Skip to main content
SOC Defenders exposes a TAXII 2.1 server that allows you to integrate the threat intelligence feed directly into SIEM platforms, threat intelligence platforms (TIPs), and custom tooling using the industry-standard TAXII protocol. TAXII (Trusted Automated eXchange of Intelligence Information) is defined by OASIS and is natively supported by tools such as Splunk, Microsoft Sentinel, IBM QRadar, and OpenCTI. Objects are served in STIX 2.1 format.
TAXII 2.1 access requires a Pro subscription. Upgrade your account at socdefenders.ai to enable this feature.

​
Protocol overview

TAXII 2.1 organises threat data into collections — named groups of STIX objects such as all IOCs, IP addresses only, file hashes, or CVEs. Clients discover the server’s API root, list available collections, and then poll individual collections for objects, optionally using the added_after parameter to retrieve only objects added since their last poll.

​
Discovery endpoint

Send a GET request to the discovery URL to retrieve the server’s title, description, contact information, and the API root URL you will use for all subsequent requests. Method: GET https://socdefenders.ai/api/taxii2/ Authentication: Required — pass your API key in the Authorization header as a Bearer token. Tier: Pro.

​
Example request

​
Example response

​
Response fields

​
string
Human-readable name of the TAXII server.
​
string
Description of the threat intelligence feed provided by this server.
​
string
Contact address for the server operator. Reach the SOC Defenders team at support@socdefenders.ai.
​
string
The default API root URL. Use this as the base URL for collections and object requests.
​
string[]
Array of API root URLs available on this server. Each root can have its own set of collections.

​
API root

All collection and object requests are made under the API root returned in the discovery response:
Proceed to Collections to list the available collections, or to Collection Objects to begin fetching STIX objects.