Cyber Threat Intelligence (STIX/TAXII Feed Integration)

Cyber Threat Intelligence integration in AIR enables you to ingest structured threat intelligence from STIX/TAXII-compatible feeds and operationalize it in investigation workflows.

The integration connects AIR to external TAXII 2.x servers, pulls STIX objects, parses indicators, and converts them into investigation-ready YARA, Sigma, and osquery hunt/triage rules.

Key capabilities

With Cyber Threat Intelligence integration, you can:

• Connect to TAXII 2.x compliant feeds (public or private)
• Discover available TAXII collections automatically
• Run scheduled or manual sync jobs
• Apply confidence filtering before rule generation
• Convert indicators into YARA, Sigma, and osquery hunt/triage rules
• Browse imported indicators and sync history in AIR

Supported authentication methods

You can configure feed access with:

• No authentication (for public feeds)
• Bearer token
• Basic authentication
• API key via custom header

Prerequisites

Before configuring a feed, verify the following:

• You have administrative access in AIR
• Your feed provider supports TAXII 2.x and STIX data
• You have the required feed credentials/tokens
• The Console can reach the feed endpoint over the network
• The Cyber Threat Intelligence integration feature is enabled in your environment

Recommended setup workflow

1. Add the TAXII feed URL and authentication details.
2. Test connection and load available collections.
3. Select collections to subscribe.
4. Configure conversion options per category.
5. Set sync strategy (manual or scheduled).
6. Run initial sync and review generated hunt/triage rules.

Supported indicator categories

The current parser supports these indicator categories:

• File hash
• File path
• Network address (IPv4/IPv6)
• Domain
• URL
• Email
• Registry key
• Mutex
• Process
• Direct YARA pattern
• Direct Sigma pattern

Rule generation and ownership modes

When content type is hunt/triage rules, imported indicators are converted into YARA, Sigma, or osquery content.

Mode	Behavior
Managed	Rules are maintained by the system and updated on sync cycles.
Snapshot	Rules are created as a point-in-time snapshot and are not overwritten by later sync updates.

Sync behavior

• Scheduled sync intervals support: 15, 30, 60, 120, 360, 720, 1440 minutes
• Manual sync is supported
• Sync logs are retained for recent runs and can be reviewed in the UI
• Incremental sync is used to reduce repeated data transfer

Current limitations

• TAXII 1.x is not supported
• Compound STIX patterns (for example AND / OR mixed observables) are not supported
• Feed ingestion is pull-based (no webhook/push mode)

Best practices

• Start with trusted collections and expand gradually
• Set a sensible confidence threshold to reduce noisy indicators
• Define clear ownership for feed maintenance and review
• For Snapshot mode, periodically remove low-value or stale feed sources and keep curated feeds only.

How conversion works in practice

During each sync, AIR processes incoming STIX objects and applies your collection-level configuration:

1. Pull indicators from selected TAXII collections.
2. Parse supported indicator patterns into internal categories.
3. Filter indicators by confidence threshold and supported pattern rules.
4. Group indicators by engine/category mapping.
5. Generate or update hunt/triage rules (YARA, Sigma, osquery).

In Managed mode, generated rules are maintained by sync cycles. In Snapshot mode, generated rules are preserved as point-in-time outputs.

FAQ

Why do I see fewer indicators than expected after sync?

This usually means one or more indicators were excluded by configuration or parser rules, for example:

• Confidence is below your minimum threshold
• Pattern type is unsupported for the current phase
• Indicator category is disabled in conversion settings
• Indicator has expired or is no longer available in the source collection

Why did some indicators not become rules?

Not every STIX object becomes a hunt/triage rule directly. Rule creation depends on:

• Supported indicator category
• Engine mapping in your collection configuration
• Search scope compatibility for the selected engine
• Rule size and batching limits in the current implementation

What is the difference between Managed and Snapshot modes?

• Managed: best for continuously updated feeds. Rules are updated by recurring sync jobs.
• Snapshot: best for one-time or controlled imports. Existing generated rules are not overwritten by later sync updates.

How often should I run sync jobs?

Use shorter intervals for high-priority operational feeds and longer intervals for low-volatility feeds. Supported scheduled intervals are 15, 30, 60, 120, 360, 720, and 1440 minutes.

Which authentication type should I choose?

• Use None for public feeds
• Use Bearer for token-based providers
• Use Basic when username/password is required
• Use API Key when provider expects a custom header

Always confirm the exact auth method and header format with your feed provider.

Is TAXII 1.x supported?

No. The current integration supports TAXII 2.x only.

Can I use webhook/push instead of polling?

Not in the current phase. Feed ingestion is pull-based through scheduled or manual sync.

Can I ingest every STIX pattern type?

No. Compound patterns (for example mixed AND / OR object conditions) are currently out of scope and can be skipped.