Cyber Threat Intelligence (STIX/TAXII Feed Integration)
Cyber Threat Intelligence integration in AIR enables you to ingest structured threat intelligence from STIX/TAXII-compatible feeds and operationalize it in investigation workflows.
The integration connects AIR to external TAXII 2.x servers, pulls STIX objects, parses indicators, and converts them into investigation-ready YARA, Sigma, and osquery hunt/triage rules.
Key capabilities
Section titled “Key capabilities”With Cyber Threat Intelligence integration, you can:
- Connect to TAXII 2.x compliant feeds (public or private)
- Discover available TAXII collections automatically
- Run scheduled or manual sync jobs
- Apply confidence filtering before rule generation
- Convert indicators into YARA, Sigma, and osquery hunt/triage rules
- Browse imported indicators and sync history in AIR
Supported authentication methods
Section titled “Supported authentication methods”You can configure feed access with:
- No authentication (for public feeds)
- Bearer token
- Basic authentication
- API key via custom header
Prerequisites
Section titled “Prerequisites”Before configuring a feed, verify the following:
- You have administrative access in AIR
- Your feed provider supports TAXII 2.x and STIX data
- You have the required feed credentials/tokens
- The Console can reach the feed endpoint over the network
- The Cyber Threat Intelligence integration feature is enabled in your environment
Recommended setup workflow
Section titled “Recommended setup workflow”- Add the TAXII feed URL and authentication details.
- Test connection and load available collections.
- Select collections to subscribe.
- Configure conversion options per category.
- Set sync strategy (manual or scheduled).
- Run initial sync and review generated hunt/triage rules.
Supported indicator categories
Section titled “Supported indicator categories”The current parser supports these indicator categories:
- File hash
- File path
- Network address (IPv4/IPv6)
- Domain
- URL
- Registry key
- Mutex
- Process
- Direct YARA pattern
- Direct Sigma pattern
Rule generation and ownership modes
Section titled “Rule generation and ownership modes”When content type is hunt/triage rules, imported indicators are converted into YARA, Sigma, or osquery content.
| Mode | Behavior |
|---|---|
| Managed | Rules are maintained by the system and updated on sync cycles. |
| Snapshot | Rules are created as a point-in-time snapshot and are not overwritten by later sync updates. |
Sync behavior
Section titled “Sync behavior”- Scheduled sync intervals support:
15,30,60,120,360,720,1440minutes - Manual sync is supported
- Sync logs are retained for recent runs and can be reviewed in the UI
- Incremental sync is used to reduce repeated data transfer
Current limitations
Section titled “Current limitations”- TAXII 1.x is not supported
- Compound STIX patterns (for example
AND/ORmixed observables) are not supported - Feed ingestion is pull-based (no webhook/push mode)
Best practices
Section titled “Best practices”- Start with trusted collections and expand gradually
- Set a sensible confidence threshold to reduce noisy indicators
- Define clear ownership for feed maintenance and review
- For Snapshot mode, periodically remove low-value or stale feed sources and keep curated feeds only.
How conversion works in practice
Section titled “How conversion works in practice”During each sync, AIR processes incoming STIX objects and applies your collection-level configuration:
- Pull indicators from selected TAXII collections.
- Parse supported indicator patterns into internal categories.
- Filter indicators by confidence threshold and supported pattern rules.
- Group indicators by engine/category mapping.
- Generate or update hunt/triage rules (YARA, Sigma, osquery).
In Managed mode, generated rules are maintained by sync cycles. In Snapshot mode, generated rules are preserved as point-in-time outputs.
Why do I see fewer indicators than expected after sync?
Section titled “Why do I see fewer indicators than expected after sync?”This usually means one or more indicators were excluded by configuration or parser rules, for example:
- Confidence is below your minimum threshold
- Pattern type is unsupported for the current phase
- Indicator category is disabled in conversion settings
- Indicator has expired or is no longer available in the source collection
Why did some indicators not become rules?
Section titled “Why did some indicators not become rules?”Not every STIX object becomes a hunt/triage rule directly. Rule creation depends on:
- Supported indicator category
- Engine mapping in your collection configuration
- Search scope compatibility for the selected engine
- Rule size and batching limits in the current implementation
What is the difference between Managed and Snapshot modes?
Section titled “What is the difference between Managed and Snapshot modes?”- Managed: best for continuously updated feeds. Rules are updated by recurring sync jobs.
- Snapshot: best for one-time or controlled imports. Existing generated rules are not overwritten by later sync updates.
How often should I run sync jobs?
Section titled “How often should I run sync jobs?”Use shorter intervals for high-priority operational feeds and longer intervals for low-volatility feeds. Supported scheduled intervals are 15, 30, 60, 120, 360, 720, and 1440 minutes.
Which authentication type should I choose?
Section titled “Which authentication type should I choose?”- Use None for public feeds
- Use Bearer for token-based providers
- Use Basic when username/password is required
- Use API Key when provider expects a custom header
Always confirm the exact auth method and header format with your feed provider.
Is TAXII 1.x supported?
Section titled “Is TAXII 1.x supported?”No. The current integration supports TAXII 2.x only.
Can I use webhook/push instead of polling?
Section titled “Can I use webhook/push instead of polling?”Not in the current phase. Feed ingestion is pull-based through scheduled or manual sync.
Can I ingest every STIX pattern type?
Section titled “Can I ingest every STIX pattern type?”No. Compound patterns (for example mixed AND / OR object conditions) are currently out of scope and can be skipped.