Processing Stix Taxii Feeds

Processing Stix Taxii Feeds

Overview

Cybersecurity skill for processing stix taxii feeds. Follows industry best practices and security standards.

When to Use

Trigger phrases:

• "processing stix taxii feeds"
• "Onboarding a new TAXII 2"
• "Validating that ingested STIX bundles conform to the OASIS STIX 2"
• "Building automated pipelines that parse STIX relationship objects to reconstruct"

Use this skill when:

• Onboarding a new TAXII 2.1 collection from a government feed (CISA AIS, FS-ISAC) or commercial provider
• Validating that ingested STIX bundles conform to the OASIS STIX 2.1 specification before import
• Building automated pipelines that parse STIX relationship objects to reconstruct campaign context

Do not use this skill for proprietary vendor feed formats (Recorded Future JSON, CrowdStrike IOC lists) that require vendor-specific parsers rather than STIX processing.

When NOT to Use

• When you lack proper authorization for testing
• For production systems without change management
• When the task requires legal or compliance expertise beyond technical scope

Prerequisites

• Python 3.9+ with stix2 library (pip install stix2) and taxii2-client library
• Network access to TAXII 2.1 server endpoint with valid credentials
• Target TIP or SIEM with import API (MISP, OpenCTI, or Splunk ES)

Workflow

# Example: IOC detection
import re

IOC_PATTERNS = {
    "ip": r"\b(?:\d{1,3}\.){3}\d{1,3}\b",
    "domain": r"\b[a-z0-9-]+\.[a-z]{2,}\b",
    "hash_md5": r"\b[a-f0-9]{32}\b",
    "hash_sha256": r"\b[a-f0-9]{64}\b",
}

def extract_iocs(text: str) -> dict:
    return {k: re.findall(v, text) for k, v in IOC_PATTERNS.items()}

1. Define Objectives — Clarify the goals and scope for stix taxii feeds.
2. Gather Resources — Collect tools, data, and access needed for stix taxii feeds.
3. Execute Process — Carry out stix taxii feeds operations methodically.
4. Verify Quality — Check results against acceptance criteria.
5. Document Outcomes — Record findings, decisions, and next steps.

Tools

• Analysis Platform — Data processing and visualization
• Collaboration Tools — Team coordination and knowledge sharing

Process

1. Prepare — Gather requirements, verify prerequisites, set up environment
2. Execute — Run processing stix taxii feeds workflow with configured parameters
3. Verify — Validate output meets requirements, document results

Verification

• All stix taxii feeds procedures executed completely and documented
• Findings validated against multiple data sources
• False positives identified and filtered
• Results documented with evidence and timestamps
• Recommendations provided with risk-based prioritization

Anti-Rationalization Table