Incoming feed - TAXII 2.1 inbox#

Note

This article describes how to configure incoming feeds for a particular feed source. To see how to configure incoming feeds in general, see Create and configure incoming feeds.

Specifications

Transport type

TAXII 2.1 inbox

Content type

STIX 2.1

Ingested data

See STIX Compatibility

Processed data

This feed starts a TAXII 2.1 collection that listens for POST requests that add objects to it. Objects added to the collection this way are ingested by the Intelligence Center.

Configure the feed#

Tip

This feed depends on the bundled Opentaxii server.

To change TAXII 2 service defaults, see Configure Opentaxii server.

  1. Create or edit an incoming feed.

  2. Under Transport and content, fill out these fields:

    Note

    Required fields are marked with an asterisk (*).

    Field

    Description

    Transport type*

    Select TAXII 2.1 inbox from the drop-down menu.

    Content type*

    Select STIX 2.1 from the drop-down menu.

    Public

    (Not recommended) Select to allow anyone to send objects to this feed.

    Authorized groups

    Select one or more groups whose users are authorized to send objects to this feed.

    Not available when Public is selected.

  3. Store your changes by selecting Save.

Known issues#

See STIX 2.1 Known Issues.