TAXII server implementation in Python from EclecticIQ.
OpenTAXII is a robust Python implementation of TAXII Services that delivers rich feature set and friendly pythonic API built on top of well designed application.
OpenTAXII is guaranteed to be compatible with Cabby, TAXII client library.
Source | Documentation | Information | Download
We have made the decision to consider this project feature-complete. It means we still maintain it, however we focus only on bug fixes. Still, we’re very open to external contributions - if you know how to fix an issue and you can open a PR, we will be very grateful.
See the documentation.
OpenTAXII can also be run using docker. This guide assumes that you have access to a local or remote docker server, and won't go into the setup of docker.
To get a default (development) instance using docker
bash
$ docker run -d -p 9000:9000 eclecticiq/opentaxii
To have the instance preloaded with example data, see the documentation on docker volumes.
NOTE: OpenTAXII is now accessible through port 9000, with data stored locally in a SQLite databases optionally using services/collections/accounts defined in data-configuration.yml
More documentation on running OpenTAXII in a container is found in the OpenTAXII Docker Documentation.
You are encouraged to provide feedback by commenting on open issues or sending us email at opentaxii@eclecticiq.com
I would like to support OpenTAXII by implementing Uffizzi preview environments. Disclaimer: I work on Uffizzi.
Uffizzi is a Open Source full stack previews engine and our platform is available completely free for OpenTAXII (and all open source projects). This will provide maintainers with preview environments of every PR in the cloud, which enables faster iterations and reduces time to merge. You can see the open source repos which are currently using Uffizzi over here
Uffizzi is purpose-built for the task of previewing PRs and it integrates with your workflow to deploy preview environments in the background without any manual steps for maintainers or contributors.
We can go ahead and create an Initial PoC for you right away if you think there is value in this proposal.
Multiple taxii2 endpoints (pretty much anything that prints an id) cause an exception when trying to convert an object that contains UUID to json. This is a minimal fix that handles the UUID encoding by converting to a string first on json conversion.
There are a couple fields used for the taxii2 implementation that aren't described in the configurations docs, making setup a little harder than it should be. There are also a couple fields that are required (otherwise the server throws a 500 error) that aren't described as such.
While I was at it I figured rather than making setting a value for public_discovery required I'd just set it to a default of False. Right now discovery doesn't work at all (throws an error) unless the user explicitly sets an option, so False seemed like a safe default.
Hello, I am facing an issue to configure opentaxii to use taxii2. Below my configuration file:
default.yml `---
domain: "myserver.com:9000"
support_basic_auth: yes return_server_error_details: no
auth_api: class: opentaxii.auth.sqldb.SQLDatabaseAPI parameters: db_connection: sqlite:////tmp/auth.db create_tables: yes secret: SECRET-STRING-NEEDS-TO-BE-CHANGED token_ttl_secs: 3600
taxii1:
taxii2: persistence_api: class: opentaxii.persistence.sqldb.SQLDatabaseAPI parameters: db_connection: sqlite:////tmp/data.db create_tables: yes
logging: opentaxii: info root: info `
data-configuration.yml (version 1 tested) `apiroots: - id: test_api_root default: true title: Test API Root description: Main API Root is_public: true
collections: - id: collection api_root_id: test_api_root title: Main Collection description: Main collection Information is_public: true is_public_write: true
accounts: - username: test password: test permissions: collection-a: modify - username: admin password: admin is_admin: yes `
*data-configuration.yml* (version 2 tested)
`---
domain: myserver.com:9000
services: - id: inbox type: inbox address: /services/inbox description: Inbox Service destination_collection_required: yes accept_all_content: yes authentication_required: yes supported_content: - urn:stix.mitre.org:json:2.1 protocol_bindings: - urn:taxii.mitre.org:protocol:http:1.0
- id: discovery
type: discovery
address: /services/discovery
description: Discovery Service
advertised_services:
- inbox
- discovery
- collection_management
- poll
protocol_bindings:
- urn:taxii.mitre.org:protocol:http:1.0
- id: collection_management
type: collection_management
address: /services/collection-management
description: Collection Management Service
protocol_bindings:
- urn:taxii.mitre.org:protocol:http:1.0
- id: poll
type: poll
address: /services/poll
description: Poll Service
subscription_required: no
max_result_count: 100
max_result_size: 10
authentication_required: yes
protocol_bindings:
- urn:taxii.mitre.org:protocol:http:1.0
collections: - name: test available: true accept_all_content: true supported_content: - urn:stix.mitre.org:json:2.1 service_ids: - inbox - collection_management - poll
accounts: - username: test password: test permissions: test: modify `
With both data-configuration.yml the command:
opentaxii-sync-data opentaxii/data-configuration.yml
do not work, reporting the error:
AttributeError: 'NoneType' object has no attribute 'persistence'
Starting server with gunicorn:
gunicorn opentaxii.http:app --bind myserver.com:9000 --config python:opentaxii.http
does not show any error.
Trying to query the server via taxii2-client I obtained the error below:
requests.exceptions.HTTPError: 500 Server Error: Internal Server Error for url: http://myserver.com:9000/taxii2/
Could you please help me to validate the configuration files e and how can I start and use the taxii2 on opentaxii?
I'm having trouble with the syntax in the data-configuration.yml file in order to implement an api-root on the system. I have the taxii2 server up and responding but cannot get an api-root to show in the system.
Please let me know what I'm doing wrong as I'm getting lost in the documentation.
Thank you,
data-config yml `apiroots: - id: test_api_root default: true title: Test API Root description: Main API Root is_public: true
collections: - id: collection-a api_root_id: test_api_root title: Main Collection description: Main collection Information is_public: true is_public_write: true
accounts: - username: test password: test permissions: collection-a: modify - username: admin password: admin is_admin: yes`
opentaxii yml `---
domain: "localhost:9000"
support_basic_auth: yes return_server_error_details: no
auth_api: class: opentaxii.auth.sqldb.SQLDatabaseAPI parameters: db_connection: sqlite:////tmp/auth.db create_tables: yes secret: SECRET-STRING-NEEDS-TO-BE-CHANGED token_ttl_secs: 3600
taxii2: allow_custom_properties: true contact: [email protected] description: TAXII2 Server max_content_length: 2048 persistence_api: class: opentaxii.persistence.sqldb.Taxii2SQLDatabaseAPI parameters: create_tables: true db_connection: sqlite:////tmp/data.db public_discovery: true title: Taxii2.1 Service
logging: opentaxii: info root: info`
{"service_id": "poll_a", "message_id": "771fc879-c5b2-470e-bcf0-6812bc9ee8d0", "message_type": "Poll_Request", "message_version": "urn:taxii.mitre.org:message:xml:1.1", "event": "Processing message", "logger": "opentaxii.taxii.services.poll.PollService", "level": "debug", "timestamp": "2022-10-07T11:43:59.266374Z"}
everything works normally, there is no problem, but when opentaxii is started with gunicorn, "Processing message" loops and this message comes up forever, is there any way to stop this process?
#238 <https://github.com/eclecticiq/OpenTAXII/pull/238>
thanks @zed-eiq <https://github.com/zed-eiq>
for the improvement).raise_unauthorized
for taxii2, this was missing and lead to 500 errors.allow_custom_properties
/taxii2/
public_discovery
option to taxii2 configOpenTAXII2PersistenceAPI
#217 <https://github.com/eclecticiq/OpenTAXII/issues/217>
thanks @azurekid <https://github.com/azurekid>
for the report)#210 <https://github.com/eclecticiq/OpenTAXII/issues/210>
thanks @rohits144 <https://github.com/rohits144>
for the report)delete_content_blocks
when using mysql on sqlalchemy 1.3@SanyaKapoor <https://github.com/SanyaKapoor>
_)Fix for #114 <https://github.com/eclecticiq/OpenTAXII/issues/114>
_: reintroduce opentaxii-create-account
CLI command.Fix for #153 <https://github.com/eclecticiq/OpenTAXII/issues/152>
_: check if user can modify a collection before advertising it over inbox service.acceptable_destination
key in status details instead of extended headersengine_parameters
to SQLDatabaseAPI
for those who want to customize SQLAlchemy engine parameters.lxml
for security reasons.opentaxii-sync-data
CLI command.opentaxii-sync-data
.libtaxii <https://github.com/TAXIIProject/libtaxii>
_ dependency upgraded to 1.1.111.@bjigmp <https://github.com/bjigmp>
, @chorsley <https://github.com/chorsley>
, @rjprins <https://github.com/rjprins>
_).xml_parser_supports_huge_tree
set to yes
or true
will disable security restrictions and force XML parser to support very deep trees and very long text content.#38 <https://github.com/EclecticIQ/OpenTAXII/issues/38>
_).opentaxii-delete-blocks
CLI command added (related to #45 <https://github.com/EclecticIQ/OpenTAXII/issues/45>
_).delete_content_blocks
method added <https://github.com/EclecticIQ/OpenTAXII/commit/dc6fddc27a98e8450c7e05e583b2bfb741f6e197#diff-6814849ac352b2b74132f8fa52e0ec4eR213>
_ to Persistence API.required <https://github.com/EclecticIQ/OpenTAXII/commit/dc6fddc27a98e8450c7e05e583b2bfb741f6e197#diff-ce3f7b939e5c540480ac655aef32c513R116>
_ to be unique in default SQL DB Auth API implementation.None
instead of InboxMessage
objectsetup.py
removed.anyconfig <https://pypi.python.org/pypi/anyconfig>
_ API.Issue #191 <https://github.com/TAXIIProject/libtaxii/issues/191>
_.get_domain
in Persistence API returns domain value configured for service_id
. If nothing returned, value set in configuration file will be used.#238 <https://github.com/eclecticiq/OpenTAXII/pull/238>
thanks @zed-eiq <https://github.com/zed-eiq>
for the improvement).raise_unauthorized
for taxii2, this was missing and lead to 500 errors.allow_custom_properties
/taxii2/
public_discovery
option to taxii2 configOpenTAXII2PersistenceAPI
#217 <https://github.com/eclecticiq/OpenTAXII/issues/217>
thanks @azurekid <https://github.com/azurekid>
for the report)#210 <https://github.com/eclecticiq/OpenTAXII/issues/210>
thanks @rohits144 <https://github.com/rohits144>
for the report)delete_content_blocks
when using mysql on sqlalchemy 1.3@SanyaKapoor <https://github.com/SanyaKapoor>
_)Fix for #114 <https://github.com/eclecticiq/OpenTAXII/issues/114>
_: reintroduce opentaxii-create-account
CLI command.Fix for #153 <https://github.com/eclecticiq/OpenTAXII/issues/152>
_: check if user can modify a collection before advertising it over inbox service.acceptable_destination
key in status details instead of extended headersengine_parameters
to SQLDatabaseAPI
for those who want to customize SQLAlchemy engine parameters.lxml
for security reasons.opentaxii-sync-data
CLI command.opentaxii-sync-data
.libtaxii <https://github.com/TAXIIProject/libtaxii>
_ dependency upgraded to 1.1.111.@bjigmp <https://github.com/bjigmp>
, @chorsley <https://github.com/chorsley>
, @rjprins <https://github.com/rjprins>
_).xml_parser_supports_huge_tree
set to yes
or true
will disable security restrictions and force XML parser to support very deep trees and very long text content.#38 <https://github.com/EclecticIQ/OpenTAXII/issues/38>
_).opentaxii-delete-blocks
CLI command added (related to #45 <https://github.com/EclecticIQ/OpenTAXII/issues/45>
_).delete_content_blocks
method added <https://github.com/EclecticIQ/OpenTAXII/commit/dc6fddc27a98e8450c7e05e583b2bfb741f6e197#diff-6814849ac352b2b74132f8fa52e0ec4eR213>
_ to Persistence API.required <https://github.com/EclecticIQ/OpenTAXII/commit/dc6fddc27a98e8450c7e05e583b2bfb741f6e197#diff-ce3f7b939e5c540480ac655aef32c513R116>
_ to be unique in default SQL DB Auth API implementation.None
instead of InboxMessage
objectsetup.py
removed.anyconfig <https://pypi.python.org/pypi/anyconfig>
_ API.Issue #191 <https://github.com/TAXIIProject/libtaxii/issues/191>
_.get_domain
in Persistence API returns domain value configured for service_id
. If nothing returned, value set in configuration file will be used.raise_unauthorized
for taxii2, this was missing and lead to 500 errors.allow_custom_properties
/taxii2/
public_discovery
option to taxii2 configOpenTAXII2PersistenceAPI
#217 <https://github.com/eclecticiq/OpenTAXII/issues/217>
thanks @azurekid <https://github.com/azurekid>
for the report)#210 <https://github.com/eclecticiq/OpenTAXII/issues/210>
thanks @rohits144 <https://github.com/rohits144>
for the report)delete_content_blocks
when using mysql on sqlalchemy 1.3@SanyaKapoor <https://github.com/SanyaKapoor>
_)Fix for #114 <https://github.com/eclecticiq/OpenTAXII/issues/114>
_: reintroduce opentaxii-create-account
CLI command.Fix for #153 <https://github.com/eclecticiq/OpenTAXII/issues/152>
_: check if user can modify a collection before advertising it over inbox service.acceptable_destination
key in status details instead of extended headersengine_parameters
to SQLDatabaseAPI
for those who want to customize SQLAlchemy engine parameters.lxml
for security reasons.opentaxii-sync-data
CLI command.opentaxii-sync-data
.libtaxii <https://github.com/TAXIIProject/libtaxii>
_ dependency upgraded to 1.1.111.@bjigmp <https://github.com/bjigmp>
, @chorsley <https://github.com/chorsley>
, @rjprins <https://github.com/rjprins>
_).xml_parser_supports_huge_tree
set to yes
or true
will disable security restrictions and force XML parser to support very deep trees and very long text content.#38 <https://github.com/EclecticIQ/OpenTAXII/issues/38>
_).opentaxii-delete-blocks
CLI command added (related to #45 <https://github.com/EclecticIQ/OpenTAXII/issues/45>
_).delete_content_blocks
method added <https://github.com/EclecticIQ/OpenTAXII/commit/dc6fddc27a98e8450c7e05e583b2bfb741f6e197#diff-6814849ac352b2b74132f8fa52e0ec4eR213>
_ to Persistence API.required <https://github.com/EclecticIQ/OpenTAXII/commit/dc6fddc27a98e8450c7e05e583b2bfb741f6e197#diff-ce3f7b939e5c540480ac655aef32c513R116>
_ to be unique in default SQL DB Auth API implementation.None
instead of InboxMessage
objectsetup.py
removed.anyconfig <https://pypi.python.org/pypi/anyconfig>
_ API.Issue #191 <https://github.com/TAXIIProject/libtaxii/issues/191>
_.get_domain
in Persistence API returns domain value configured for service_id
. If nothing returned, value set in configuration file will be used.allow_custom_properties
/taxii2/
public_discovery
option to taxii2 configOpenTAXII2PersistenceAPI
#217 <https://github.com/eclecticiq/OpenTAXII/issues/217>
thanks @azurekid <https://github.com/azurekid>
for the report)#210 <https://github.com/eclecticiq/OpenTAXII/issues/210>
thanks @rohits144 <https://github.com/rohits144>
for the report)delete_content_blocks
when using mysql on sqlalchemy 1.3@SanyaKapoor <https://github.com/SanyaKapoor>
_)Fix for #114 <https://github.com/eclecticiq/OpenTAXII/issues/114>
_: reintroduce opentaxii-create-account
CLI command.Fix for #153 <https://github.com/eclecticiq/OpenTAXII/issues/152>
_: check if user can modify a collection before advertising it over inbox service.acceptable_destination
key in status details instead of extended headersengine_parameters
to SQLDatabaseAPI
for those who want to customize SQLAlchemy engine parameters.lxml
for security reasons.opentaxii-sync-data
CLI command.opentaxii-sync-data
.libtaxii <https://github.com/TAXIIProject/libtaxii>
_ dependency upgraded to 1.1.111.@bjigmp <https://github.com/bjigmp>
, @chorsley <https://github.com/chorsley>
, @rjprins <https://github.com/rjprins>
_).xml_parser_supports_huge_tree
set to yes
or true
will disable security restrictions and force XML parser to support very deep trees and very long text content.#38 <https://github.com/EclecticIQ/OpenTAXII/issues/38>
_).opentaxii-delete-blocks
CLI command added (related to #45 <https://github.com/EclecticIQ/OpenTAXII/issues/45>
_).delete_content_blocks
method added <https://github.com/EclecticIQ/OpenTAXII/commit/dc6fddc27a98e8450c7e05e583b2bfb741f6e197#diff-6814849ac352b2b74132f8fa52e0ec4eR213>
_ to Persistence API.required <https://github.com/EclecticIQ/OpenTAXII/commit/dc6fddc27a98e8450c7e05e583b2bfb741f6e197#diff-ce3f7b939e5c540480ac655aef32c513R116>
_ to be unique in default SQL DB Auth API implementation.None
instead of InboxMessage
objectsetup.py
removed.anyconfig <https://pypi.python.org/pypi/anyconfig>
_ API.Issue #191 <https://github.com/TAXIIProject/libtaxii/issues/191>
_.get_domain
in Persistence API returns domain value configured for service_id
. If nothing returned, value set in configuration file will be used./taxii2/
public_discovery
option to taxii2 configOpenTAXII2PersistenceAPI
#217 <https://github.com/eclecticiq/OpenTAXII/issues/217>
thanks @azurekid <https://github.com/azurekid>
for the report)#210 <https://github.com/eclecticiq/OpenTAXII/issues/210>
thanks @rohits144 <https://github.com/rohits144>
for the report)delete_content_blocks
when using mysql on sqlalchemy 1.3@SanyaKapoor <https://github.com/SanyaKapoor>
_)Fix for #114 <https://github.com/eclecticiq/OpenTAXII/issues/114>
_: reintroduce opentaxii-create-account
CLI command.Fix for #153 <https://github.com/eclecticiq/OpenTAXII/issues/152>
_: check if user can modify a collection before advertising it over inbox service.acceptable_destination
key in status details instead of extended headersengine_parameters
to SQLDatabaseAPI
for those who want to customize SQLAlchemy engine parameters.lxml
for security reasons.opentaxii-sync-data
CLI command.opentaxii-sync-data
.libtaxii <https://github.com/TAXIIProject/libtaxii>
_ dependency upgraded to 1.1.111.@bjigmp <https://github.com/bjigmp>
, @chorsley <https://github.com/chorsley>
, @rjprins <https://github.com/rjprins>
_).xml_parser_supports_huge_tree
set to yes
or true
will disable security restrictions and force XML parser to support very deep trees and very long text content.#38 <https://github.com/EclecticIQ/OpenTAXII/issues/38>
_).opentaxii-delete-blocks
CLI command added (related to #45 <https://github.com/EclecticIQ/OpenTAXII/issues/45>
_).delete_content_blocks
method added <https://github.com/EclecticIQ/OpenTAXII/commit/dc6fddc27a98e8450c7e05e583b2bfb741f6e197#diff-6814849ac352b2b74132f8fa52e0ec4eR213>
_ to Persistence API.required <https://github.com/EclecticIQ/OpenTAXII/commit/dc6fddc27a98e8450c7e05e583b2bfb741f6e197#diff-ce3f7b939e5c540480ac655aef32c513R116>
_ to be unique in default SQL DB Auth API implementation.None
instead of InboxMessage
objectsetup.py
removed.anyconfig <https://pypi.python.org/pypi/anyconfig>
_ API.Issue #191 <https://github.com/TAXIIProject/libtaxii/issues/191>
_.get_domain
in Persistence API returns domain value configured for service_id
. If nothing returned, value set in configuration file will be used./taxii2/
public_discovery
option to taxii2 configOpenTAXII2PersistenceAPI
#217 <https://github.com/eclecticiq/OpenTAXII/issues/217>
thanks @azurekid <https://github.com/azurekid>
for the report)#210 <https://github.com/eclecticiq/OpenTAXII/issues/210>
thanks @rohits144 <https://github.com/rohits144>
for the report)delete_content_blocks
when using mysql on sqlalchemy 1.3@SanyaKapoor <https://github.com/SanyaKapoor>
_)Fix for #114 <https://github.com/eclecticiq/OpenTAXII/issues/114>
_: reintroduce opentaxii-create-account
CLI command.Fix for #153 <https://github.com/eclecticiq/OpenTAXII/issues/152>
_: check if user can modify a collection before advertising it over inbox service.acceptable_destination
key in status details instead of extended headersengine_parameters
to SQLDatabaseAPI
for those who want to customize SQLAlchemy engine parameters.lxml
for security reasons.opentaxii-sync-data
CLI command.opentaxii-sync-data
.libtaxii <https://github.com/TAXIIProject/libtaxii>
_ dependency upgraded to 1.1.111.@bjigmp <https://github.com/bjigmp>
, @chorsley <https://github.com/chorsley>
, @rjprins <https://github.com/rjprins>
_).xml_parser_supports_huge_tree
set to yes
or true
will disable security restrictions and force XML parser to support very deep trees and very long text content.#38 <https://github.com/EclecticIQ/OpenTAXII/issues/38>
_).opentaxii-delete-blocks
CLI command added (related to #45 <https://github.com/EclecticIQ/OpenTAXII/issues/45>
_).delete_content_blocks
method added <https://github.com/EclecticIQ/OpenTAXII/commit/dc6fddc27a98e8450c7e05e583b2bfb741f6e197#diff-6814849ac352b2b74132f8fa52e0ec4eR213>
_ to Persistence API.required <https://github.com/EclecticIQ/OpenTAXII/commit/dc6fddc27a98e8450c7e05e583b2bfb741f6e197#diff-ce3f7b939e5c540480ac655aef32c513R116>
_ to be unique in default SQL DB Auth API implementation.None
instead of InboxMessage
objectsetup.py
removed.anyconfig <https://pypi.python.org/pypi/anyconfig>
_ API.Issue #191 <https://github.com/TAXIIProject/libtaxii/issues/191>
_.get_domain
in Persistence API returns domain value configured for service_id
. If nothing returned, value set in configuration file will be used.EclecticIQ is a global provider of threat intelligence, hunting and response technology and services.
GitHub Repositorytaxii stix cti python taxii-server threatintel threat-sharing cyber-threat-intelligence