload","X-Content-Type-Options":"nosniff, nosniff","X-Frame-Options":"DENY, DENY","X-Krakend":"Version u...

TAXII 2.1 Delete Objects

Delete Objects from a Collection in TAXII 2.1 server.

Endpoint

URL: /collections/{{collection_id}}/objects/{{object_id}}/

Method: DELETE

Input

Argument Name	Type	Required	Description
headers	object	Optional	HTTP headers for the request
path_parameters.collection_id	string	Required	Parameters for the TAXII 2.1 Delete Objects action
path_parameters.object_id	string	Required	Parameters for the TAXII 2.1 Delete Objects action
parameters.match[spec_version]	string	Optional	The specification version(s) of the STIX object that are being requested. More than one value can be specified. Values must be comma(,) seperated.
parameters.match[version]	string	Optional	The version(s) of the object(s) that are being requested from either an object or manifest task. More than one value can be specified. Values must be comma(,) seperated.

Input Example

{"headers":{},"path_parameters":{"collection_id":"string","object_id":"string"},"parameters":{"match[spec_version]":"string","match[version]":"string"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

TAXII 2.1 Get Object Manifests

Get manifest information about the contents of a specific Collection in a TAXII 2.1 server.

Endpoint

URL: /collections/{{collection_id}}/manifest/

Method: GET

Input

Argument Name	Type	Required	Description
headers	object	Optional	HTTP headers for the request
path_parameters.collection_id	string	Required	Parameters for the TAXII 2.1 Get Object Manifests action
parameters.added_after	string	Optional	A single timestamp that filters objects to only include those objects added after the specified timestamp. The added_after parameter is not in any way related to dates or times in a STIX object or any other CTI object.
parameters.limit	number	Optional	A single integer value that indicates the maximum number of objects that are received in a single response.
parameters.next	string	Optional	Next page number.
parameters.match[id]	string	Optional	The identifier of the object(s) that are being requested. When searching for a STIX Object, this is a STIX ID. More than one value can be specified. Values must be comma(,) seperated.
parameters.match[spec_version]	string	Optional	The specification version(s) of the STIX object that are being requested. More than one value can be specified. Values must be comma(,) seperated.
parameters.match[type]	string	Optional	The type of the object(s) that are being requested. More than one value can be specified. Values must be comma(,) seperated.
parameters.match[version]	string	Optional	The version(s) of the object(s) that are being requested from either an object or manifest task. More than one value can be specified. Values must be comma(,) seperated.

Input Example

{"headers":{},"path_parameters":{"collection_id":"string"},"parameters":{"added_after":"string","limit":123,"next":"string","match[id]":"string","match[spec_version]":"string","match[type]":"string","match[version]":"string"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":206,"response_headers":{"Date":"Fri, 14 Jul 2023 07:01:29 GMT","Content-Type":"application/taxii+json;version=2.1","Content-Length":"810","Connection":"keep-alive","Allow":"GET, HEAD, OPTIONS","Content-Security-Policy":"img-src https: data: blob:;","Referrer-Policy":"same-origin","Server":"gunicorn","Strict-Transport-Security":"max-age=315360000; includeSubDomains; preload","X-Content-Type-Options":"nosniff, nosniff","X-Frame-Options":"DENY, DENY","X-Krakend":"Version undefined","...

TAXII 2.1 Get Object Versions

Get a list of object versions from a collection.

Endpoint

URL: /collections/{{collection_id}}/objects/{{object_id}}/versions/

Method: GET

Input

Argument Name	Type	Required	Description
headers	object	Optional	HTTP headers for the request
path_parameters.collection_id	string	Required	Parameters for the TAXII 2.1 Get Object Versions action
path_parameters.object_id	string	Required	Parameters for the TAXII 2.1 Get Object Versions action
parameters.added_after	string	Optional	A single timestamp that filters objects to only include those objects added after the specified timestamp. The added_after parameter is not in any way related to dates or times in a STIX object or any other CTI object.
parameters.limit	number	Optional	A single integer value that indicates the maximum number of objects that are received in a single response.
parameters.next	string	Optional	Next page number.
parameters.match[spec_version]	string	Optional	The specification version(s) of the STIX object that are being requested. More than one value can be specified. Values must be comma(,) seperated.

Input Example

{"headers":{},"path_parameters":{"collection_id":"string","object_id":"string"},"parameters":{"added_after":"string","limit":123,"next":"string","match[spec_version]":"string"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
spec_version	string	Output field: spec_version
objects	array	Output field: objects

Output Example

{"status_code":200,"response_headers":{"Date":"Fri, 14 Jul 2023 06:52:28 GMT","Content-Type":"application/taxii+json;version=2.1","Content-Length":"268","Connection":"keep-alive","Allow":"GET, HEAD, OPTIONS","Content-Security-Policy":"img-src https: data: blob:;","Referrer-Policy":"same-origin","Server":"gunicorn","Strict-Transport-Security":"max-age=315360000; includeSubDomains; preload","X-Content-Type-Options":"nosniff, nosniff","X-Frame-Options":"DENY, DENY","X-Krakend":"Version undefined","...

TAXII 2.1 Get Objects

Get Objects of a Collection from a TAXII 2.1 server.

Endpoint

URL: /collections/{{collection_id}}/objects/

Method: GET

Input

Argument Name	Type	Required	Description
headers	object	Optional	HTTP headers for the request
path_parameters.collection_id	string	Required	Parameters for the TAXII 2.1 Get Objects action
parameters.added_after	string	Optional	A single timestamp that filters objects to only include those objects added after the specified timestamp. The added_after parameter is not in any way related to dates or times in a STIX object or any other CTI object.
parameters.limit	number	Optional	A single integer value that indicates the maximum number of objects that are received in a single response.
parameters.next	string	Optional	Next page number.
parameters.match[id]	string	Optional	The identifier of the object(s) that are being requested. When searching for a STIX Object, this is a STIX ID. More than one value can be specified. Values must be comma(,) seperated.
parameters.match[spec_version]	string	Optional	The specification version(s) of the STIX object that are being requested. More than one value can be specified. Values must be comma(,) seperated.
parameters.match[type]	string	Optional	The type of the object(s) that are being requested. More than one value can be specified. Values must be comma(,) seperated.
parameters.match[version]	string	Optional	The version(s) of the object(s) that are being requested from either an object or manifest task. More than one value can be specified. Values must be comma(,) seperated.

Input Example

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
objects	array	Output field: objects
more	boolean	Output field: more
next	string	Output field: next

Output Example

{"status_code":206,"response_headers":{"Date":"Thu, 13 Jul 2023 17:27:40 GMT","Content-Type":"application/taxii+json;version=2.1","Content-Length":"4170","Connection":"keep-alive","Allow":"GET, POST, HEAD, OPTIONS","Content-Security-Policy":"img-src https: data: blob:;","Referrer-Policy":"same-origin","Server":"gunicorn","Strict-Transport-Security":"max-age=315360000; includeSubDomains; preload","Vary":"Accept","X-Content-Type-Options":"nosniff, nosniff","X-Frame-Options":"DENY, DENY","X-Krakend...

TAXII 2.1 Server Discovery

Discover Server for TAXII 2.1

Endpoint

URL: /taxii2/

Method: GET

Input

Argument Name	Type	Required	Description
headers	object	Optional	HTTP headers for the request

Input Example

{"headers":{}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
title	string	Output field: title
description	string	Output field: description
contact	string	Output field: contact
default	string	Output field: default
api_roots	array	Output field: api_roots

Output Example

{"status_code":200,"response_headers":{"Date":"Thu, 13 Jul 2023 15:49:09 GMT","Content-Type":"application/taxii+json;version=2.1","Content-Length":"300","Connection":"keep-alive","Allow":"GET, HEAD, OPTIONS","Content-Security-Policy":"img-src https: data: blob:;","Referrer-Policy":"same-origin","Server":"gunicorn","Strict-Transport-Security":"max-age=315360000; includeSubDomains; preload","X-Content-Type-Options":"nosniff, nosniff","X-Frame-Options":"DENY, DENY","X-Krakend":"Version undefined","...

Response Headers

Header	Description	Example
Allow	HTTP response header: Allow	GET, HEAD, OPTIONS
Connection	HTTP response header: Connection	close
Content-Length	The length of the response body in bytes	298
Content-Range	HTTP response header: Content-Range	90-110/54704
Content-Security-Policy	HTTP response header: Content-Security-Policy	img-src https: data: blob:;
Content-Type	The media type of the resource	application/taxii+json;version=2.1
Date	The date and time at which the message was originated	Thu, 13 Jul 2023 17:27:40 GMT
Referrer-Policy	HTTP response header: Referrer-Policy	same-origin
Server	Information about the software used by the origin server	gunicorn
Strict-Transport-Security	HTTP response header: Strict-Transport-Security	max-age=315360000; includeSubDomains; preload
Vary	HTTP response header: Vary	Accept
X-Content-Type-Options	HTTP response header: X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	HTTP response header: X-Frame-Options	DENY, DENY
X-Krakend	HTTP response header: X-Krakend	Version undefined
X-Krakend-Completed	HTTP response header: X-Krakend-Completed	false
X-Taxii-Date-Added-First	HTTP response header: X-Taxii-Date-Added-First	2021-04-14T13:09:59.353000Z
X-Taxii-Date-Added-Last	HTTP response header: X-Taxii-Date-Added-Last	2022-02-09T14:16:38.556000Z
X-Xss-Protection	HTTP response header: X-Xss-Protection	1; mode=block