Skip to main content
Tag

TAXII

5 articles on TAXII.

← All blog posts
IOC Expiration: When to Remove an IP From a Blocklist
Threat Intel2026-09-09

IOC Expiration: When to Remove an IP From a Blocklist

Manage IOC expiration with separate DNS, evidence and STIX validity clocks. Review stale IP blocks, process withdrawals and preserve the audit trail.

6 min read
TAXII Threat Feeds: Build a Continuous SIEM Integration
Threat Intel2026-09-02

TAXII Threat Feeds: Build a Continuous SIEM Integration

Connect an isMalicious TAXII collection to your SIEM with safe pagination, durable checkpoints, validation, monitoring, and recovery.

6 min read
STIX/TAXII Threat Feeds: Operational Guide for OpenCTI, MISP, and SIEM Pipelines
Threat Intel2026-08-20

STIX/TAXII Threat Feeds: Operational Guide for OpenCTI, MISP, and SIEM Pipelines

How to wire STIX 2.1 and TAXII 2.1 collections into OpenCTI, MISP, or your SIEM — what to poll, how to handle confidence and aging indicators, and where enrichment APIs fit alongside feed ingestion.

9 min read
Threat Intelligence Platforms: Architecture, Data Quality, and High-Signal Feeds
Threat Intel2026-04-26

Threat Intelligence Platforms: Architecture, Data Quality, and High-Signal Feeds

Design TIPs and intel pipelines that scale: normalization, confidence scoring, deduplication, API-first delivery, and how to pair platform investments with analyst workflows.

8 min read
Building IOC Pipelines: From Raw Indicators to Operational Threat Intelligence in 2026
Threat Intel2026-04-26

Building IOC Pipelines: From Raw Indicators to Operational Threat Intelligence in 2026

A practical engineering guide to building indicator of compromise (IOC) pipelines—ingestion, normalization, deduplication, enrichment, scoring, distribution, and feedback—to turn raw threat feeds into operational defense.

10 min read