Processing STIX/TAXII Feeds

When to Use

Use this skill when:

• Onboarding a new TAXII 2.1 collection from a government feed (CISA AIS, FS-ISAC) or commercial provider
• Validating that ingested STIX bundles conform to the OASIS STIX 2.1 specification before import
• Building automated pipelines that parse STIX relationship objects to reconstruct campaign context

Do not use this skill for proprietary vendor feed formats (Recorded Future JSON, CrowdStrike IOC lists) that require vendor-specific parsers rather than STIX processing.

Prerequisites

• Python 3.9+ with stix2 library (pip install stix2) and taxii2-client library
• Network access to TAXII 2.1 server endpoint with valid credentials
• Target TIP or SIEM with import API (MISP, OpenCTI, or Splunk ES)

Workflow

Step 1: Discover TAXII Server Collections