[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AFDY98EWM3HGP4DJXB49JK":3,"skill-same:01M6AFDY98EWM3HGP4DJXB49JK":121},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":43,"linkOnly":44,"markdownContent":45,"markdownBody":46,"frontMatter":47,"refName":62,"commitSha":63,"skillDirectory":64,"forksCount":65,"repositoryHtmlUrl":66,"repositoryHomepageUrl":67,"ownerHtmlUrl":68,"ownerBlogUrl":69,"ownerDescription":70,"updatedAt":71,"install":72,"resources":85},"01M6AFDY98EWM3HGP4DJXB49JK","implementing-stix-taxii-feed-integration",null,"Implements a STIX 2.1\u002FTAXII 2.1 threat-intelligence feed consumer and producer in Python, covering TAXII server discovery, collection polling, parsing STIX bundles with the stix2 library, and standing up a local TAXII server with Medallion. Use when integrating a STIX\u002FTAXII CTI feed into a SIEM or TIP, writing a TAXII client to poll for new indicators, or setting up TAXII collections for indicator exchange.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35990,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-stix-taxii-feed-integration\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42],"implementing stix taxii feed integration","integration","TAXII","stix","cti","oasis","feed-integration","indicators","TIP","indicator","ioc","writing","threat-intelligence","mitre-attack","server","library","siem","cybersecurity","python","2026-11-10 10:12:30",false,"---\nname: implementing-stix-taxii-feed-integration\ndescription: Implements a STIX 2.1\u002FTAXII 2.1 threat-intelligence feed consumer and\n  producer in Python, covering TAXII server discovery, collection polling, parsing\n  STIX bundles with the stix2 library, and standing up a local TAXII server with Medallion.\n  Use when integrating a STIX\u002FTAXII CTI feed into a SIEM or TIP, writing a TAXII client\n  to poll for new indicators, or setting up TAXII collections for indicator exchange.\ndomain: cybersecurity\nsubdomain: threat-intelligence\ntags:\n- threat-intelligence\n- cti\n- ioc\n- mitre-attack\n- stix\n- taxii\n- feed-integration\n- oasis\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- ID.RA-01\n- ID.RA-05\n- DE.CM-01\n- DE.AE-02\nmitre_attack:\n- T1591\n- T1592\n- T1593\n- T1589\n---\n# Implementing STIX\u002FTAXII Feed Integration\n\n## Overview\n\nSTIX (Structured Threat Information eXpression) and TAXII (Trusted Automated eXchange of Intelligence Information) are OASIS open standards for representing and transporting cyber threat intelligence. This skill covers implementing a STIX\u002FTAXII 2.1 feed consumer and producer using Python, configuring TAXII server discovery, collection management, polling for new intelligence, parsing STIX 2.1 objects, and integrating feeds into SIEM and TIP platforms.\n\n\n## When to Use\n\n- When deploying or configuring implementing stix taxii feed integration capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- Python 3.9+ with `taxii2-client`, `stix2`, `cti-taxii-client` libraries\n- Understanding of STIX 2.1 data model (SDOs, SCOs, SROs)\n- Understanding of TAXII 2.1 protocol (discovery, API roots, collections)\n- Network access to TAXII servers (MITRE ATT&CK TAXII, Anomali STAXX)\n- Optional: medallion for running a local TAXII 2.1 server\n\n## Key Concepts\n\n### TAXII 2.1 Architecture\n\nTAXII defines a RESTful API with three service types:\n- **Discovery**: Returns information about available API roots\n- **API Root**: Contains collections and serves as the main interaction point\n- **Collection**: A logical grouping of STIX objects accessible via GET\u002FPOST\n\n### STIX 2.1 Object Model\n\nSTIX objects are categorized as:\n- **SDOs (STIX Domain Objects)**: Indicator, Malware, Threat Actor, Campaign, Attack Pattern, Tool, Infrastructure, Vulnerability, Identity, Location, Note, Opinion, Report, Grouping\n- **SCOs (STIX Cyber Observables)**: IPv4-Addr, Domain-Name, URL, File, Email-Addr, Process, Network-Traffic, Artifact\n- **SROs (STIX Relationship Objects)**: Relationship, Sighting\n- **Meta Objects**: Marking Definition (TLP), Language Content, Extension Definition\n\n### STIX Bundle\n\nA Bundle is a collection of STIX objects transmitted together. Bundles have a unique ID and contain an array of objects. TAXII collections serve bundles in response to GET requests.\n\n## Workflow\n\n### Step 1: TAXII Server Discovery\n\n```python\nfrom taxii2client.v21 import Server, Collection, as_pages\n\n# Connect to MITRE ATT&CK TAXII server\nserver = Server(\"https:\u002F\u002Fcti-taxii.mitre.org\u002Ftaxii2\u002F\", user=\"\", password=\"\")\n\nprint(f\"Title: {server.title}\")\nprint(f\"Description: {server.description}\")\n\n# List API roots\nfor api_root in server.api_roots:\n    print(f\"\\nAPI Root: {api_root.title}\")\n    print(f\"  URL: {api_root.url}\")\n\n    # List collections\n    for collection in api_root.collections:\n        print(f\"  Collection: {collection.title} (ID: {collection.id})\")\n        print(f\"    Can Read: {collection.can_read}\")\n        print(f\"    Can Write: {collection.can_write}\")\n```\n\n### Step 2: Fetch STIX Objects from Collection\n\n```python\nfrom taxii2client.v21 import Collection, as_pages\nimport json\n\n# Connect to Enterprise ATT&CK collection\nENTERPRISE_ATTACK_ID = \"95ecc380-afe9-11e4-9b6c-751b66dd541e\"\ncollection = Collection(\n    f\"https:\u002F\u002Fcti-taxii.mitre.org\u002Fstix\u002Fcollections\u002F{ENTERPRISE_ATTACK_ID}\u002F\",\n    user=\"\",\n    password=\"\",\n)\n\nprint(f\"Collection: {collection.title}\")\n\n# Fetch all objects (paginated)\nall_objects = []\nfor envelope in as_pages(collection.get_objects, per_request=50):\n    objects = envelope.get(\"objects\", [])\n    all_objects.extend(objects)\n    print(f\"  Fetched {len(objects)} objects (total: {len(all_objects)})\")\n\nprint(f\"\\nTotal objects retrieved: {len(all_objects)}\")\n\n# Categorize by type\ntype_counts = {}\nfor obj in all_objects:\n    obj_type = obj.get(\"type\", \"unknown\")\n    type_counts[obj_type] = type_counts.get(obj_type, 0) + 1\n\nfor obj_type, count in sorted(type_counts.items()):\n    print(f\"  {obj_type}: {count}\")\n```\n\n### Step 3: Parse STIX 2.1 Objects with stix2 Library\n\n```python\nfrom stix2 import parse, Filter, MemoryStore\n\n# Load objects into a MemoryStore for querying\nstore = MemoryStore(stix_data=all_objects)\n\n# Query for all indicators\nindicators = store.query([Filter(\"type\", \"=\", \"indicator\")])\nprint(f\"Indicators: {len(indicators)}\")\n\nfor ind in indicators[:5]:\n    print(f\"  {ind.name}: {ind.pattern}\")\n\n# Query for malware\nmalware_list = store.query([Filter(\"type\", \"=\", \"malware\")])\nprint(f\"\\nMalware families: {len(malware_list)}\")\n\n# Query for threat actors\nactors = store.query([Filter(\"type\", \"=\", \"intrusion-set\")])\nprint(f\"Threat actors: {len(actors)}\")\n\n# Find relationships for a specific object\ndef get_related(store, source_id):\n    relationships = store.query([\n        Filter(\"type\", \"=\", \"relationship\"),\n        Filter(\"source_ref\", \"=\", source_id),\n    ])\n    return relationships\n\n# Example: Get all techniques used by APT28\napt28 = store.query([\n    Filter(\"type\", \"=\", \"intrusion-set\"),\n    Filter(\"name\", \"=\", \"APT28\"),\n])\nif apt28:\n    rels = get_related(store, apt28[0].id)\n    for rel in rels:\n        target = store.get(rel.target_ref)\n        if target:\n            print(f\"  {rel.relationship_type} -> {target.name} ({target.type})\")\n```\n\n### Step 4: Implement Custom TAXII Consumer\n\n```python\nfrom taxii2client.v21 import Collection, as_pages\nfrom stix2 import parse, Bundle\nfrom datetime import datetime, timedelta\nimport json\n\nclass TAXIIConsumer:\n    \"\"\"Consume STIX\u002FTAXII 2.1 feeds and extract IOCs.\"\"\"\n\n    def __init__(self, collection_url, user=\"\", password=\"\"):\n        self.collection = Collection(collection_url, user=user, password=password)\n        self.last_poll = None\n\n    def poll_new_objects(self, added_after=None):\n        \"\"\"Poll for objects added after a specific timestamp.\"\"\"\n        if added_after is None:\n            added_after = (\n                self.last_poll or\n                (datetime.utcnow() - timedelta(days=1)).strftime(\n                    \"%Y-%m-%dT%H:%M:%S.000Z\"\n                )\n            )\n\n        all_objects = []\n        kwargs = {\"added_after\": added_after}\n\n        for envelope in as_pages(\n            self.collection.get_objects, per_request=100, **kwargs\n        ):\n            objects = envelope.get(\"objects\", [])\n            all_objects.extend(objects)\n\n        self.last_poll = datetime.utcnow().strftime(\"%Y-%m-%dT%H:%M:%S.000Z\")\n        return all_objects\n\n    def extract_indicators(self, objects):\n        \"\"\"Extract actionable indicators from STIX objects.\"\"\"\n        indicators = []\n        for obj in objects:\n            if obj.get(\"type\") == \"indicator\":\n                indicators.append({\n                    \"id\": obj.get(\"id\"),\n                    \"name\": obj.get(\"name\", \"\"),\n                    \"pattern\": obj.get(\"pattern\", \"\"),\n                    \"pattern_type\": obj.get(\"pattern_type\", \"\"),\n                    \"valid_from\": obj.get(\"valid_from\", \"\"),\n                    \"valid_until\": obj.get(\"valid_until\", \"\"),\n                    \"indicator_types\": obj.get(\"indicator_types\", []),\n                    \"confidence\": obj.get(\"confidence\", 0),\n                    \"labels\": obj.get(\"labels\", []),\n                })\n        return indicators\n\n    def extract_observables(self, objects):\n        \"\"\"Extract STIX Cyber Observables.\"\"\"\n        observables = []\n        observable_types = {\n            \"ipv4-addr\", \"ipv6-addr\", \"domain-name\", \"url\",\n            \"file\", \"email-addr\", \"network-traffic\",\n        }\n        for obj in objects:\n            if obj.get(\"type\") in observable_types:\n                observables.append({\n                    \"type\": obj[\"type\"],\n                    \"value\": obj.get(\"value\", \"\"),\n                    \"id\": obj.get(\"id\"),\n                })\n        return observables\n\n\n# Usage\nconsumer = TAXIIConsumer(\n    f\"https:\u002F\u002Fcti-taxii.mitre.org\u002Fstix\u002Fcollections\u002F{ENTERPRISE_ATTACK_ID}\u002F\"\n)\nnew_objects = consumer.poll_new_objects()\nindicators = consumer.extract_indicators(new_objects)\nprint(f\"New indicators: {len(indicators)}\")\n```\n\n### Step 5: Set Up Local TAXII Server with Medallion\n\n```python\n# medallion configuration (medallion.conf)\nTAXII_CONFIG = {\n    \"backend\": {\n        \"module_class\": \"MemoryBackend\",\n    },\n    \"users\": {\n        \"admin\": \"admin_password\",\n        \"readonly\": \"readonly_password\",\n    },\n    \"taxii\": {\n        \"max_content_length\": 10485760,\n    },\n}\n\n# Run medallion server:\n# pip install medallion\n# python -m medallion --config medallion.conf --port 5000\n\n# Add objects to local TAXII server\nimport requests\n\ndef push_to_taxii(server_url, collection_id, stix_bundle, user, password):\n    \"\"\"Push STIX bundle to a TAXII 2.1 collection.\"\"\"\n    url = f\"{server_url}\u002Fcollections\u002F{collection_id}\u002Fobjects\u002F\"\n    headers = {\n        \"Content-Type\": \"application\u002Fstix+json;version=2.1\",\n        \"Accept\": \"application\u002Ftaxii+json;version=2.1\",\n    }\n    response = requests.post(\n        url,\n        json=stix_bundle,\n        headers=headers,\n        auth=(user, password),\n        timeout=30,\n    )\n    return response.json()\n```\n\n## Validation Criteria\n\n- TAXII server discovery returns valid API roots and collections\n- STIX objects fetched and parsed correctly from TAXII collections\n- Indicators extracted with valid STIX patterns\n- Pagination handled correctly for large collections\n- Consumer tracks polling state for incremental updates\n- Local TAXII server accepts and serves STIX bundles\n\n## References\n\n- [STIX 2.1 Specification](https:\u002F\u002Fdocs.oasis-open.org\u002Fcti\u002Fstix\u002Fv2.1\u002Fstix-v2.1.html)\n- [TAXII 2.1 Specification](https:\u002F\u002Fdocs.oasis-open.org\u002Fcti\u002Ftaxii\u002Fv2.1\u002Ftaxii-v2.1.html)\n- [taxii2-client PyPI](https:\u002F\u002Fpypi.org\u002Fproject\u002Ftaxii2-client\u002F)\n- [stix2 Python Library](https:\u002F\u002Fstix2.readthedocs.io\u002F)\n- [MITRE ATT&CK TAXII Server](https:\u002F\u002Fcti-taxii.mitre.org\u002Ftaxii2\u002F)\n- [Medallion TAXII Server](https:\u002F\u002Fgithub.com\u002Foasis-open\u002Fcti-taxii-server)\n","# Implementing STIX\u002FTAXII Feed Integration\n\n## Overview\n\nSTIX (Structured Threat Information eXpression) and TAXII (Trusted Automated eXchange of Intelligence Information) are OASIS open standards for representing and transporting cyber threat intelligence. This skill covers implementing a STIX\u002FTAXII 2.1 feed consumer and producer using Python, configuring TAXII server discovery, collection management, polling for new intelligence, parsing STIX 2.1 objects, and integrating feeds into SIEM and TIP platforms.\n\n\n## When to Use\n\n- When deploying or configuring implementing stix taxii feed integration capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- Python 3.9+ with `taxii2-client`, `stix2`, `cti-taxii-client` libraries\n- Understanding of STIX 2.1 data model (SDOs, SCOs, SROs)\n- Understanding of TAXII 2.1 protocol (discovery, API roots, collections)\n- Network access to TAXII servers (MITRE ATT&CK TAXII, Anomali STAXX)\n- Optional: medallion for running a local TAXII 2.1 server\n\n## Key Concepts\n\n### TAXII 2.1 Architecture\n\nTAXII defines a RESTful API with three service types:\n- **Discovery**: Returns information about available API roots\n- **API Root**: Contains collections and serves as the main interaction point\n- **Collection**: A logical grouping of STIX objects accessible via GET\u002FPOST\n\n### STIX 2.1 Object Model\n\nSTIX objects are categorized as:\n- **SDOs (STIX Domain Objects)**: Indicator, Malware, Threat Actor, Campaign, Attack Pattern, Tool, Infrastructure, Vulnerability, Identity, Location, Note, Opinion, Report, Grouping\n- **SCOs (STIX Cyber Observables)**: IPv4-Addr, Domain-Name, URL, File, Email-Addr, Process, Network-Traffic, Artifact\n- **SROs (STIX Relationship Objects)**: Relationship, Sighting\n- **Meta Objects**: Marking Definition (TLP), Language Content, Extension Definition\n\n### STIX Bundle\n\nA Bundle is a collection of STIX objects transmitted together. Bundles have a unique ID and contain an array of objects. TAXII collections serve bundles in response to GET requests.\n\n## Workflow\n\n### Step 1: TAXII Server Discovery\n\n```python\nfrom taxii2client.v21 import Server, Collection, as_pages\n\n# Connect to MITRE ATT&CK TAXII server\nserver = Server(\"https:\u002F\u002Fcti-taxii.mitre.org\u002Ftaxii2\u002F\", user=\"\", password=\"\")\n\nprint(f\"Title: {server.title}\")\nprint(f\"Description: {server.description}\")\n\n# List API roots\nfor api_root in server.api_roots:\n    print(f\"\\nAPI Root: {api_root.title}\")\n    print(f\"  URL: {api_root.url}\")\n\n    # List collections\n    for collection in api_root.collections:\n        print(f\"  Collection: {collection.title} (ID: {collection.id})\")\n        print(f\"    Can Read: {collection.can_read}\")\n        print(f\"    Can Write: {collection.can_write}\")\n```\n\n### Step 2: Fetch STIX Objects from Collection\n\n```python\nfrom taxii2client.v21 import Collection, as_pages\nimport json\n\n# Connect to Enterprise ATT&CK collection\nENTERPRISE_ATTACK_ID = \"95ecc380-afe9-11e4-9b6c-751b66dd541e\"\ncollection = Collection(\n    f\"https:\u002F\u002Fcti-taxii.mitre.org\u002Fstix\u002Fcollections\u002F{ENTERPRISE_ATTACK_ID}\u002F\",\n    user=\"\",\n    password=\"\",\n)\n\nprint(f\"Collection: {collection.title}\")\n\n# Fetch all objects (paginated)\nall_objects = []\nfor envelope in as_pages(collection.get_objects, per_request=50):\n    objects = envelope.get(\"objects\", [])\n    all_objects.extend(objects)\n    print(f\"  Fetched {len(objects)} objects (total: {len(all_objects)})\")\n\nprint(f\"\\nTotal objects retrieved: {len(all_objects)}\")\n\n# Categorize by type\ntype_counts = {}\nfor obj in all_objects:\n    obj_type = obj.get(\"type\", \"unknown\")\n    type_counts[obj_type] = type_counts.get(obj_type, 0) + 1\n\nfor obj_type, count in sorted(type_counts.items()):\n    print(f\"  {obj_type}: {count}\")\n```\n\n### Step 3: Parse STIX 2.1 Objects with stix2 Library\n\n```python\nfrom stix2 import parse, Filter, MemoryStore\n\n# Load objects into a MemoryStore for querying\nstore = MemoryStore(stix_data=all_objects)\n\n# Query for all indicators\nindicators = store.query([Filter(\"type\", \"=\", \"indicator\")])\nprint(f\"Indicators: {len(indicators)}\")\n\nfor ind in indicators[:5]:\n    print(f\"  {ind.name}: {ind.pattern}\")\n\n# Query for malware\nmalware_list = store.query([Filter(\"type\", \"=\", \"malware\")])\nprint(f\"\\nMalware families: {len(malware_list)}\")\n\n# Query for threat actors\nactors = store.query([Filter(\"type\", \"=\", \"intrusion-set\")])\nprint(f\"Threat actors: {len(actors)}\")\n\n# Find relationships for a specific object\ndef get_related(store, source_id):\n    relationships = store.query([\n        Filter(\"type\", \"=\", \"relationship\"),\n        Filter(\"source_ref\", \"=\", source_id),\n    ])\n    return relationships\n\n# Example: Get all techniques used by APT28\napt28 = store.query([\n    Filter(\"type\", \"=\", \"intrusion-set\"),\n    Filter(\"name\", \"=\", \"APT28\"),\n])\nif apt28:\n    rels = get_related(store, apt28[0].id)\n    for rel in rels:\n        target = store.get(rel.target_ref)\n        if target:\n            print(f\"  {rel.relationship_type} -> {target.name} ({target.type})\")\n```\n\n### Step 4: Implement Custom TAXII Consumer\n\n```python\nfrom taxii2client.v21 import Collection, as_pages\nfrom stix2 import parse, Bundle\nfrom datetime import datetime, timedelta\nimport json\n\nclass TAXIIConsumer:\n    \"\"\"Consume STIX\u002FTAXII 2.1 feeds and extract IOCs.\"\"\"\n\n    def __init__(self, collection_url, user=\"\", password=\"\"):\n        self.collection = Collection(collection_url, user=user, password=password)\n        self.last_poll = None\n\n    def poll_new_objects(self, added_after=None):\n        \"\"\"Poll for objects added after a specific timestamp.\"\"\"\n        if added_after is None:\n            added_after = (\n                self.last_poll or\n                (datetime.utcnow() - timedelta(days=1)).strftime(\n                    \"%Y-%m-%dT%H:%M:%S.000Z\"\n                )\n            )\n\n        all_objects = []\n        kwargs = {\"added_after\": added_after}\n\n        for envelope in as_pages(\n            self.collection.get_objects, per_request=100, **kwargs\n        ):\n            objects = envelope.get(\"objects\", [])\n            all_objects.extend(objects)\n\n        self.last_poll = datetime.utcnow().strftime(\"%Y-%m-%dT%H:%M:%S.000Z\")\n        return all_objects\n\n    def extract_indicators(self, objects):\n        \"\"\"Extract actionable indicators from STIX objects.\"\"\"\n        indicators = []\n        for obj in objects:\n            if obj.get(\"type\") == \"indicator\":\n                indicators.append({\n                    \"id\": obj.get(\"id\"),\n                    \"name\": obj.get(\"name\", \"\"),\n                    \"pattern\": obj.get(\"pattern\", \"\"),\n                    \"pattern_type\": obj.get(\"pattern_type\", \"\"),\n                    \"valid_from\": obj.get(\"valid_from\", \"\"),\n                    \"valid_until\": obj.get(\"valid_until\", \"\"),\n                    \"indicator_types\": obj.get(\"indicator_types\", []),\n                    \"confidence\": obj.get(\"confidence\", 0),\n                    \"labels\": obj.get(\"labels\", []),\n                })\n        return indicators\n\n    def extract_observables(self, objects):\n        \"\"\"Extract STIX Cyber Observables.\"\"\"\n        observables = []\n        observable_types = {\n            \"ipv4-addr\", \"ipv6-addr\", \"domain-name\", \"url\",\n            \"file\", \"email-addr\", \"network-traffic\",\n        }\n        for obj in objects:\n            if obj.get(\"type\") in observable_types:\n                observables.append({\n                    \"type\": obj[\"type\"],\n                    \"value\": obj.get(\"value\", \"\"),\n                    \"id\": obj.get(\"id\"),\n                })\n        return observables\n\n\n# Usage\nconsumer = TAXIIConsumer(\n    f\"https:\u002F\u002Fcti-taxii.mitre.org\u002Fstix\u002Fcollections\u002F{ENTERPRISE_ATTACK_ID}\u002F\"\n)\nnew_objects = consumer.poll_new_objects()\nindicators = consumer.extract_indicators(new_objects)\nprint(f\"New indicators: {len(indicators)}\")\n```\n\n### Step 5: Set Up Local TAXII Server with Medallion\n\n```python\n# medallion configuration (medallion.conf)\nTAXII_CONFIG = {\n    \"backend\": {\n        \"module_class\": \"MemoryBackend\",\n    },\n    \"users\": {\n        \"admin\": \"admin_password\",\n        \"readonly\": \"readonly_password\",\n    },\n    \"taxii\": {\n        \"max_content_length\": 10485760,\n    },\n}\n\n# Run medallion server:\n# pip install medallion\n# python -m medallion --config medallion.conf --port 5000\n\n# Add objects to local TAXII server\nimport requests\n\ndef push_to_taxii(server_url, collection_id, stix_bundle, user, password):\n    \"\"\"Push STIX bundle to a TAXII 2.1 collection.\"\"\"\n    url = f\"{server_url}\u002Fcollections\u002F{collection_id}\u002Fobjects\u002F\"\n    headers = {\n        \"Content-Type\": \"application\u002Fstix+json;version=2.1\",\n        \"Accept\": \"application\u002Ftaxii+json;version=2.1\",\n    }\n    response = requests.post(\n        url,\n        json=stix_bundle,\n        headers=headers,\n        auth=(user, password),\n        timeout=30,\n    )\n    return response.json()\n```\n\n## Validation Criteria\n\n- TAXII server discovery returns valid API roots and collections\n- STIX objects fetched and parsed correctly from TAXII collections\n- Indicators extracted with valid STIX patterns\n- Pagination handled correctly for large collections\n- Consumer tracks polling state for incremental updates\n- Local TAXII server accepts and serves STIX bundles\n\n## References\n\n- [STIX 2.1 Specification](https:\u002F\u002Fdocs.oasis-open.org\u002Fcti\u002Fstix\u002Fv2.1\u002Fstix-v2.1.html)\n- [TAXII 2.1 Specification](https:\u002F\u002Fdocs.oasis-open.org\u002Fcti\u002Ftaxii\u002Fv2.1\u002Ftaxii-v2.1.html)\n- [taxii2-client PyPI](https:\u002F\u002Fpypi.org\u002Fproject\u002Ftaxii2-client\u002F)\n- [stix2 Python Library](https:\u002F\u002Fstix2.readthedocs.io\u002F)\n- [MITRE ATT&CK TAXII Server](https:\u002F\u002Fcti-taxii.mitre.org\u002Ftaxii2\u002F)\n- [Medallion TAXII Server](https:\u002F\u002Fgithub.com\u002Foasis-open\u002Fcti-taxii-server)\n",{"name":5,"tags":48,"author":50,"domain":41,"license":15,"version":51,"nist_csf":52,"subdomain":36,"description":7,"mitre_attack":57},[36,28,34,37,27,49,30,29],"taxii","mahipal","1.0",[53,54,55,56],"ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02",[58,59,60,61],"T1591","T1592","T1593","T1589","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fimplementing-stix-taxii-feed-integration",4395,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":73,"prompt":83,"zipAvailable":84},[74,77,80],{"tool":75,"command":76},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-stix-taxii-feed-integration",{"tool":78,"command":79},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-stix-taxii-feed-integration",{"tool":81,"command":82},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-stix-taxii-feed-integration","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-stix-taxii-feed-integration\u002FSKILL.md",true,[86,92,97,103,107,111,117],{"path":87,"resourceType":88,"resourceTypeDesc":89,"sizeBytes":90,"sourceHtmlUrl":91},"assets\u002Ftemplate.md","ASSET","资产文件",1236,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-stix-taxii-feed-integration\u002Fassets\u002Ftemplate.md",{"path":93,"resourceType":93,"resourceTypeDesc":94,"sizeBytes":95,"sourceHtmlUrl":96},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-stix-taxii-feed-integration\u002FLICENSE",{"path":98,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":101,"sourceHtmlUrl":102},"references\u002Fapi-reference.md","REFERENCE","参考文档",4813,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-stix-taxii-feed-integration\u002Freferences\u002Fapi-reference.md",{"path":104,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":105,"sourceHtmlUrl":106},"references\u002Fstandards.md",2876,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-stix-taxii-feed-integration\u002Freferences\u002Fstandards.md",{"path":108,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":109,"sourceHtmlUrl":110},"references\u002Fworkflows.md",2905,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-stix-taxii-feed-integration\u002Freferences\u002Fworkflows.md",{"path":112,"resourceType":113,"resourceTypeDesc":114,"sizeBytes":115,"sourceHtmlUrl":116},"scripts\u002Fagent.py","SCRIPT","脚本",11976,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-stix-taxii-feed-integration\u002Fscripts\u002Fagent.py",{"path":118,"resourceType":113,"resourceTypeDesc":114,"sizeBytes":119,"sourceHtmlUrl":120},"scripts\u002Fprocess.py",10969,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-stix-taxii-feed-integration\u002Fscripts\u002Fprocess.py",[122,149,173,201,227,254],{"skillNo":123,"name":124,"nameZh":6,"description":125,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":126,"categories":127,"keywords":129,"publishedAt":43},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[128],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[130,131,132,133,134,41,135,136,137,138,139,140,141,142,143,144,145,146,147,148],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","security","incident response","identity","pr","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":150,"name":151,"nameZh":6,"description":152,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":153,"categories":154,"keywords":156,"publishedAt":43},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[155],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[157,145,158,159,134,160,41,137,161,162,163,164,165,166,167,168,169,170,171,172],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":174,"name":175,"nameZh":6,"description":176,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":177,"categories":178,"keywords":183,"publishedAt":43},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[179,182],{"categoryNo":180,"categoryName":181,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[167,184,185,186,187,41,188,189,161,190,191,192,193,194,195,196,197,198,199,200],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":202,"name":203,"nameZh":6,"description":204,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":205,"categories":206,"keywords":208,"publishedAt":43},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[207],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[209,210,211,41,212,213,214,215,216,217,218,219,220,221,222,223,164,224,225,226],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":228,"name":229,"nameZh":6,"description":230,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":231,"categories":232,"keywords":234,"publishedAt":43},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[233],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[235,236,237,41,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":255,"name":256,"nameZh":6,"description":257,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":258,"categories":259,"keywords":261,"publishedAt":43},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[260],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[134,262,41,40,263,34,264,265,266,267,268,196,269,197,270,271,272,273,274,275],"triaging security incident","file","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]