A comprehensive TAXII 2.x server designed for testing XSIAM and XSOAR Threat Intelligence Management (TIM). MockTAXII offers a complete STIX/TAXII 2.1 implementation, generating realistic indicators, campaigns and reports, all with rich, interlinked relationships.
View project on GitHubMaintained by GoCortex, an independent publisher of open-source tooling for the Palo Alto Networks Cortex platform.
A Flask-based TAXII 2.x server for testing TAXII 2.1 clients. MockTAXII was built against Threat Intelligence Management (TIM) on the Palo Alto Networks Cortex Platform - Cortex XSIAM and Cortex XSOAR - and implements the TAXII 2.1 integration endpoints a TIM feed exercises, serving STIX 2.1 objects generated from a PostgreSQL database at enterprise scale. It is a bounded synthetic test feed for demonstration and integration testing, not a claim of full TAXII 2.1 specification coverage - see Feed and pagination scope.
MockTAXII enables security professionals to test threat intelligence integrations without access to production threat feeds. It provides a bounded synthetic test server for the TAXII 2.1 integration surface and generates STIX 2.1 objects from a PostgreSQL database populated with realistic threat data derived from authentic sources including Spamhaus DROP lists, CISA KEV catalogue, and the MITRE ATT&CK framework.
The server generates indicators across multiple threat categories:
The site is independently operated and is in no way endorsed or supported by Palo Alto Networks.