TAXII 2.1 Feeds and Server
Pull curated threat intelligence over TAXII 2.1, the open OASIS standard, in STIX 2.1 format. Point any compliant client at our collections, or self-host our server software. TAXII access runs on its own Enterprise licence, so talk to us about a trial.
- 2,500+Intelligence sources
- 20 minUpdate interval
- 5 minTo full integration
- 100%Made in Europe
What are TAXII 2.1 feeds and a TAXII server?
TAXII is the open standard protocol for exchanging cyber threat intelligence, and STIX is the format that describes it. Q-Feeds provides a TAXII 2.1 server with STIX 2.1 collections, so any TAXII-compatible client can pull our curated intelligence automatically.
Connect your SIEM, TIP, SOAR or firewall once, subscribe to the collections you need, and indicators of compromise flow in continuously, with no custom parsing and no vendor lock-in.
Because it is standards-based, the same feed works across your whole security stack, combining commercial, OSINT and governmental sources refreshed every 20 minutes.
TAXII highlights
TAXII/STIX 2.1 spec
Our server is fully compatible with the TAXII/STIX 2.1 specification. Older versions are not supported.
Different feeds
Feeds varying from APT and botnets to ransomware hashes and malicious URLs.
Self-host
Prefer to run your own TAXII server? Use our own developed TAXII server software.
Integrations
Easily integrate threat intelligence with platforms such as SIEM solutions.
How TAXII 2.1 works
TAXII 2.1 is a REST API defined by OASIS. A client discovers what a server offers, subscribes to a collection and then polls it for STIX 2.1 objects over HTTPS. These are the parts you will meet when you connect.
Discovery endpoint
A GET on /taxii2/ returns the server title, contact details and the API roots it publishes. It is the only URL you have to hand to a client.
API roots
An API root groups collections and declares which TAXII versions it speaks, how large a request may be and how many objects it will return per page.
Collections
Every collection is an addressable set of intelligence with its own id, description and read or write permissions, so you subscribe per category instead of taking everything.
Objects and filtering
Reading a collection's objects endpoint returns a TAXII envelope of STIX 2.1 objects. Use the added_after filter to fetch only what changed since your last poll, then page through the results with limit and next.
Authentication
Our server accepts HTTP basic authentication and bearer tokens over TLS, which is what most SIEM and TIP connectors expect out of the box.
Versions we support
TAXII 2.1 and STIX 2.1 became OASIS Standards in June 2021. We implement 2.1 only, so TAXII 1.x and 2.0 clients cannot connect.
TAXII 2.1 Feeds
Our threat intelligence is also available via our TAXII server.
- Fully compatible with the 2.1 specification
- Basic and token authentication
- Multiple threat intelligence categories
TAXII 2.1 Server Software
Q-Feeds has developed its own TAXII server software, available for you to self-host.
- Built to be compatible with the TAXII 2.1 specification
- Convenient management portal
- Easy-to-use STIX watch-folder function
Frequently asked questions about TAXII and STIX
What are TAXII and STIX?
STIX is a standard format for describing cyber threat intelligence, and TAXII is the protocol used to transport it. Together they let security tools exchange indicators in a consistent, vendor-neutral way.
Which clients can connect to the Q-Feeds TAXII server?
Any TAXII 2.1-compatible client can connect, including OpenCTI, MISP, EclecticIQ, Anomali ThreatStream, ThreatConnect, SIEMs such as Microsoft Sentinel and Splunk, SOAR tools and compatible firewalls.
What is in the collections?
Collections group curated indicators such as APT infrastructure, botnets, ransomware hashes and malicious URLs, so you subscribe only to what is relevant.
Can I self-host a TAXII server?
Yes. Q-Feeds offers its own TAXII 2.1 server software with a management portal and a STIX watch-folder function, so you can run your own server.
How often is the intelligence updated?
The intelligence is refreshed every 20 minutes, so every client pulling from the TAXII server receives current indicators.
Are there free TAXII feeds?
Not from us. TAXII access runs on a separate Enterprise licence because of the extra context and infrastructure behind it. If you want to judge the intelligence itself at no cost first, the free Community edition gives you the same curated indicators as ordinary feeds. Public open-source TAXII feeds do exist, but they are usually single-source and irregularly maintained.
Is there an open source TAXII server?
TAXII is an open standard, so open source implementations exist, including the OASIS reference server and client. Our server software is not open source, but it follows the same specification, so any compliant client works with it and you are never locked in.
Where is the official OASIS TAXII 2.1 specification?
The specification is published free of charge by the OASIS Cyber Threat Intelligence Technical Committee. You can read the TAXII 2.1 specification and the STIX 2.1 specification on the OASIS site.
Put your threat feeds to work
Evaluate our intelligence today!
Simplify your security operations, start your free Q-Feeds trial and experience the difference.
Activate free access