What problem does it solve?
Ingesting threat intelligence from TAXII feeds often leads to silent data loss, duplicate indicators, and malformed STIX bundles breaking downstream SIEM or TIP imports. This Skill provides a structured workflow to discover collections, paginate feeds, validate STIX 2.1 objects, and route them to consuming platforms without losing or mis-handling intelligence.
Core Features & Use Cases
- TAXII Collection Discovery & Polling: Enumerate TAXII 2.1 server collections and fetch incremental objects using
added_after filters with pagination and UTC overlap windows.
- STIX Bundle Validation: Parse bundles with the
stix2 library, check spec_version, required indicator fields, confidence ranges, and resolve relationship references before import.
- Routing & Bi-directional Sharing: Map indicators, malware, threat-actors, and courses-of-action to SIEM, EDR, TIP, or SOAR destinations while enforcing TLP marking restrictions, and publish validated local intelligence back to shared collections.
- Use Case: Onboard a CISA AIS or FS-ISAC feed by polling its TAXII collection every 24 hours, deduplicating indicators by observable value, filtering revoked or expired entries, and pushing clean indicators into Splunk ES and MISP.
Quick Start
Ask the AI to connect to your TAXII 2.1 server, fetch the last 24 hours of STIX objects from a chosen collection, validate the indicators, and route them to your SIEM.
