Misp: Integrated STIX/TAXII feed ingestion via the GUI

[robertnixon2003]

Feature request

This feature request is to add STIX/TAXII as a feed source format option in the platform. Not a bolt on or script. But something that is production ready. It would also need the ability to authenticate with SSL certificates as most major ISACs require this.

This small piece is the only reason we still pay for a commercial Threat Intelligence Platform.

[iglocska]

One of the main issues with this is that we ourselves don't have access to any such STIX/TAXII feed so we'd have to develop it blindly. Got any idea of something for us to develop against?

[adulau]

@robertnixon2003 if you can find a way to have access to one of those, that would be great. We can discuss privately about it via info(AT)circl(DOT)lu

[robertnixon2003]

I sent an email to the address above. It will be coming from my corporate account. Thanks for your interest on this. I will help in any way I can.

[chrineun]

We would be interested in that feature too . +1

[shotoz]

We definitavely need this ! There is an open server available: hailataxii.com

[perez1987]

+1

[gonrada]

@adulau The Department of Homeland Security’s (DHS) free Automated Indicator Sharing (AIS) is also a TAXII feed you could use.

[Glhenn]

@adulau Anaomali also have a TAXII 2.0 feed - LIMO - that is free that can be leveraged.

[arcsector]

You can develop it against hailataxii or taxiistand. Both have support for username/password auth, but for key auth you could use DHS's repo, although it only works with libtaxii, not cabby.

[holidayz1]

+1

[Tubbs10]

Any news on this yet? I'm sure there are a lot of organizations who could benefit from this a long way.

[user4913]

Is there any news on this one? We would be keen to see this as an option? Is there any way currently to ingest TAXI data into MISP?