Managing threat intel feeds using TAXII

You can now store third-party threat intel feeds into a standard format called TAXII (Trusted Automated eXchange of Intelligence Information).

Note
Intel feeds retrieved from the TAXII server should adhere to the STIX 2.0/2.1 format.

You can create new configuration settings for the TAXII server using the Malware Analysis appliance Web UI and the CLI.

Create a new TAXII server configuration using the Malware Analysis appliance Web UI.

Log in to the Malware Analysis appliance as an administrator.
Go to Settings >TAXII.
Select Create New Config+. You will be redirected to the configuration form.
Enter a Server name and the current status of the TAXII server. A maximum of 255 characters is allowed for the server name. This step is mandatory.
Enter the Discovery URL, Username and Password.
Enter the API Root URL. If the credentials are same as the discovery URL, select the checkbox. Otherwise enter the required Username and password.
Enter the Collection ID associated with the API root URL. Click + to add more collection IDs.
Click +Add additional API root to add more API roots.
Enter the Root-ca name and Ca-chain name. If CA chain name is provided then its mandatory to enter the root CA name.
See Configuring SSL Interception CA Certificates for more details.
Enter the Pagination limit and the sync period. Select the Enable checkbox to enable the root CA.
The range for pagination limit is 500-15000. Sync period can have a frequency between 1 - 168 minutes.
Click Validate to connect to the TAXII server using the current configuration. It will return a success message if the connection is established, otherwise it will return an error message.
Select Save to save your configuration. You can also select Delete to delete the configuration.

To create a new TAXII server configuration using the CLI:

Go to CLI configuration mode.

hostname > enable
hostname # configure terminal

Store and execute the root CA and store the remaining CA chain.

hostname (config) # crypto certificate name rootCA public-cert pem ""
hostname (config) # crypto certificate ca-list default-ca-list name rootCA
hostname (config) # crypto certificate ca-chain chain-name inter-ca-chain web-server pem-bundle ""

Create a new TAXII server configuration.
```
hostname (config) # taxii server <serverName>
```
You can use the following CLIs to configure a new TAXII server. For more details, refer to the CLI Reference:
- Creates a server name. A maximum of 255 characters is allowed for the server name. This step is mandatory:
  [no] taxii server <serverName>
  Use the ‘no’ form of the command to delete the existing configuration.
- Enters the API root URL and credentials. If a username and password are not provided, the credentials provided for the discovery URL will be used:
  taxii server <serverName> api-root <api-root> username <username> password <password>
- Enters collection IDs for the mentioned API root:
  taxii server <serverName> api-root <api-root> collection-id <collection-id>
  Use the ‘no’ form of the command to delete the API root and the collection ID.
- Deletes the mentioned API root:
  no taxii server <serverName> api-root <api-root>
- Enters the discovery URL:
  taxii server <serverName> discovery-url <discovery-url>
- Enters the credentials for the discovery URL:
  taxii server <serverName> username <username> password <password>
- Enters the pagination limit. The range for pagination limit is 500-15000:
  taxii server <serverName> pagination_limit <pagination_limit>
- Enters the frequency of synchronization in minutes. The frequency can be between 1 - 168 minutes:
  taxii server <serverName> sync-frequency <frequency_mins>
- Enables the current configuration:
  [no] taxii server <serverName> enable
  Use the ‘no’ form of the command to disable the existing configuration.
- Validates the connection with the TAXII server using the current configuration. It will return a success message if the connection is established, otherwise it will return an error message:
  taxii server <serverName> validate config
- Stores the name of the root CA certificate:
  taxii server <serverName> root-ca <root-ca-name>
  Use the ‘no’ form of the command to delete the root CA.
- Stores the name of the CA chain. The root CA is mandatory when configuring the CA chain:
  taxii server <serverName> root-ca <root-ca-name> ca-chain <ca-chain-name>
- Deletes the CA chain:
  no taxii server <serverName> ca-chain
- Displays the configurations associated with the current TAXII server:
  show taxii server <serverName>
- Enables the required indicator type for STIX format intel feeds:
  [no]analysis custom stix indicator-type <type> enable
  Use the ‘no’ form of the command to disable an indicator type.

Verify the configuration of the new TAXII server.

hostname (config) # show taxii server <serverName>
TAXII server              : ctix
Enable                    : true
Discovery URL             : https://threatfeed.cyware.com/ctixapi/ctix15/taxii3/
Username                  : a126rf12-2bc3-4b0c-acfe-1776975b4043
Last sync time            : 2025-03-21T08:48:57.750000Z
Sync frequency            : 15
Pagination limit          : 1000
Root CA name              : AmazonRootCA1.pem
CA chain name             : 
Status                    : Taxii feed Synchronization completed succesfully at :2025-03-21T08:49:03.105
API root   1    
    URL                   : https://threatfeed.cyware.com/ctixapi/ctix24/
    Username              : 
    Collection IDs        : [46cc884e-fd37-4436-95b3-ac73710df3dc]