implementing-taxii-server-with-opentaxii

name	implementing-taxii-server-with-opentaxii
description	Deploy and configure a TAXII 2.1 server (Medallion) with Docker, publish and consume STIX 2.1 bundles across collections, and integrate the feed with SIEM/SOAR platforms for automated indicator exchange between organizations. Use when standing up a TAXII server to share threat intel, configuring collections for CTI feeds, or automating STIX indicator ingestion into a SIEM/SOAR.
domain	cybersecurity
subdomain	threat-intelligence
tags	["taxii","stix","opentaxii","threat-sharing","cti","indicator-exchange","taxii-server","automation"]
version	1.0
author	mahipal
license	Apache-2.0
nist_csf	["ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02"]
mitre_attack	["T1591","T1592","T1593","T1589"]

Implementing TAXII Server with OpenTAXII

Overview

TAXII (Trusted Automated eXchange of Intelligence Information) is an OASIS standard protocol for exchanging cyber threat intelligence over HTTPS. OpenTAXII is an open-source TAXII server implementation by EclecticIQ that supports TAXII 1.x, while the OASIS cti-taxii-server provides a TAXII 2.1 reference implementation. This skill covers deploying a TAXII server, configuring collections for threat intelligence feeds, publishing STIX 2.1 bundles, and integrating with SIEM/SOAR platforms for automated indicator ingestion.

When to Use

• When deploying or configuring implementing taxii server with opentaxii capabilities in your environment
• When establishing security controls aligned to compliance requirements
• When building or improving security architecture for this domain
• When conducting security assessments that require this implementation

Prerequisites

• Python 3.9+ with medallion, stix2, taxii2-client, opentaxii, cabby libraries
• Docker and Docker Compose for containerized deployment
• Understanding of STIX 2.1 objects (Indicator, Malware, Attack Pattern, Relationship)
• Familiarity with REST APIs and HTTPS configuration
• TLS certificates for production deployment

Key Concepts

TAXII 2.1 Architecture

TAXII 2.1 defines three services: Discovery (find available API roots), API Root (entry point for collections), and Collections (repositories of CTI objects). Collections support two access models: the Collection endpoint allows consumers to poll for objects, and the Status endpoint tracks the result of add operations. TAXII uses HTTP content negotiation with application/taxii+json;version=2.1.

Sharing Models

TAXII supports hub-and-spoke (central server distributes to consumers), peer-to-peer (bidirectional sharing between partners), and source-subscriber (producer publishes, consumers subscribe) models. Each collection can have read-only, write-only, or read-write access controls.

STIX 2.1 Content

TAXII transports STIX 2.1 bundles containing Structured Threat Information objects: Indicators (detection patterns), Observed Data, Malware, Attack Patterns, Threat Actors, Intrusion Sets, Campaigns, Relationships, and Sightings. Each object has a unique STIX ID, creation/modification timestamps, and optional TLP marking definitions.

Workflow

Step 1: Deploy TAXII 2.1 Server with Medallion

# Install medallion (OASIS reference implementation)



 json

config = {
    : {
        : ,
        : 
    },
    : {
        : ,
        : ,
        : 
    },
    : {
        : 
    }
}


taxii_data = {
    : {
        : ,
        : ,
        : ,
        : ,
        : []
    },
    : {
        : {
            : ,
            : ,
            : [],
            : ,
            : {
                : {
                    : ,
                    : ,
                    : ,
                    : ,
                    : ,
                    : []
                },
                : {
                    : ,
                    : ,
                    : ,
                    : ,
                    : ,
                    : []
                },
                : {
                    : ,
                    : ,
                    : ,
                    : ,
                    : ,
                    : []
                }
            }
        }
    }
}

 (, )  f:
    json.dump(config, f, indent=)
 (, )  f:
    json.dump(taxii_data, f, indent=)
()