feat(feed-taxii2): new generic TAXII 2.1 / STIX feed connector

Pulls STIX 2.x indicators from any TAXII 2.1 server, parses the STIX patterns into normalized IOCs {value,type} for TIM import. list-collections + fetch. Basic/bearer/none auth, stdlib-only. py_compile clean. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-07-12 22:43:17 +02:00
parent 4f94b59e17
commit c779c38dab
4 changed files with 358 additions and 0 deletions
@@ -0,0 +1,64 @@
+id: feed_taxii2
+name: TAXII 2 Feed
+version: 1.0.0
+description: "Generic TAXII 2.1 threat-intel feed connector — pull STIX 2.x indicators from any TAXII 2.1 server (OpenCTI, Anomali, MISP, CISA AIS, ...) and emit normalized IOCs (value + type) parsed from the STIX patterns, for import into the Threat Indicator Manager. Basic or bearer authentication; stdlib-only, no extra Python dependencies."
+changelog: "1.0.0 — Initial release: list collections, fetch indicators from a TAXII 2.1 collection."
+category: feed
+
+# Per-instance configuration. api_root_url is the TAXII 2.1 API root
+# (e.g. https://server/taxii2/api1). auth_type selects none/basic/bearer.
+config_schema:
+  properties:
+    api_root_url:
+      type: string
+      description: "TAXII 2.1 API root URL (e.g. https://server/taxii2/api1)"
+    collection_id:
+      type: string
+      description: "Default collection ID to fetch from"
+    auth_type:
+      type: string
+      description: "none, basic, or bearer (default basic)"
+      default: "basic"
+    username:
+      type: string
+      description: "Username (for basic auth)"
+    password:
+      type: string
+      description: "Password (basic) or token (bearer)"
+      x-soar-sensitive: true
+    insecure:
+      type: boolean
+      description: "Trust any TLS certificate (not secure)"
+      default: false
+  required:
+    - api_root_url
+
+commands:
+  - id: list_collections
+    name: feed-taxii2-list-collections
+    description: "List the collections available on the TAXII 2.1 API root."
+    risk: read
+    inputs_schema:
+      properties: {}
+      required: []
+    outputs_schema: { properties: {} }
+  - id: fetch_indicators
+    name: feed-taxii2-fetch-indicators
+    description: "Fetch STIX indicators from a collection and return normalized IOCs."
+    risk: read
+    inputs_schema:
+      properties:
+        collection_id: { type: string, description: "Collection ID (defaults to the configured one)" }
+        added_after: { type: string, description: "Only objects added after this timestamp (ISO-8601)" }
+        limit: { type: number, description: "Max objects to request (default 500)" }
+      required: []
+    outputs_schema: { properties: {} }
+
+  - id: test_connection
+    name: feed-taxii2-test-connection
+    description: "Verify the TAXII server and credentials (used by the Test button)."
+    risk: read
+    inputs_schema:
+      properties: {}
+      required: []
+    outputs_schema: { properties: {} }