TAXII Client Basics

Updated 3 months ago by Elvis Hovor

This document explains the basics of using a TAXII client to download data from the TruSTAR TAXII Server.

Requirements

The TAXII client you use must meet the following requirements in order to connect to the TruSTAR TAXII server:

  • TAXII Version 1.2 or higher
  • Able to accept STIX 1.2 formatted packages
  • TruSTAR API v1.3 (Provided by TruSTAR)
  • TruSTAR Python SDK v0.3.23 (Provided by TruSTAR)
  • Able to connect to these services supported by the TruSTAR TAXII Server:
    • Discovery
    • Collection Management
    • Collection Polling
A subscription ID is not required to access the TAXII server data.

Accessing an Enclave

By default, the TruSTAR TAXII server will serve Indicators from all TruSTAR Enclaves that your TruSTAR user account has access to.

Downloading from a Single Enclave

To download from a single Enclave, TruSTAR recommends a two-step process:

  1. Create a new User Account in the TruSTAR Web App. Think of this as a service account; use a team or group email address for this user account's username to distinguish its limited access from other user accounts that have full access to TruSTAR Enclaves.
  2. Give that account view access only to the Enclave you want to download from. For more information on how to do this, see Managing Users.

Downloading from Multiple Enclaves

If you need to download Indicators from multiple Enclaves AND need to know which Enclave each Indicator came from, TruSTAR recommends creating several service accounts, with each account having view access to a single Enclave. You can then make poll requests to the TAXII server one service account at a time.

If you are using a TAXII client within a third-party application (for example, LogRhythm), you must configure a new TruSTAR TAXII server connection for each Enclave that you want to query.

Managing Whitelisted Indicators

When connecting your TAXII client to the TruSTAR TAXII server, the client will import all Indicators, even those that you have whitelisted in TruSTAR.

To avoid this, there are two options:

  • Manually delete those Indicators by hand in the TruSTAR Web App before the TAXII client connection is made
  • Programatically remove them from the TAXII Server's response to your TAXII client after downloading them from TruSTAR.


How Did We Do?