OpenTAXII

OpenTAXII serves as a TAXII (Trusted Automated eXchange of Indicator Information) server implementation designed for sharing cyber threat intelligence. Developed by EclecticIQ, it offers a comprehensive feature set including API root and collection management, user account handling, and content synchronization capabilities. The tool is built on well-designed Python applications, ensuring compatibility with standard TAXII clients like Cabby.

Use cases include setting up private or public TAXII 2.0 servers for distributing STIX-formatted threat intelligence within organizations or across trusted communities. Administrators can create API roots, collections with read/write permissions, manage user accounts with admin privileges, and perform data cleanup operations. The package also includes documentation for common usage.

Key components include CLI utilities for adding API roots and collections, account creation and updates, content block deletion, and data synchronization from YAML configurations, making it suitable for automated threat feed management in security operations centers.

OpenTAXII operates as a Flask-based web application implementing TAXII 2.0 protocols for serving STIX 2 content through API roots and collections. It uses SQLAlchemy for database persistence, libtaxii for TAXII message handling, and structlog for logging. Authentication is managed via a custom Auth API, supporting username/password accounts with admin roles. Content blocks are timestamp-labeled for time-windowed deletions, and public read/write access can be enabled on collections. Synchronization from YAML configs populates services, collections, and accounts, with optional force-deletion of undefined collections.