Create TAXII Collection

  • Release version: Australia
  • Updated March 12, 2026
  • 2 minutes to read

    • Use this section to learn how to configure and define TAXII collections for sharing intelligence.

    Before you begin

    Role required: sn_sec_tisc.admin

    Procedure

    1. Navigate to Workspaces > Threat Intelligence Security Center > Administration > TAXII Outbound Server.
    2. Select TAXII Collections.
    3. Select New to create a TAXII Collection.
    4. On the form, fill in the fields.
      Table 1. Create New Inbound Intelligence Profile
      Field Description
      Name Name of the TAXII collection.
      Description Description of the TAXII collection.
      Spec Version Specifies the version of the TAXII used for data formatting and exchange.
      Note:
      The only supported spec version for data formatting is 2.1.
      Expiry period (days) Specifies the number of days after which the records added to the TAXII Collection expires.
      Note:
      After expiration, the records will be marked as inactive and subsequently removed from the collection.
      Enable Versioning Select this check box to enable versioning for the records being added to the TAXII collection.
      Note:
      When a record is added to a TAXII collection and if it differs from its previous version, the application will add the new version only if the versioning is enabled.

      If the versioning is not enabled, the existing record will be overwritten with the updated data.
      Access to all TAXII API users Specifies access for TAXII users. When selected, all users assigned the TAXII Server API role will be granted permission to retrieve data from this collection.
      Note:
      When the Access to all TAXII API users field is not selected, only the users specified in this field will have access to the TAXII collection records.
      Read Access When the Access to all TAXII API users field is not selected, then only the users specified in this field will be able to access the TAXII collection records.
    5. Select Save.
    System property to add records

    The system property for TAXII collections limits the number of records that can be added to a TAXII collection.

    The following is the system property for the TAXII Collection configuration:

    Name Description
    sn_sec_tisc.taxii_server_collection_record_limit Maximum number of records that can be added to an outbound TAXII server collection.

    The default value is 10000.
    1. View the system property information for adding records to the TAXII collection.
    2. Navigate to the Flow Designer > Flows.
      This navigation displays the template flow for adding TAXII Collections.
    3. Select the Automatically add threat intelligence to a TAXII Collection flow.
    4. Navigate to the Flow Designer > Actions.
    Adding records to the TAXII Collection
    Currently, the only method for adding records to the TAXII server collection is via an automated process. The following are the two actions that are provisioned in the base system:
    1. Add Record to TAXII Server Collection
    2. Add Records to TAXII Server Collection
    1. View the respective TAXII server collection action.