id: feed_taxii2
name: TAXII 2 Feed
version: 1.0.0
description: "Generic TAXII 2.1 threat-intel feed connector — pull STIX 2.x indicators from any TAXII 2.1 server (OpenCTI, Anomali, MISP, CISA AIS, ...) and emit normalized IOCs (value + type) parsed from the STIX patterns, for import into the Threat Indicator Manager. Basic or bearer authentication; stdlib-only, no extra Python dependencies."
changelog: "1.0.0 — Initial release: list collections, fetch indicators from a TAXII 2.1 collection."
category: feed

# Per-instance configuration. api_root_url is the TAXII 2.1 API root
# (e.g. https://server/taxii2/api1). auth_type selects none/basic/bearer.
config_schema:
  properties:
    api_root_url:
      type: string
      description: "TAXII 2.1 API root URL (e.g. https://server/taxii2/api1)"
    collection_id:
      type: string
      description: "Default collection ID to fetch from"
    auth_type:
      type: string
      description: "none, basic, or bearer (default basic)"
      default: "basic"
    username:
      type: string
      description: "Username (for basic auth)"
    password:
      type: string
      description: "Password (basic) or token (bearer)"
      x-soar-sensitive: true
    insecure:
      type: boolean
      description: "Trust any TLS certificate (not secure)"
      default: false
  required:
    - api_root_url

commands:
  - id: list_collections
    name: feed-taxii2-list-collections
    description: "List the collections available on the TAXII 2.1 API root."
    risk: read
    inputs_schema:
      properties: {}
      required: []
    outputs_schema: { properties: {} }
  - id: fetch_indicators
    name: feed-taxii2-fetch-indicators
    description: "Fetch STIX indicators from a collection and return normalized IOCs."
    risk: read
    inputs_schema:
      properties:
        collection_id: { type: string, description: "Collection ID (defaults to the configured one)" }
        added_after: { type: string, description: "Only objects added after this timestamp (ISO-8601)" }
        limit: { type: number, description: "Max objects to request (default 500)" }
      required: []
    outputs_schema: { properties: {} }

  - id: test_connection
    name: feed-taxii2-test-connection
    description: "Verify the TAXII server and credentials (used by the Test button)."
    risk: read
    inputs_schema:
      properties: {}
      required: []
    outputs_schema: { properties: {} }