Cyber Threat Intelligence (STIX/TAXII Feed Integration)

Cyber Threat Intelligence integration in XDR Forensics enables you to ingest structured threat intelligence from STIX/TAXII-compatible feeds and operationalize it in investigation workflows.

The integration connects XDR Forensics to external TAXII 2.x servers, pulls STIX objects, parses indicators, and converts them into investigation-ready YARA, Sigma, and osquery hunt/triage rules.

With Cyber Threat Intelligence integration, you can:

• Connect to TAXII 2.x compliant feeds (public or private)
• Discover available TAXII collections automatically
• Run scheduled or manual sync jobs
• Apply confidence filtering before rule generation
• Convert indicators into YARA, Sigma, and osquery hunt/triage rules
• Browse imported indicators and sync history in XDR Forensics

You can configure feed access with:

• No authentication (for public feeds)
• Bearer token
• Basic authentication
• API key via custom header

Before configuring a feed, verify the following:

• You have administrative access in XDR Forensics
• Your feed provider supports TAXII 2.x and STIX data
• You have the required feed credentials/tokens
• The Console can reach the feed endpoint over the network
• The Cyber Threat Intelligence integration feature is enabled in your environment

1. Add the TAXII feed URL and authentication details.
2. Test connection and load available collections.
3. Select collections to subscribe.
4. Configure conversion options per category.
5. Set sync strategy (manual or scheduled).
6. Run initial sync and review generated hunt/triage rules.

The current parser supports these indicator categories:

• File hash
• File path
• Network address (IPv4/IPv6)
• Domain
• URL
• Email
• Registry key
• Mutex
• Process
• Direct YARA pattern
• Direct Sigma pattern

When content type is hunt/triage rules, imported indicators are converted into YARA, Sigma, or osquery content.

• Scheduled sync intervals support: 15, 30, 60, 120, 360, 720, 1440 minutes
• Manual sync is supported
• Sync logs are retained for recent runs and can be reviewed in the UI
• Incremental sync is used to reduce repeated data transfer

• TAXII 1.x is not supported
• Compound STIX patterns (for example AND / OR mixed observables) are not supported
• Feed ingestion is pull-based (no webhook/push mode)

• Start with trusted collections and expand gradually
• Set a sensible confidence threshold to reduce noisy indicators
• Define clear ownership for feed maintenance and review
• For Snapshot mode, periodically remove low-value or stale feed sources and keep curated feeds only.

During each sync, XDR Forensics processes incoming STIX objects and applies your collection-level configuration:

1. Pull indicators from selected TAXII collections.
2. Parse supported indicator patterns into internal categories.
3. Filter indicators by confidence threshold and supported pattern rules.
4. Group indicators by engine/category mapping.
5. Generate or update hunt/triage rules (YARA, Sigma, osquery).

In Managed mode, generated rules are maintained by sync cycles. In Snapshot mode, generated rules are preserved as point-in-time outputs.

This usually means one or more indicators were excluded by configuration or parser rules, for example:

• Confidence is below your minimum threshold
• Pattern type is unsupported for the current phase
• Indicator category is disabled in conversion settings
• Indicator has expired or is no longer available in the source collection

Not every STIX object becomes a hunt/triage rule directly. Rule creation depends on:

• Supported indicator category
• Engine mapping in your collection configuration
• Search scope compatibility for the selected engine
• Rule size and batching limits in the current implementation

• Managed: best for continuously updated feeds. Rules are updated by recurring sync jobs.
• Snapshot: best for one-time or controlled imports. Existing generated rules are not overwritten by later sync updates.

Use shorter intervals for high-priority operational feeds and longer intervals for low-volatility feeds. Supported scheduled intervals are 15, 30, 60, 120, 360, 720, and 1440 minutes.

• Use None for public feeds
• Use Bearer for token-based providers
• Use Basic when username/password is required
• Use API Key when provider expects a custom header

Always confirm the exact auth method and header format with your feed provider.

No. The current integration supports TAXII 2.x only.

Not in the current phase. Feed ingestion is pull-based through scheduled or manual sync.

No. Compound patterns (for example mixed AND / OR object conditions) are currently out of scope and can be skipped.