New App: ctis-taxii

[bliew-splunk]

Name of the app ctis-taxii

(I have opted for hyphenating this app name to make it more readable. CTIS offer other protocols, so I wanted to be as specific as possible)

The name of app your are contributing. Please ensure the app name follows our naming convention.

Integration The technology that your app integrates with. This app will integrate with the Australian ASD's CTIS program which exposes a TAXII v2.1 REST server to participating agencies. This app is intended to provide similar functionality to the integration with MS Sentinel: https://www.cyber.gov.au/about-us/view-all-content/news-and-media/join-the-cyber-threat-intelligence-sharing-service-through-sentinel

References:

• https://splunk.atlassian.net/browse/FDSE-2250
• https://www.oasis-open.org/standard/taxii-version-2-1/
• https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/gateway-hardening/gateway-security-guidance-package-executive-guidance

About The app will provide actions to:

• generate Indicator STIX JSON from SOAR artifacts or indicators
• submit Indicators of Concern (IOC) to the TAXII server
• potentially use on-poll to schedule submission in batches

[alexa-phantom]

Thanks @bliew-splunk https://github.com/splunk-soar-connectors/ctis-taxii If we are all set, please close out the issue. Thanks

[bliew-splunk]

Thanks @alexa-phantom