Lion Cipher Lab

Stand up a TAXII 2.1 server and share threat intel (serve it, then pull it)

• Threat Intel Analyst
• Intermediate
• ~60 min
• Free · no account required

Why it matters

Consuming a threat feed is the easy half; being the one who SERVES it is where real sharing programs live. STIX is the agreed language for describing threats, but a STIX file sitting on your disk helps no one — it has to move, on a schedule, with access control, in a shape every partner's tooling already understands. That is TAXII: a small, boring HTTPS protocol that every compliant server exposes in the same shape, so any client can pull from any server. CISA's Automated Indicator Sharing, MISP, commercial platforms, ISACs, and MITRE's own ATT&CK feed all move data this way. Most analysts…

What you'll learn

• explaining the TAXII 2.1 data model end to end: a Discovery endpoint lists API Roots, an API Root holds Collections, a Collection holds STIX Objects, and clients poll (or add to) a collection's /objects
• telling STIX apart from TAXII — STIX is the data/language (the cargo), TAXII is the HTTP transport/protocol that moves it (the delivery van)
• running the OASIS reference TAXII 2.1 server `medallion` locally with its memory backend, protected by HTTP basic auth
• reading a TAXII server config: a backend, users for basic auth, and an API root that exposes a collection with can_read / can_write flags
• connecting the OASIS `taxii2-client` (taxii2client) to a discovery URL and enumerating api_roots and collections
• building a STIX 2.1 Indicator in code and ADDING it to a writable collection (the TAXII 2.1 add-objects envelope), then POLLING it back out
• filtering a poll by type, id, and added_after so a consumer pulls only what is new since last time (incremental polling)
• knowing the TAXII 2.1 content type application/taxii+json;version=2.1 and why a plain browser request to a TAXII URL is correctly rejected
• judging when running your OWN TAXII server is worth it (you're a producer sharing to partners/an ISAC, or feeding your own tools a normalized feed) versus just consuming existing feeds

Steps in this lab

1. STIX vs TAXII, and the four-level data model you're about to build
2. Set up: Python, a virtual environment, and the two OASIS libraries
3. Write the server's config — a backend, users, an API root, and a writable collection
4. Start medallion and confirm the discovery endpoint is live
5. Connect with taxii2-client and walk discovery -> api root -> collection
6. Build a STIX 2.1 Indicator and ADD it to your writable collection
7. POLL it back — and filter by type, id, and added_after
8. When to run your OWN TAXII server — and when not to

Open the full interactive lab →