TAXII 2.1 Feed

Ingest STIX 2.1 cyber threat intelligence from any TAXII 2.1 server (e.g. CISA AIS, AlienVault OTX, MITRE ATT&CK, OpenCTI, Anomali, MISP). Reference objects (vulnerabilities, ATT&CK techniques, indicators, mitigations) become canonical graph entities; intelligence reports become report-type insights that reference those entities and can drive auto-hunts. Polling is incremental (added_after) with server-side type filtering.

Category	Threat intelligence
Direction	Query source
Sign-in	No Authentication, Basic Auth, Bearer Token
Query languages	—
Website	https://oasis-open.github.io/cti-documentation/

Before you start

Huntbase can sign in to TAXII 2.1 Feed with any of these methods: Basic Auth, Bearer Token. Pick one, create the credential in TAXII 2.1 Feed, then keep it to hand for the Connect step.

Watch out for

• Access control is defined by each TAXII server or sharing community, not by the TAXII standard. Ask your feed provider for credentials. HTTP Basic is the scheme the standard suggests.
• TAXII 2.0 servers use the /taxii/ discovery URL instead of /taxii2/, and this feed expects TAXII 2.1.

For the vendor's own instructions, see TAXII 2.1 specification.

tip

Use a dedicated, read-only credential for Huntbase where the product allows it. Huntbase only needs to read.

Connect TAXII 2.1 Feed

1. Go to Connections and click New connection, or click New connection on the TAXII 2.1 Feed product page.
2. On Product, pick TAXII 2.1 Feed and choose the Owner.
3. On Details, give the connection a Name and, optionally, a Description.
4. On Connect, fill in the settings and credentials described below.
5. On Verify, review the summary and click Create & check.

For everything else on the setup page — saving a draft, I'll do this later, and what each check result means — see Connections.

Settings

Where your TAXII 2.1 Feed lives:

Field	Required	Notes
TAXII Server URL	Yes	The server's discovery URL, which ends in /taxii2/ in TAXII 2.1, such as https://example.com/taxii2/. Your feed provider publishes this URL.
Collection ID	Yes	The ID of the collection to poll. The server lists its collections at {api-root}/collections/.
API Root URL	No	Optional. The API Root that holds the collection, such as https://example.com/api1/. Set it when you already know it, or when the server doesn't offer discovery.
Auth Type	Yes	Must match the method you choose, none, basic or bearer. One of none, basic, bearer. Defaults to none.
STIX Types Filter	No	Defaults to indicator,report,vulnerability,attack-pattern.
Page Size	No	Defaults to 100.

Credentials

Choose a Method, enter a Credential label (for example Production), then fill in the fields for that method.

No Authentication

No fields — choose this method to connect without credentials.

Basic Auth

Field	Required	Notes
Username	Yes	Secret — not shown again after you save it.
Password	Yes	Secret — not shown again after you save it.

Bearer Token

Field	Required	Notes
Bearer Token	Yes	Secret — not shown again after you save it.

Query it

TAXII 2.1 Feed doesn't add a query language of its own. Ask Scout about it, or query what it brings in with the languages in Query languages.

Next steps

• Connections — health, credentials and settings after you connect
• Query languages — syntax, parameters and time ranges
• Chatting with Scout — ask questions without writing a query
• All integrations — the rest of the catalog