domains / families / security / processing-stix-taxii-feeds

processing-stix-taxii-feeds

separate

'Processes STIX 2.1 threat intelligence bundles delivered via TAXII 2.1

When to use

• Onboarding a new TAXII 2.1 collection from a government feed (CISA AIS, FS-ISAC) or commercial provider
• Validating that ingested STIX bundles conform to the OASIS STIX 2.1 specification before import
• Building automated pipelines that parse STIX relationship objects to reconstruct campaign context

When not to use

• proprietary vendor feed formats
• Recorded Future JSON
• CrowdStrike IOC lists
• vendor-specific parsers

Skill page

Source