TAXII 2.1 server
Discovery, an API root and nine shared collections, plus private ones for your own reports.
Data products
STIX/TAXII threat intelligence feeds
IP, domain, URL, and malware hash indicators in STIX 2.1, served over TAXII 2.1. Ingest with any TAXII client, plain curl, or your SIEM's native TAXII input — no proprietary connector required.
Evaluate a feed in my tool
Pro €99/month · Enterprise on quote · not in Free · TAXII polling does not use your request quota
Open-standard threat feeds · no vendor tools
- format
- STIX 2.1 · TAXII 2.1
- collections
- ip · domain · url · hash
- refresh
- nightly · full rebuild
GET/taxii/api-root/collections/
| Collection | Indicators |
|---|---|
| malicious-domainsMalicious Domains | 18 675 572 |
| malicious-ipsMalicious IP Addresses | 8 676 321 |
| malicious-urlsMalicious URLs | 1 353 431 |
| malicious-file-hashesMalicious File Hashes | 3 887 743 |
| malicious-subdomainsMalicious Subdomains | 5 843 786 |
| malware-iocsMalware IOCs | 27 974 981 |
| c2-indicatorsCommand-and-Control Indicators | 13 503 562 |
| ransomware-iocsRansomware IOCs | 6 784 |
| phishing-indicatorsPhishing Indicators | 9 607 512 |
9 collectionsSTIX 2.1 · TAXII 2.1counted 9 hr. ago
Capabilities
Signals for your investigation, with their context.
STIX 2.1 indicators
Each carries a pattern, confidence, labels and source references when available.
Nightly rebuild
Collections rebuild from 02:00 UTC. Poll once a day; 06:00 UTC is a safe slot.
Incremental pulls
added_after returns only the indicators seen since your last poll.
Revocations
Indicators removed as false positives come back with revoked: true and the same ID.
OpenCTI fields
x_opencti_score on every indicator, with first-seen and last-seen dates when known.
Applications
Use cases to evaluate first.
MISP
Pull the collections into MISP through a TAXII 2.1 client.
OpenCTI
Import with the TAXII connector; indicators carry x_opencti_score.
Commercial TIPs
Any TIP with a TAXII 2.1 client can poll the collections.
Your own scripts
Plain HTTPS and an API key are enough.
Specification
What the server returns. Check it before you connect a client.
- Format
- STIX 2.1 bundles: one identity object, then indicators with pattern, confidence and labels.
- Transport
- TAXII 2.1 discovery, API root, collections and objects, paged with the next token.
- Collections
- malicious-ips, malicious-domains, malicious-urls, malicious-file-hashes, phishing-indicators, c2-indicators and more.
- Access
- Pro and Enterprise, with your API key. Polling does not use the monthly request quota.
- Page size
- 50 objects by default. Pro: up to 1,001 per page. Enterprise: no plan cap.
- Refresh
- Collections rebuild nightly from 02:00 UTC. Polling more often returns the same set.
FAQ
Frequently asked questions.
How can I share and ingest threat intelligence using standards like TAXII without vendor tools?
Use any TAXII 2.1 client, or plain HTTPS with your API key in the X-API-KEY header. Follow the next token until the response reports no more data.
How large are TAXII response pages?
50 objects by default. Pro allows up to 1,001 per page, one identity plus 1,000 indicators; Enterprise has no plan cap. Keep following the next token while X-TAXII-Has-More is true.
What STIX/TAXII versions do you support?
STIX 2.1 and TAXII 2.1. STIX/TAXII 1.x is not offered.
How do I connect?
Point your client at the discovery URL in the API reference and authenticate with your API key. Feed access needs Pro or Enterprise.
Cite this data
Quote these figures credited to isMalicious, with a link to this page so readers can check them at the source.
Attribution text: Source: isMalicious, isMalicious STIX/TAXII Feeds — https://ismalicious.com/data/stix-taxii
Explore
Related tools and pages.
Test it with your own indicators.
Send your current tool, expected volume and decision date. We will scope a test against your existing sources.
Pro €99/month · Enterprise on quote · not in Free · TAXII polling does not use your request quota