What Is a STIX/TAXII Threat Feed? A Plain-English Definition — and Why Ours Just Stopped Refusing You at the Door
- Patrick Duggan
- 59 minutes ago
- 4 min read
If you have been told to "consume a STIX/TAXII feed" and nodded along, this is the explainer. No prior knowledge assumed, and about four minutes long.
There is also a confession in the middle of it, because we found out this week that our own feed was refusing people at the door.
STIX is the language. TAXII is the delivery.
That is the entire distinction and almost everyone gets it muddled.
STIX — Structured Threat Information Expression — is a format. It is a way of writing down a piece of threat intelligence so a machine can read it: this IP address is a command-and-control server, this file hash is a piece of malware, this domain belongs to this actor, and here is when we saw it and how confident we are. Without a shared format, every vendor hands you a differently-shaped spreadsheet and you write glue code forever.
TAXII — Trusted Automated Exchange of Intelligence Information — is a transport. It is the agreed way to go and fetch STIX over HTTPS: how you discover what is available, how collections are organised, how you ask for only what changed since yesterday.
The analogy that actually holds: STIX is the language the letter is written in. TAXII is the postal service that delivers it. You can write STIX and hand it over on a USB stick. You can run TAXII and serve something that is not STIX. They are usually paired because they were designed together, but they solve different problems.
What you actually do with one
A threat feed is a list of things known to be bad, with enough context to act on. In practice it goes to one of three places:
Your SIEM, where it becomes enrichment — an alert fires, and instead of an unfamiliar IP address you get "this is a known C2 for this ransomware crew, first seen three weeks ago." That is the difference between a ticket and a decision.
Your firewall or proxy, where high-confidence entries become blocks. This is why confidence scores matter more than volume: an indicator you would not stake a block on should not arrive flagged as one.
Your investigation, where you take an indicator you found and ask whether anyone has seen it before.
The three questions worth asking any feed vendor
Volume is the number every vendor leads with and it is the least useful one. Ours is around 653,000 distinct indicators, and we would rather you interrogated these instead:
When did the last indicator for the thing I care about arrive? A feed with a large total and nothing new in months is a memoir. We audited ourselves on this in August and found actors sitting green for eight weeks with a big count and no recent arrivals. The count never felt wrong, which is exactly the problem.
Which of these did you actually observe, and which are you passing on? Most feeds are substantially other people's research, redistributed. That is legitimate and useful — but it is not the same as first-party observation, and a vendor that will not separate the two is asking you to take the flattering interpretation. We publish the split.
What would you not block yourself? If everything in a feed is marked safe-to-automate, nothing is. Real intelligence has a confidence gradient, and the gradient is where the honesty lives.
The part where we were the problem
Here is what we learned this week from our own AI-visibility data.
taxii feed public is one of the queries AI assistants most often cite us for. Our own guide, How to Consume Our Free STIX/TAXII Threat Intelligence Feed, was earning citations. An assistant would tell somebody we run a free feed and point them at it.
And an anonymous caller following that guide got HTTP 401 on every endpoint, including discovery.
Nothing was broken. Every component behaved exactly as configured. We had written the guide, earned the recommendation, and then built a wall in front of the people who acted on it — and because no error was ever logged as an error, we could not see it.
That is fixed as of today. TAXII discovery now answers anonymously, which is what the spec intended: discovery exists so a client can find out what collections are on offer and how to reach them. Requiring a key to learn that a key is required is a closed loop with no exit. The collections themselves still need one — a free one — and the discovery document now says so plainly and tells you where to get it.
While we were in there we also found the discovery document still advertising "1,086,000+ IOCs from 275+ organizations across 46 countries" — a record count inflated roughly 2.6× against distinct indicators, plus a consumer figure we publicly retired in August. It had been served to every TAXII client since, and plausibly quoted back by the assistants citing us. Also fixed.
How to actually consume ours
Point a TAXII 2.1 client at analytics.dugganusa.com/api/v1/stix-feed/taxii2 and it will tell you the rest. Registration is free and takes about thirty seconds. Send the key as an Authorization: Bearer header, or as ?api_key= if your SIEM cannot set headers — plenty cannot, which is why both work.
If your tooling wants something other than STIX we publish CSV blocklists for IPs, domains, hashes, URLs and malicious packages, an OPNsense-native format, and a MISP feed for the CERTs and ISACs who asked for one by name.
And if you pull it and the first thing you notice is that we are thin on an actor you care about — tell us. The last person who told us something in a feedback box got a whole new feed format inside a fortnight.
Was this useful, or did we miss something? Rate this post below — we read every one, and the low scores are the ones that change what we build.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.
Was this useful? Thirty seconds, no cookies, no tracking, no third parties, your address hashed and never stored. If the box below does not load, the same question lives at https://analytics.dugganusa.com/nps.html?post=what-is-a-stix-taxii-threat-feed-a-plain-english-definition-and-why-ours-just-stopped-refusing-yo
Comments