processing-stix-taxii-feeds

Processes STIX 2.1 threat intelligence bundles delivered via TAXII 2.1 servers, normalizing objects into platform-native schemas and routing them to appropriate consuming systems. Use when onboarding new TAXII collection endpoints, automating bi-directional intelligence sharing with ISACs, or building pipeline validation for malformed STIX bundles. Activates for requests involving OASIS STIX, TAXII server configuration, MISP TAXII, or Cortex XSOAR feed integrations.

Jump to install

Repository: xalgord/xalgorix
Last source activity: June 6, 2026 at 16:41
Detected SKILL.md language: English
Stars: 813
Forks: 146

Install options

The review-first prompt is selected by default. You can switch to a direct command or download a local copy.

Review the source files

Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.

Back to search Back to installation

name	processing-stix-taxii-feeds
description	Processes STIX 2.1 threat intelligence bundles delivered via TAXII 2.1 servers, normalizing objects into platform-native schemas and routing them to appropriate consuming systems. Use when onboarding new TAXII collection endpoints, automating bi-directional intelligence sharing with ISACs, or building pipeline validation for malformed STIX bundles. Activates for requests involving OASIS STIX, TAXII server configuration, MISP TAXII, or Cortex XSOAR feed integrations.
domain	cybersecurity
subdomain	threat-intelligence
tags	["STIX-2.1","TAXII-2.1","OASIS","MISP","CTI","IOC","threat-intelligence","NIST-SP-800-150"]
version	1.0.0
author	mahipal
license	Apache-2.0
nist_csf	["ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02"]

Processing STIX/TAXII Feeds

When to Use

Use this skill when:

Onboarding a new TAXII 2.1 collection from a government feed (CISA AIS, FS-ISAC) or commercial provider
Validating that ingested STIX bundles conform to the OASIS STIX 2.1 specification before import
Building automated pipelines that parse STIX relationship objects to reconstruct campaign context

Do not use this skill for proprietary vendor feed formats (Recorded Future JSON, CrowdStrike IOC lists) that require vendor-specific parsers rather than STIX processing.

Detection Gaps & Validation

Confidence is optional and unscaled: STIX 2.1 confidence (0-100) is frequently absent, and producers map it differently (some use Admiralty/None-Low-Med-High bands, some omit it). Do not treat missing/low confidence as "ignore" or a high value as "block" - normalize each feed's scale on ingest and default missing values conservatively rather than to 100.
Dedup and correlation gaps: the same indicator arrives from CISA AIS, an ISAC, and a commercial feed with different IDs and markings; without dedup by pattern value you inflate counts and may block on a single low-quality source. Key on the observable, not the STIX id.
Silent data loss: missing pagination (next/as_pages) and clock skew on added_after drop objects at interval boundaries - use UTC with a 5-minute overlap and reconcile object counts per poll to detect gaps.
Expired/revoked indicators: honor valid_until and revoked: true - pipelines that ingest the pattern but ignore these fields keep blocking on retired infrastructure. Filter both before routing to SIEM/firewall.
How to confirm a bundle is usable: check spec_version (2.0 vs 2.1 schemas differ), confirm required indicator fields and pattern syntax parse, and resolve relationship refs (source_ref/target_ref) actually exist in the bundle before reconstructing campaign context.

Prerequisites

Python 3.9+ with stix2 library (pip install stix2) and taxii2-client library
Network access to TAXII 2.1 server endpoint with valid credentials
Target TIP or SIEM with import API (MISP, OpenCTI, or Splunk ES)

Workflow

Step 1: Discover TAXII Server Collections

 taxii2client.v21  Server, as_pages

server = Server(,
                user=, password=)
api_root = server.api_roots[]
 collection  api_root.collections:
    (collection., collection.title, collection.can_read)

from taxii2client.v21 import Collection
from datetime import datetime, timedelta, timezone

collection = Collection(
    "https://cti.example.com/taxii/api1/collections/<id>/objects/",
    user="apiuser", password="apikey")

# Fetch only objects added in the last 24 hours
added_after = datetime.now(timezone.utc) - timedelta(hours=24)
for bundle_page in as_pages(collection.get_objects,
                             added_after=added_after, per_request=100):
    process_bundle(bundle_page)

import stix2

def process_bundle(bundle_dict):
    bundle = stix2.parse(bundle_dict, allow_custom=True)
    for obj in bundle.objects:
        if obj.type == "indicator":
            validate_indicator(obj)
        elif obj.type == "threat-actor":
            upsert_threat_actor(obj)
        elif obj.type == "relationship":
            link_objects(obj)

def validate_indicator(indicator):
    required = ["id", "type", "spec_version", "created",
                "modified", "pattern", "pattern_type", "valid_from"]
    for field in required:
        if not hasattr(indicator, field):
            raise ValueError(f"Missing required field: {field}")
    # Check confidence range
    if hasattr(indicator, "confidence"):
        assert 0 <= indicator.confidence <= 100

for marking in obj.get("object_marking_refs", []):
    if "tlp-red" in marking:
        route_to_restricted_platform_only(obj)

# Add validated local intelligence back to shared collection
new_indicator = stix2.Indicator(
    name="Malicious C2 Domain",
    pattern="[domain-name:value = 'evil-c2.example.com']",
    pattern_type="stix",
    valid_from="2025-01-15T00:00:00Z",
    confidence=80,
    labels=["malicious-activity"],
    object_marking_refs=["marking-definition--34098fce-860f-479c-ae..."]  # TLP:GREEN
)
collection.add_objects(stix2.Bundle(new_indicator))

Term	Definition
STIX Bundle	Top-level STIX container object (type: "bundle") holding any number of STIX Domain Objects (SDOs) and STIX Relationship Objects (SROs)
SDO	STIX Domain Object — core intelligence types: indicator, threat-actor, malware, campaign, attack-pattern, course-of-action
SRO	STIX Relationship Object — links two SDOs with a labeled relationship (e.g., "uses", "attributed-to", "indicates")
Pattern Language	STIX pattern syntax for indicator conditions: `[network-traffic:dst_port = 443 AND ipv4-addr:value = '10.0.0.1']`
Marking Definition	STIX object encoding TLP or statement restrictions on intelligence sharing
added_after	TAXII 2.1 filter parameter (RFC 3339 timestamp) for incremental polling of new objects