Skip to content
Exploring TAXII Outbound Server › Configuring Threat Intelligence External Sharing › Administer › Threat Intelligence Security Center › Security Operations
Release: Australia · Updated: 2026-03-12 · Official documentation · View source

Automated Sharing of TAXII Collections

Automated TAXII Collections automatically add intelligence records to TAXII Server Collections for seamless distribution to trusted external partners.

Before you begin

Role required:

  • System Administrator (view, create or edit)
  • sn_sec_tisc.admin (view)

About this task

The automated flow action adds the record provided in the inputs to TAXII server collections configured in the selected template. For more information, see Configuring Outbound Intel Sharing Templates.

Add record to TAXII Server Collection via automated process:

Procedure

  1. Navigate to All > Threat Intelligence Security Center > Administration.

  2. Select Automated Flows.

  3. Select Automatically add threat intelligence to a TAXII collection action link to view the respective rule details in the flow designer.

  4. View the flow designer action for the following triggers:

     Observable Created or Updated where (Type is IP address (V4), or Type is IP address (V6), or Type is Domain Name; and TISC Tags contains Add to: Sample Collection, and Reputation is Malicious, and Threat Score greater than or is 60)  Actions Select multiple

  5. Go to Actions

ActionDescription
Sharing Template[Outbound Intel Sharing]

Select the sharing template.Template with a usage mode of both Automated addition to TAXII Collections can be selected for Automated Sharing.

For more information see, Configuring Outbound Intel Sharing Templates.

Observable Record [Observable]Select the type of observable record to add records to TAXII server collections.
Indicator Record [Indicator]Select the type of indicators record to add records to TAXII server collections.
Object Record [Object]Select the type of objects record to add records to TAXII server collections.
Include Related RecordsSelect this check box to add the related records of the selected observables, including indicators and objects to TAXII server collections.
  1. Select Done.

What to do next

Activate the flow.

Parent Topic:Exploring TAXII Outbound Server

Related topics

Create TAXII Collection

Viewing TAXII Collection Records

Create TAXII Collection

Configuring Outbound Intel Sharing Controls

Configuring Outbound Intel Sharing Templates