{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":45547,"path":"security-management/threat-intelligence-security-center/tisc-create-taxii-collection.md","title":"Create TAXII Collection","bundle":null,"doc_type":null,"release":"australia","body":"\n# Create TAXII Collection\n\nUse this section to learn how to configure and define TAXII collections for sharing intelligence.\n\n## Before you begin\n\nRole required: sn\\_sec\\_tisc.admin\n\n## Procedure\n\n1.  Navigate to **Workspaces** &gt; **Threat Intelligence Security Center** &gt; **Administration** &gt; **TAXII Outbound Server**.\n\n2.  Select **TAXII Collections**.\n\n3.  Select **New** to create a TAXII Collection.\n\n4.  On the form, fill in the fields.\n\n<table id=\"table_syl_ztc_mfc\"><thead><tr><th>\n\nField\n\n</th><th>\n\nDescription\n\n</th></tr></thead><tbody><tr><td>\n\nName\n\n</td><td>\n\nName of the TAXII collection.\n\n</td></tr><tr><td>\n\nDescription\n\n</td><td>\n\nDescription of the TAXII collection.\n\n</td></tr><tr><td>\n\nSpec Version\n\n</td><td>\n\nSpecifies the version of the TAXII used for data formatting and exchange.**Note:** The only supported spec version for data formatting is 2.1.\n\n</td></tr><tr><td>\n\nExpiry period \\(days\\)\n\n</td><td>\n\nSpecifies the number of days after which the records added to the TAXII Collection expires. **Note:** After expiration, the records will be marked as inactive and subsequently removed from the collection.\n\n</td></tr><tr><td>\n\nEnable Versioning\n\n</td><td>\n\nSelect this check box to enable versioning for the records being added to the TAXII collection.**Note:** When a record is added to a TAXII collection and if it differs from its previous version, the application will add the new version only if the versioning is enabled.\n\nIf the versioning is not enabled, the existing record will be overwritten with the updated data.\n\n</td></tr><tr><td>\n\nAccess to all TAXII API users\n\n</td><td>\n\nSpecifies access for TAXII users. When selected, all users assigned the TAXII Server API role will be granted permission to retrieve data from this collection.**Note:** When the **Access to all TAXII API users** field is not selected, only the users specified in this field will have access to the TAXII collection records.\n\n</td></tr><tr><td>\n\nRead Access\n\n</td><td>\n\nWhen the **Access to all TAXII API users** field is not selected, then only the users specified in this field will be able to access the TAXII collection records.\n\n</td></tr></tbody>\n</table>5.  To copy the discovery URL of the TAXII server, do the following:\n\n    1.  Select the information icon on the record to open **TAXII Server Configuration**.\n\n    2.  Select the copy icon next to the **Discovery URL** field.\n\n        The discovery URL is copied to your clipboard. Share this URL with TAXII clients to connect to your instance and retrieve the threat intelligence shared through the TAXII collection.\n\n6.  Select **Save**.\n\n7.  **System property to add records**\n\n    The system property for TAXII collections limits the number of records that can be added to a TAXII collection.\n\n    The following is the system property for the TAXII Collection configuration:\n\n<table id=\"table_rzw_ds3_4fc\"><thead><tr><th>\n\nName\n\n</th><th>\n\nDescription\n\n</th></tr></thead><tbody><tr><td>\n\nsn\\_sec\\_tisc.taxii\\_server\\_collection\\_record\\_limit\n\n</td><td>\n\nMaximum number of records that can be added to an outbound TAXII server collection.The default value is 10000.\n\n</td></tr></tbody>\n</table>8.  View the system property information for adding records to the TAXII collection.\n\n9.  Navigate to the **Flow Designer** &gt; **Flows**.\n\n    This navigation displays the template flow for adding TAXII Collections.\n\n10. Select the **Automatically add threat intelligence to a TAXII Collection** flow.\n\n11. Navigate to the **Flow Designer** &gt; **Actions**.\n\n12. **Adding records to the TAXII Collection**\n\n    Currently, the only method for adding records to the TAXII server collection is via an automated process. The following are the two actions that are provisioned in the base system:\n\n    1.  **Add Record to TAXII Server Collection**\n    2.  **Add Records to TAXII Server Collection**\n13. View the respective TAXII server collection action.\n\n\n**Parent Topic:**[Exploring TAXII Outbound Server](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/threat-intelligence-security-center/tisc-taxii-outbound-server.md)\n\n**Related topics**  \n\n\n[Automated Sharing of TAXII Collections]()\n\n[Viewing TAXII Collection Records]()\n\n[Automated Sharing of TAXII Collections](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/threat-intelligence-security-center/tisc-automated-share-taxii.md)\n\n[Configuring Outbound Intel Sharing Templates](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/threat-intelligence-security-center/tisc-intel-sharing-templates.md)\n\n"}}