TAXII Client

Updated 4 months ago by TruSTAR

TruSTAR's TAXII Client offers users a convenient method to ingest intelligence from other TAXII services into enclaves into the TruSTAR Platform. This enables users to normalize intelligence from STIX-TAXII supported tools and leverage high-fidelity Indicators within workflow tools.

  • Source Type: Premium Intel
  • Update Type: Feed-based
  • Update Frequency: 15 minutes
  • Time to Install: 10 minutes

Observables Supported

Requirements

  • Supported Versions
    • TAXII V1.2
    • STIX V1.2
    • TruSTAR API v1.3
    • TruSTAR Python SDK v0.3.23
  • TAXII Client may be GUI-based or CLI
  • API Username
  • API Password
  • PEM file containing private key and certificate
    • Certificate path: path to cert 
    • Certificate url: certificate location path 
  • Key Passphrase (if applicable)
  • TAXII Server URL ("Poll URL")
  • Collections (comma separated)
TruSTAR Admin rights are required to activate this Premium Intelligence feed.

Getting Started

  1. Log into the TruSTAR Web App.
  2. Click the Marketplace icon on the left side icon list.
  3. Click Premium Intel to view the feeds available.
  4. Click Subscribe on the "TAXII Client A" box.
  5. Enter the information requested and click Save Credentials & Request Subscription. (refer to marketplace tile setup below for more details on filling out tile information)

TruSTAR will validate the integration within 48 hours and send an email when the integration has been enabled.

To connect to a second TAXII client, use the TAXII Client B tile in the Marketplace.

Configuring the TAXII Client

To configure your TAXII Client to start pulling indicators from a TAXII Server, enter these credentials:

  • API Username: Username for the TAXII server to connect.
  • API Password: Password for the TAXII server to connect.
  • Content of pem file containing private key and certificate: (optional) PEM File Format Sample
  • Key Passphrase: (optional) Key passphrase for certificate above
  • TAXII server url: poll URL of the TAXII server you want to connect to poll collections from.
  • Collections (comma separated): Comma separated list of the TAXII server collections you want submitted into TruSTAR.

Known Issues

No reported issues.

Please contact support@trustar.co if you have issues with this integration.


How Did We Do?