Connectors

TAXII

Taxii

Updated 2026-08-17

1. Overview

TAXII, short for Trusted Automated exchange of Intelligence Information, defines how cyber threat information can be shared via services and message exchanges.

It is designed specifically to support STIX information, which it does by defining an API that aligns with the common sharing model.

2. Configuration

Follow the initial configuration steps in How to Configure Automation? in the Bloo Knowledge Base.

Click the edit icon to add details.

Field	Description
Configuration Name	Enter the configuration name to uniquely identify this integration.
Collection URL	Enter the valid Collection URL that exists on your TAXII server and that you have read access to.
Username	Enter the username for your TAXII server (if authentication is required).
Password	Enter the password for your TAXII server (if authentication is required).


Note: TAXII Versions and Collection URLTAXII has two versions — TAXII 1.x and TAXII 2.x — which are not backward compatible and use different Collection URL formats.TAXII 1.x: The Collection URL format varies by server provider. Your TAXII feed provider will supply the exact URL. There is no fixed standard path.TAXII 2.x (current OASIS standard, approved 2021): Collection URLs follow a fixed structure: https://`<server>`/`<api-root>`/collections/`<collection-id>`/objects/Refer to your TAXII server's documentation to confirm the exact URL for your setup.Source: OASIS TAXII 2.1 specification — docs.oasis-open.org/cti/taxii/v2.1

Note: TAXII Versions and Collection URLTAXII has two versions — TAXII 1.x and TAXII 2.x — which are not backward compatible and use different Collection URL formats.TAXII 1.x: The Collection URL format varies by server provider. Your TAXII feed provider will supply the exact URL. There is no fixed standard path.TAXII 2.x (current OASIS standard, approved 2021): Collection URLs follow a fixed structure: https://<server>/<api-root>/collections/<collection-id>/objects/Refer to your TAXII server's documentation to confirm the exact URL for your setup.Source: OASIS TAXII 2.1 specification — docs.oasis-open.org/cti/taxii/v2.1

3. Dataset Integrated with TAXII

Retrieve Threat Intel Data

TAXII integration will be configured in Bloo with unique configuration names. It can be configured multiple times. It stores data as a dataset in an event store. This is a scheduled event store and can be used to fetch threat intel data.

Function name: Import_any_intel

Input

_retrieve list

The above query retrieves a list of all the existing event stores. The output is as shown below:

Output

_retrieve query <config_name>

In the absence of a config name, the event store will be named after the plugin name. Query accordingly:

_retrieve query <plugin_name>

In the pipelined query function, the _retrieve directive queries the event store to fetch threat intel data. The output is as shown below:

Output Structure

The output structure will be in STIX format. STIX (Structured Threat Information eXpression) is the standard data format used with TAXII for representing cyber threat intelligence.

Was this page helpful?