implementing-stix-taxii-feed-integration

Use the taxii2-client library to connect to a TAXII 2.1 server, enumerate API roots and collections, then call get_objects with as_pages to iterate paginated results. The MITRE ATT&CK TAXII server at cti-taxii.mitre.org is a common public source.

Filter STIX objects where type equals indicator and read the pattern field, which contains the STIX pattern expression. Also extract SCOs like ipv4-addr, domain-name, url, and file objects, since raw observables often live outside indicator objects.

Calling get_objects once returns only the first envelope page for large collections. Wrap the call in as_pages from taxii2-client and iterate until all pages are exhausted, logging the running total to confirm completeness.

Yes, pass an added_after parameter in UTC format %Y-%m-%dT%H:%M:%S.000Z to fetch only new objects. Persist the server-returned timestamp per collection, since local-time or malformed timestamps cause re-fetching or skipped objects.

Yes, the medallion package from OASIS provides a local TAXII 2.1 server with configurable users and backends. You can push STIX bundles to its collections via POST requests with the application/stix+json;version=2.1 content type.

Indicators are SDOs containing detection patterns with context like valid_from and confidence, while SCOs such as ipv4-addr and domain-name are raw cyber observables. Consumers must handle both families or they miss actual observable values.