Deploy and configure an OpenTAXII server to share and consume STIX-formatted cyber threat intelligence using the TAXII 2.1 protocol for automated indicator exchange between organizations.
Deploy and configure an OpenTAXII server to share and consume STIX-formatted cyber threat intelligence using the TAXII 2.1 protocol for automated indicator exchange between organizations.
TAXII (Trusted Automated eXchange of Intelligence Information) is an OASIS standard protocol for exchanging cyber threat intelligence over HTTPS. OpenTAXII is an open-source TAXII server implementation by EclecticIQ that supports TAXII 1.x, while the OASIS cti-taxii-server provides a TAXII 2.1 reference implementation. This skill covers deploying a TAXII server, configuring collections for threat intelligence feeds, publishing STIX 2.1 bundles, and integrating with SIEM/SOAR platforms for automated indicator ingestion.
When to Use
When deploying or configuring implementing taxii server with opentaxii capabilities in your environment
When establishing security controls aligned to compliance requirements
When building or improving security architecture for this domain
When conducting security assessments that require this implementation
Common Misconfigurations & Verification
Discovery/API-root URL mismatch: the discovery.default and api_roots URLs in the config must match the externally reachable HTTPS base, or clients discover endpoints they cannot reach. Verify with a real Server(...).api_roots call from outside the host.
Collection IDs not stable: reusing or regenerating a collection id orphans published objects and breaks consumer poll state. Pin UUIDs in config and never recycle them.
Permission flags wrong: a collection with can_write: false silently rejects publishes; can_read: false returns empty polls. Confirm read/write per collection against the intended sharing model (hub-and-spoke vs peer-to-peer).
Default credentials and volatile backend: the sample *_change_me passwords and MemoryBackend are not production-safe - data is lost on restart and auth is weak. Switch to a persistent backend and real TLS certs.
Verification: hit /taxii2/ for discovery, list collections with the correct read/write flags, publish a bundle and confirm the Status response success_count, then poll it back and validate the IOCs forward into the SIEM.
Prerequisites
Python 3.9+ with medallion, , , , libraries
stix2
taxii2-client
opentaxii
cabby
Docker and Docker Compose for containerized deployment
Understanding of STIX 2.1 objects (Indicator, Malware, Attack Pattern, Relationship)
Familiarity with REST APIs and HTTPS configuration
TLS certificates for production deployment
Key Concepts
TAXII 2.1 Architecture
TAXII 2.1 defines three services: Discovery (find available API roots), API Root (entry point for collections), and Collections (repositories of CTI objects). Collections support two access models: the Collection endpoint allows consumers to poll for objects, and the Status endpoint tracks the result of add operations. TAXII uses HTTP content negotiation with application/taxii+json;version=2.1.
Sharing Models
TAXII supports hub-and-spoke (central server distributes to consumers), peer-to-peer (bidirectional sharing between partners), and source-subscriber (producer publishes, consumers subscribe) models. Each collection can have read-only, write-only, or read-write access controls.
STIX 2.1 Content
TAXII transports STIX 2.1 bundles containing Structured Threat Information objects: Indicators (detection patterns), Observed Data, Malware, Attack Patterns, Threat Actors, Intrusion Sets, Campaigns, Relationships, and Sightings. Each object has a unique STIX ID, creation/modification timestamps, and optional TLP marking definitions.
