skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

implementing-taxii-server-with-opentaxii

Deploy and configure a TAXII 2.1 server to publish and consume STIX threat intelligence.

954|172|Updated Mar 13, 2026
Search Tags:#threat intelligence#stix#taxii#cti#siem integration#ioc sharing#opentaxii
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill implementing-taxii-server-with-opentaxii
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: implementing-taxii-server-with-opentaxii
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/threat-intelligence/implementing-taxii-server-with-opentaxii
Command: npx skills add https://github.com/xalgord/xalgorix --skill implementing-taxii-server-with-opentaxii

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires medallion, stix2, taxii2-client, opentaxii, cabby, requests.

What problem does it solve?

Organizations need a standardized way to exchange cyber threat intelligence between teams, partners, and security tools, but manually sharing IOCs is slow and error-prone. This Skill guides the deployment of a TAXII 2.1 server so STIX-formatted indicators can be published, polled, and forwarded automatically.

Core Features & Use Cases

  • TAXII Server Deployment: Configure and run a TAXII 2.1 server using Medallion or OpenTAXII, including Docker Compose setup, discovery endpoints, API roots, and collections with read/write permissions.
  • STIX 2.1 Publishing and Consumption: Create STIX bundles (Indicators, Malware, Relationships), publish them to collections, and poll collections with pagination and added_after filtering.
  • SIEM/SOAR Integration: Extract IOCs from polled STIX objects and forward them to Splunk HEC or Elasticsearch for detection workflows.
  • Use Case: A SOC team stands up a TAXII server with malware, APT, and phishing collections, publishes SUNBURST indicators, and automatically feeds the IOCs into Splunk for alerting.

Quick Start

Deploy a TAXII 2.1 server with Medallion, create threat intelligence collections, and publish a STIX 2.1 indicator bundle to one of them.

Frequently Asked Questions about implementing-taxii-server-with-opentaxii

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I set up a TAXII 2.1 server for threat intelligence sharing?▼

Install the Medallion reference implementation, define a config with users, a discovery section, and API roots containing collections, then run it directly or via Docker Compose. Verify deployment by querying the /taxii2/ discovery endpoint and listing collections.

How to publish STIX 2.1 indicators to a TAXII collection?▼

Build STIX objects with the stix2 library, wrap them in a Bundle, and call collection.add_objects using taxii2-client. Check the returned Status response success_count to confirm the objects were accepted by the collection.

What is the difference between OpenTAXII and Medallion?▼

OpenTAXII by EclecticIQ supports the TAXII 1.x protocol, while Medallion is the OASIS cti-taxii-server reference implementation for TAXII 2.1. For STIX 2.1 content and modern TAXII 2.1 collections, Medallion is the appropriate choice.

Why does my TAXII client get 406 or 415 errors when polling collections?▼

These errors come from wrong media-type headers. TAXII 2.1 servers require Accept and Content-Type headers of application/taxii+json;version=2.1 and application/stix+json;version=2.1, so verify your client sends them exactly.

Can I use the default Medallion configuration in production?▼

No. The sample configuration uses placeholder passwords and a MemoryBackend that loses all data on restart. Switch to a persistent backend, set strong credentials, pin stable collection UUIDs, and serve the API over HTTPS with real TLS certificates.

Related Skills

Explore More Software Engineering Skills→
YukiIto1999YukiIto1999

analyzing-threat-intelligence-feeds

Converts threat intelligence feeds into normalized, deduplicated STIX 2.1 indicators.

Community
Advanced
AxxxxxxaaannAxxxxxxaaann

automating-ioc-enrichment

Enrich raw indicators of compromise with multi-source threat intelligence context.

Community
Advanced
jaskaranhundaljaskaranhundal
3

threat-intelligence

Enrich security events by classifying IOCs and mapping behaviors to MITRE ATT&CK techniques.

Community
Advanced
Muath2000Muath2000

threat-intel-engineer

Integrate, normalize, and correlate cyber threat data from STIX/TAXII feeds.

Community
Advanced