[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6EVFMM5VYKMJMAZ26VG0S34":3,"skill-same:01M6EVFMM5VYKMJMAZ26VG0S34":120},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":63,"commitSha":64,"skillDirectory":65,"forksCount":14,"repositoryHtmlUrl":66,"repositoryHomepageUrl":67,"ownerHtmlUrl":68,"ownerBlogUrl":6,"ownerDescription":69,"updatedAt":70,"install":71,"resources":84},"01M6EVFMM5VYKMJMAZ26VG0S34","implementing-stix-taxii-feed-integration",null,"STIX (Structured Threat Information eXpression) and TAXII (Trusted Automated eXchange of Intelligence Information) are OASIS open standards for representing and transporting cyber threat intelligence.","henriquescastilho\u002Fmy-claude","henriquescastilho","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F153296945?v=4","01M6ESH7EXPXTH9CVQ4K16SRG8","Henrique Scheer","01M6ESH7JHEK2PTNNH4HEH787Z",0,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-stix-taxii-feed-integration\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"integration","stix","TAXII","implementing stix taxii feed integration","oasis","information","de","expression","id","exchange","standards","cm","open","cybersecurity","feed-integration","ioc","cti","threat-intelligence","mitre-attack","threat intelligence","2026-11-10 10:12:30",false,"---\nname: implementing-stix-taxii-feed-integration\ndescription: STIX (Structured Threat Information eXpression) and TAXII (Trusted Automated\n  eXchange of Intelligence Information) are OASIS open standards for representing\n  and transporting cyber threat intelligence.\ndomain: cybersecurity\nsubdomain: threat-intelligence\ntags:\n- threat-intelligence\n- cti\n- ioc\n- mitre-attack\n- stix\n- taxii\n- feed-integration\n- oasis\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- ID.RA-01\n- ID.RA-05\n- DE.CM-01\n- DE.AE-02\nmitre_attack:\n- T1591\n- T1592\n- T1593\n- T1589\n---\n# Implementing STIX\u002FTAXII Feed Integration\n\n## Overview\n\nSTIX (Structured Threat Information eXpression) and TAXII (Trusted Automated eXchange of Intelligence Information) are OASIS open standards for representing and transporting cyber threat intelligence. This skill covers implementing a STIX\u002FTAXII 2.1 feed consumer and producer using Python, configuring TAXII server discovery, collection management, polling for new intelligence, parsing STIX 2.1 objects, and integrating feeds into SIEM and TIP platforms.\n\n\n## When to Use\n\n- When deploying or configuring implementing stix taxii feed integration capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- Python 3.9+ with `taxii2-client`, `stix2`, `cti-taxii-client` libraries\n- Understanding of STIX 2.1 data model (SDOs, SCOs, SROs)\n- Understanding of TAXII 2.1 protocol (discovery, API roots, collections)\n- Network access to TAXII servers (MITRE ATT&CK TAXII, Anomali STAXX)\n- Optional: medallion for running a local TAXII 2.1 server\n\n## Key Concepts\n\n### TAXII 2.1 Architecture\n\nTAXII defines a RESTful API with three service types:\n- **Discovery**: Returns information about available API roots\n- **API Root**: Contains collections and serves as the main interaction point\n- **Collection**: A logical grouping of STIX objects accessible via GET\u002FPOST\n\n### STIX 2.1 Object Model\n\nSTIX objects are categorized as:\n- **SDOs (STIX Domain Objects)**: Indicator, Malware, Threat Actor, Campaign, Attack Pattern, Tool, Infrastructure, Vulnerability, Identity, Location, Note, Opinion, Report, Grouping\n- **SCOs (STIX Cyber Observables)**: IPv4-Addr, Domain-Name, URL, File, Email-Addr, Process, Network-Traffic, Artifact\n- **SROs (STIX Relationship Objects)**: Relationship, Sighting\n- **Meta Objects**: Marking Definition (TLP), Language Content, Extension Definition\n\n### STIX Bundle\n\nA Bundle is a collection of STIX objects transmitted together. Bundles have a unique ID and contain an array of objects. TAXII collections serve bundles in response to GET requests.\n\n## Workflow\n\n### Step 1: TAXII Server Discovery\n\n```python\nfrom taxii2client.v21 import Server, Collection, as_pages\n\n# Connect to MITRE ATT&CK TAXII server\nserver = Server(\"https:\u002F\u002Fcti-taxii.mitre.org\u002Ftaxii2\u002F\", user=\"\", password=\"\")\n\nprint(f\"Title: {server.title}\")\nprint(f\"Description: {server.description}\")\n\n# List API roots\nfor api_root in server.api_roots:\n    print(f\"\\nAPI Root: {api_root.title}\")\n    print(f\"  URL: {api_root.url}\")\n\n    # List collections\n    for collection in api_root.collections:\n        print(f\"  Collection: {collection.title} (ID: {collection.id})\")\n        print(f\"    Can Read: {collection.can_read}\")\n        print(f\"    Can Write: {collection.can_write}\")\n```\n\n### Step 2: Fetch STIX Objects from Collection\n\n```python\nfrom taxii2client.v21 import Collection, as_pages\nimport json\n\n# Connect to Enterprise ATT&CK collection\nENTERPRISE_ATTACK_ID = \"95ecc380-afe9-11e4-9b6c-751b66dd541e\"\ncollection = Collection(\n    f\"https:\u002F\u002Fcti-taxii.mitre.org\u002Fstix\u002Fcollections\u002F{ENTERPRISE_ATTACK_ID}\u002F\",\n    user=\"\",\n    password=\"\",\n)\n\nprint(f\"Collection: {collection.title}\")\n\n# Fetch all objects (paginated)\nall_objects = []\nfor envelope in as_pages(collection.get_objects, per_request=50):\n    objects = envelope.get(\"objects\", [])\n    all_objects.extend(objects)\n    print(f\"  Fetched {len(objects)} objects (total: {len(all_objects)})\")\n\nprint(f\"\\nTotal objects retrieved: {len(all_objects)}\")\n\n# Categorize by type\ntype_counts = {}\nfor obj in all_objects:\n    obj_type = obj.get(\"type\", \"unknown\")\n    type_counts[obj_type] = type_counts.get(obj_type, 0) + 1\n\nfor obj_type, count in sorted(type_counts.items()):\n    print(f\"  {obj_type}: {count}\")\n```\n\n### Step 3: Parse STIX 2.1 Objects with stix2 Library\n\n```python\nfrom stix2 import parse, Filter, MemoryStore\n\n# Load objects into a MemoryStore for querying\nstore = MemoryStore(stix_data=all_objects)\n\n# Query for all indicators\nindicators = store.query([Filter(\"type\", \"=\", \"indicator\")])\nprint(f\"Indicators: {len(indicators)}\")\n\nfor ind in indicators[:5]:\n    print(f\"  {ind.name}: {ind.pattern}\")\n\n# Query for malware\nmalware_list = store.query([Filter(\"type\", \"=\", \"malware\")])\nprint(f\"\\nMalware families: {len(malware_list)}\")\n\n# Query for threat actors\nactors = store.query([Filter(\"type\", \"=\", \"intrusion-set\")])\nprint(f\"Threat actors: {len(actors)}\")\n\n# Find relationships for a specific object\ndef get_related(store, source_id):\n    relationships = store.query([\n        Filter(\"type\", \"=\", \"relationship\"),\n        Filter(\"source_ref\", \"=\", source_id),\n    ])\n    return relationships\n\n# Example: Get all techniques used by APT28\napt28 = store.query([\n    Filter(\"type\", \"=\", \"intrusion-set\"),\n    Filter(\"name\", \"=\", \"APT28\"),\n])\nif apt28:\n    rels = get_related(store, apt28[0].id)\n    for rel in rels:\n        target = store.get(rel.target_ref)\n        if target:\n            print(f\"  {rel.relationship_type} -> {target.name} ({target.type})\")\n```\n\n### Step 4: Implement Custom TAXII Consumer\n\n```python\nfrom taxii2client.v21 import Collection, as_pages\nfrom stix2 import parse, Bundle\nfrom datetime import datetime, timedelta\nimport json\n\nclass TAXIIConsumer:\n    \"\"\"Consume STIX\u002FTAXII 2.1 feeds and extract IOCs.\"\"\"\n\n    def __init__(self, collection_url, user=\"\", password=\"\"):\n        self.collection = Collection(collection_url, user=user, password=password)\n        self.last_poll = None\n\n    def poll_new_objects(self, added_after=None):\n        \"\"\"Poll for objects added after a specific timestamp.\"\"\"\n        if added_after is None:\n            added_after = (\n                self.last_poll or\n                (datetime.utcnow() - timedelta(days=1)).strftime(\n                    \"%Y-%m-%dT%H:%M:%S.000Z\"\n                )\n            )\n\n        all_objects = []\n        kwargs = {\"added_after\": added_after}\n\n        for envelope in as_pages(\n            self.collection.get_objects, per_request=100, **kwargs\n        ):\n            objects = envelope.get(\"objects\", [])\n            all_objects.extend(objects)\n\n        self.last_poll = datetime.utcnow().strftime(\"%Y-%m-%dT%H:%M:%S.000Z\")\n        return all_objects\n\n    def extract_indicators(self, objects):\n        \"\"\"Extract actionable indicators from STIX objects.\"\"\"\n        indicators = []\n        for obj in objects:\n            if obj.get(\"type\") == \"indicator\":\n                indicators.append({\n                    \"id\": obj.get(\"id\"),\n                    \"name\": obj.get(\"name\", \"\"),\n                    \"pattern\": obj.get(\"pattern\", \"\"),\n                    \"pattern_type\": obj.get(\"pattern_type\", \"\"),\n                    \"valid_from\": obj.get(\"valid_from\", \"\"),\n                    \"valid_until\": obj.get(\"valid_until\", \"\"),\n                    \"indicator_types\": obj.get(\"indicator_types\", []),\n                    \"confidence\": obj.get(\"confidence\", 0),\n                    \"labels\": obj.get(\"labels\", []),\n                })\n        return indicators\n\n    def extract_observables(self, objects):\n        \"\"\"Extract STIX Cyber Observables.\"\"\"\n        observables = []\n        observable_types = {\n            \"ipv4-addr\", \"ipv6-addr\", \"domain-name\", \"url\",\n            \"file\", \"email-addr\", \"network-traffic\",\n        }\n        for obj in objects:\n            if obj.get(\"type\") in observable_types:\n                observables.append({\n                    \"type\": obj[\"type\"],\n                    \"value\": obj.get(\"value\", \"\"),\n                    \"id\": obj.get(\"id\"),\n                })\n        return observables\n\n\n# Usage\nconsumer = TAXIIConsumer(\n    f\"https:\u002F\u002Fcti-taxii.mitre.org\u002Fstix\u002Fcollections\u002F{ENTERPRISE_ATTACK_ID}\u002F\"\n)\nnew_objects = consumer.poll_new_objects()\nindicators = consumer.extract_indicators(new_objects)\nprint(f\"New indicators: {len(indicators)}\")\n```\n\n### Step 5: Set Up Local TAXII Server with Medallion\n\n```python\n# medallion configuration (medallion.conf)\nTAXII_CONFIG = {\n    \"backend\": {\n        \"module_class\": \"MemoryBackend\",\n    },\n    \"users\": {\n        \"admin\": \"admin_password\",\n        \"readonly\": \"readonly_password\",\n    },\n    \"taxii\": {\n        \"max_content_length\": 10485760,\n    },\n}\n\n# Run medallion server:\n# pip install medallion\n# python -m medallion --config medallion.conf --port 5000\n\n# Add objects to local TAXII server\nimport requests\n\ndef push_to_taxii(server_url, collection_id, stix_bundle, user, password):\n    \"\"\"Push STIX bundle to a TAXII 2.1 collection.\"\"\"\n    url = f\"{server_url}\u002Fcollections\u002F{collection_id}\u002Fobjects\u002F\"\n    headers = {\n        \"Content-Type\": \"application\u002Fstix+json;version=2.1\",\n        \"Accept\": \"application\u002Ftaxii+json;version=2.1\",\n    }\n    response = requests.post(\n        url,\n        json=stix_bundle,\n        headers=headers,\n        auth=(user, password),\n        timeout=30,\n    )\n    return response.json()\n```\n\n## Validation Criteria\n\n- TAXII server discovery returns valid API roots and collections\n- STIX objects fetched and parsed correctly from TAXII collections\n- Indicators extracted with valid STIX patterns\n- Pagination handled correctly for large collections\n- Consumer tracks polling state for incremental updates\n- Local TAXII server accepts and serves STIX bundles\n\n## References\n\n- [STIX 2.1 Specification](https:\u002F\u002Fdocs.oasis-open.org\u002Fcti\u002Fstix\u002Fv2.1\u002Fstix-v2.1.html)\n- [TAXII 2.1 Specification](https:\u002F\u002Fdocs.oasis-open.org\u002Fcti\u002Ftaxii\u002Fv2.1\u002Ftaxii-v2.1.html)\n- [taxii2-client PyPI](https:\u002F\u002Fpypi.org\u002Fproject\u002Ftaxii2-client\u002F)\n- [stix2 Python Library](https:\u002F\u002Fstix2.readthedocs.io\u002F)\n- [MITRE ATT&CK TAXII Server](https:\u002F\u002Fcti-taxii.mitre.org\u002Ftaxii2\u002F)\n- [Medallion TAXII Server](https:\u002F\u002Fgithub.com\u002Foasis-open\u002Fcti-taxii-server)\n","# Implementing STIX\u002FTAXII Feed Integration\n\n## Overview\n\nSTIX (Structured Threat Information eXpression) and TAXII (Trusted Automated eXchange of Intelligence Information) are OASIS open standards for representing and transporting cyber threat intelligence. This skill covers implementing a STIX\u002FTAXII 2.1 feed consumer and producer using Python, configuring TAXII server discovery, collection management, polling for new intelligence, parsing STIX 2.1 objects, and integrating feeds into SIEM and TIP platforms.\n\n\n## When to Use\n\n- When deploying or configuring implementing stix taxii feed integration capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- Python 3.9+ with `taxii2-client`, `stix2`, `cti-taxii-client` libraries\n- Understanding of STIX 2.1 data model (SDOs, SCOs, SROs)\n- Understanding of TAXII 2.1 protocol (discovery, API roots, collections)\n- Network access to TAXII servers (MITRE ATT&CK TAXII, Anomali STAXX)\n- Optional: medallion for running a local TAXII 2.1 server\n\n## Key Concepts\n\n### TAXII 2.1 Architecture\n\nTAXII defines a RESTful API with three service types:\n- **Discovery**: Returns information about available API roots\n- **API Root**: Contains collections and serves as the main interaction point\n- **Collection**: A logical grouping of STIX objects accessible via GET\u002FPOST\n\n### STIX 2.1 Object Model\n\nSTIX objects are categorized as:\n- **SDOs (STIX Domain Objects)**: Indicator, Malware, Threat Actor, Campaign, Attack Pattern, Tool, Infrastructure, Vulnerability, Identity, Location, Note, Opinion, Report, Grouping\n- **SCOs (STIX Cyber Observables)**: IPv4-Addr, Domain-Name, URL, File, Email-Addr, Process, Network-Traffic, Artifact\n- **SROs (STIX Relationship Objects)**: Relationship, Sighting\n- **Meta Objects**: Marking Definition (TLP), Language Content, Extension Definition\n\n### STIX Bundle\n\nA Bundle is a collection of STIX objects transmitted together. Bundles have a unique ID and contain an array of objects. TAXII collections serve bundles in response to GET requests.\n\n## Workflow\n\n### Step 1: TAXII Server Discovery\n\n```python\nfrom taxii2client.v21 import Server, Collection, as_pages\n\n# Connect to MITRE ATT&CK TAXII server\nserver = Server(\"https:\u002F\u002Fcti-taxii.mitre.org\u002Ftaxii2\u002F\", user=\"\", password=\"\")\n\nprint(f\"Title: {server.title}\")\nprint(f\"Description: {server.description}\")\n\n# List API roots\nfor api_root in server.api_roots:\n    print(f\"\\nAPI Root: {api_root.title}\")\n    print(f\"  URL: {api_root.url}\")\n\n    # List collections\n    for collection in api_root.collections:\n        print(f\"  Collection: {collection.title} (ID: {collection.id})\")\n        print(f\"    Can Read: {collection.can_read}\")\n        print(f\"    Can Write: {collection.can_write}\")\n```\n\n### Step 2: Fetch STIX Objects from Collection\n\n```python\nfrom taxii2client.v21 import Collection, as_pages\nimport json\n\n# Connect to Enterprise ATT&CK collection\nENTERPRISE_ATTACK_ID = \"95ecc380-afe9-11e4-9b6c-751b66dd541e\"\ncollection = Collection(\n    f\"https:\u002F\u002Fcti-taxii.mitre.org\u002Fstix\u002Fcollections\u002F{ENTERPRISE_ATTACK_ID}\u002F\",\n    user=\"\",\n    password=\"\",\n)\n\nprint(f\"Collection: {collection.title}\")\n\n# Fetch all objects (paginated)\nall_objects = []\nfor envelope in as_pages(collection.get_objects, per_request=50):\n    objects = envelope.get(\"objects\", [])\n    all_objects.extend(objects)\n    print(f\"  Fetched {len(objects)} objects (total: {len(all_objects)})\")\n\nprint(f\"\\nTotal objects retrieved: {len(all_objects)}\")\n\n# Categorize by type\ntype_counts = {}\nfor obj in all_objects:\n    obj_type = obj.get(\"type\", \"unknown\")\n    type_counts[obj_type] = type_counts.get(obj_type, 0) + 1\n\nfor obj_type, count in sorted(type_counts.items()):\n    print(f\"  {obj_type}: {count}\")\n```\n\n### Step 3: Parse STIX 2.1 Objects with stix2 Library\n\n```python\nfrom stix2 import parse, Filter, MemoryStore\n\n# Load objects into a MemoryStore for querying\nstore = MemoryStore(stix_data=all_objects)\n\n# Query for all indicators\nindicators = store.query([Filter(\"type\", \"=\", \"indicator\")])\nprint(f\"Indicators: {len(indicators)}\")\n\nfor ind in indicators[:5]:\n    print(f\"  {ind.name}: {ind.pattern}\")\n\n# Query for malware\nmalware_list = store.query([Filter(\"type\", \"=\", \"malware\")])\nprint(f\"\\nMalware families: {len(malware_list)}\")\n\n# Query for threat actors\nactors = store.query([Filter(\"type\", \"=\", \"intrusion-set\")])\nprint(f\"Threat actors: {len(actors)}\")\n\n# Find relationships for a specific object\ndef get_related(store, source_id):\n    relationships = store.query([\n        Filter(\"type\", \"=\", \"relationship\"),\n        Filter(\"source_ref\", \"=\", source_id),\n    ])\n    return relationships\n\n# Example: Get all techniques used by APT28\napt28 = store.query([\n    Filter(\"type\", \"=\", \"intrusion-set\"),\n    Filter(\"name\", \"=\", \"APT28\"),\n])\nif apt28:\n    rels = get_related(store, apt28[0].id)\n    for rel in rels:\n        target = store.get(rel.target_ref)\n        if target:\n            print(f\"  {rel.relationship_type} -> {target.name} ({target.type})\")\n```\n\n### Step 4: Implement Custom TAXII Consumer\n\n```python\nfrom taxii2client.v21 import Collection, as_pages\nfrom stix2 import parse, Bundle\nfrom datetime import datetime, timedelta\nimport json\n\nclass TAXIIConsumer:\n    \"\"\"Consume STIX\u002FTAXII 2.1 feeds and extract IOCs.\"\"\"\n\n    def __init__(self, collection_url, user=\"\", password=\"\"):\n        self.collection = Collection(collection_url, user=user, password=password)\n        self.last_poll = None\n\n    def poll_new_objects(self, added_after=None):\n        \"\"\"Poll for objects added after a specific timestamp.\"\"\"\n        if added_after is None:\n            added_after = (\n                self.last_poll or\n                (datetime.utcnow() - timedelta(days=1)).strftime(\n                    \"%Y-%m-%dT%H:%M:%S.000Z\"\n                )\n            )\n\n        all_objects = []\n        kwargs = {\"added_after\": added_after}\n\n        for envelope in as_pages(\n            self.collection.get_objects, per_request=100, **kwargs\n        ):\n            objects = envelope.get(\"objects\", [])\n            all_objects.extend(objects)\n\n        self.last_poll = datetime.utcnow().strftime(\"%Y-%m-%dT%H:%M:%S.000Z\")\n        return all_objects\n\n    def extract_indicators(self, objects):\n        \"\"\"Extract actionable indicators from STIX objects.\"\"\"\n        indicators = []\n        for obj in objects:\n            if obj.get(\"type\") == \"indicator\":\n                indicators.append({\n                    \"id\": obj.get(\"id\"),\n                    \"name\": obj.get(\"name\", \"\"),\n                    \"pattern\": obj.get(\"pattern\", \"\"),\n                    \"pattern_type\": obj.get(\"pattern_type\", \"\"),\n                    \"valid_from\": obj.get(\"valid_from\", \"\"),\n                    \"valid_until\": obj.get(\"valid_until\", \"\"),\n                    \"indicator_types\": obj.get(\"indicator_types\", []),\n                    \"confidence\": obj.get(\"confidence\", 0),\n                    \"labels\": obj.get(\"labels\", []),\n                })\n        return indicators\n\n    def extract_observables(self, objects):\n        \"\"\"Extract STIX Cyber Observables.\"\"\"\n        observables = []\n        observable_types = {\n            \"ipv4-addr\", \"ipv6-addr\", \"domain-name\", \"url\",\n            \"file\", \"email-addr\", \"network-traffic\",\n        }\n        for obj in objects:\n            if obj.get(\"type\") in observable_types:\n                observables.append({\n                    \"type\": obj[\"type\"],\n                    \"value\": obj.get(\"value\", \"\"),\n                    \"id\": obj.get(\"id\"),\n                })\n        return observables\n\n\n# Usage\nconsumer = TAXIIConsumer(\n    f\"https:\u002F\u002Fcti-taxii.mitre.org\u002Fstix\u002Fcollections\u002F{ENTERPRISE_ATTACK_ID}\u002F\"\n)\nnew_objects = consumer.poll_new_objects()\nindicators = consumer.extract_indicators(new_objects)\nprint(f\"New indicators: {len(indicators)}\")\n```\n\n### Step 5: Set Up Local TAXII Server with Medallion\n\n```python\n# medallion configuration (medallion.conf)\nTAXII_CONFIG = {\n    \"backend\": {\n        \"module_class\": \"MemoryBackend\",\n    },\n    \"users\": {\n        \"admin\": \"admin_password\",\n        \"readonly\": \"readonly_password\",\n    },\n    \"taxii\": {\n        \"max_content_length\": 10485760,\n    },\n}\n\n# Run medallion server:\n# pip install medallion\n# python -m medallion --config medallion.conf --port 5000\n\n# Add objects to local TAXII server\nimport requests\n\ndef push_to_taxii(server_url, collection_id, stix_bundle, user, password):\n    \"\"\"Push STIX bundle to a TAXII 2.1 collection.\"\"\"\n    url = f\"{server_url}\u002Fcollections\u002F{collection_id}\u002Fobjects\u002F\"\n    headers = {\n        \"Content-Type\": \"application\u002Fstix+json;version=2.1\",\n        \"Accept\": \"application\u002Ftaxii+json;version=2.1\",\n    }\n    response = requests.post(\n        url,\n        json=stix_bundle,\n        headers=headers,\n        auth=(user, password),\n        timeout=30,\n    )\n    return response.json()\n```\n\n## Validation Criteria\n\n- TAXII server discovery returns valid API roots and collections\n- STIX objects fetched and parsed correctly from TAXII collections\n- Indicators extracted with valid STIX patterns\n- Pagination handled correctly for large collections\n- Consumer tracks polling state for incremental updates\n- Local TAXII server accepts and serves STIX bundles\n\n## References\n\n- [STIX 2.1 Specification](https:\u002F\u002Fdocs.oasis-open.org\u002Fcti\u002Fstix\u002Fv2.1\u002Fstix-v2.1.html)\n- [TAXII 2.1 Specification](https:\u002F\u002Fdocs.oasis-open.org\u002Fcti\u002Ftaxii\u002Fv2.1\u002Ftaxii-v2.1.html)\n- [taxii2-client PyPI](https:\u002F\u002Fpypi.org\u002Fproject\u002Ftaxii2-client\u002F)\n- [stix2 Python Library](https:\u002F\u002Fstix2.readthedocs.io\u002F)\n- [MITRE ATT&CK TAXII Server](https:\u002F\u002Fcti-taxii.mitre.org\u002Ftaxii2\u002F)\n- [Medallion TAXII Server](https:\u002F\u002Fgithub.com\u002Foasis-open\u002Fcti-taxii-server)\n",{"name":5,"tags":49,"author":51,"domain":37,"license":15,"version":52,"nist_csf":53,"subdomain":41,"description":7,"mitre_attack":58},[41,40,39,42,25,50,38,28],"taxii","mahipal","1.0",[54,55,56,57],"ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02",[59,60,61,62],"T1591","T1592","T1593","T1589","main","7925716f065257435fdb12e97f7e52842147d5ad",".claude\u002Fskills\u002Fimplementing-stix-taxii-feed-integration","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude","https:\u002F\u002Fclaude.com\u002Fclaude-code","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho","Software · Applied AI · Quantitative Modeling · Building with Claude.","2026-06-10 12:24:46",{"source":8,"skillName":5,"commands":72,"prompt":82,"zipAvailable":83},[73,76,79],{"tool":74,"command":75},"npx","npx skills add henriquescastilho\u002Fmy-claude --skill implementing-stix-taxii-feed-integration",{"tool":77,"command":78},"bunx","bunx skills add henriquescastilho\u002Fmy-claude --skill implementing-stix-taxii-feed-integration",{"tool":80,"command":81},"pnpm","pnpm dlx skills add henriquescastilho\u002Fmy-claude --skill implementing-stix-taxii-feed-integration","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-stix-taxii-feed-integration\u002FSKILL.md",true,[85,91,96,102,106,110,116],{"path":86,"resourceType":87,"resourceTypeDesc":88,"sizeBytes":89,"sourceHtmlUrl":90},"assets\u002Ftemplate.md","ASSET","资产文件",1236,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-stix-taxii-feed-integration\u002Fassets\u002Ftemplate.md",{"path":92,"resourceType":92,"resourceTypeDesc":93,"sizeBytes":94,"sourceHtmlUrl":95},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-stix-taxii-feed-integration\u002FLICENSE",{"path":97,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":100,"sourceHtmlUrl":101},"references\u002Fapi-reference.md","REFERENCE","参考文档",4813,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-stix-taxii-feed-integration\u002Freferences\u002Fapi-reference.md",{"path":103,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":104,"sourceHtmlUrl":105},"references\u002Fstandards.md",2876,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-stix-taxii-feed-integration\u002Freferences\u002Fstandards.md",{"path":107,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":108,"sourceHtmlUrl":109},"references\u002Fworkflows.md",2905,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-stix-taxii-feed-integration\u002Freferences\u002Fworkflows.md",{"path":111,"resourceType":112,"resourceTypeDesc":113,"sizeBytes":114,"sourceHtmlUrl":115},"scripts\u002Fagent.py","SCRIPT","脚本",11976,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-stix-taxii-feed-integration\u002Fscripts\u002Fagent.py",{"path":117,"resourceType":112,"resourceTypeDesc":113,"sizeBytes":118,"sourceHtmlUrl":119},"scripts\u002Fprocess.py",10969,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-stix-taxii-feed-integration\u002Fscripts\u002Fprocess.py",[121,162,171,180,201,227],{"skillNo":122,"name":123,"nameZh":6,"description":124,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":125,"licenseFileUrl":6,"sourceHtmlUrl":126,"categories":127,"keywords":142,"publishedAt":44},"01M6F0B6XPQ65AX2X0DWK8KT3E","markitdown","Convert files and office documents to Markdown. Supports PDF, DOCX, PPTX, XLSX, images (with OCR), audio (with transcription), HTML, CSV, JSON, XML, ZIP, YouTube URLs, EPubs and more.","MIT","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[128,131,134,137],{"categoryNo":129,"categoryName":130,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000002","文档处理",{"categoryNo":132,"categoryName":133,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000003","演示文稿",{"categoryNo":135,"categoryName":136,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000004","电子表格",{"categoryNo":138,"categoryName":139,"taxonomyType":140,"taxonomyTypeDesc":141},"01JBSEEDCAT000000000000034","行政与办公人员","PROFESSION","适用职业",[123,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161],"docx","PDF","pptx","xlsx","documents","csv","ocr","Audio","Bash","markdown","convert","read","write","edit","html","images","files","youtube","with",{"skillNo":163,"name":123,"nameZh":6,"description":124,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":125,"licenseFileUrl":6,"sourceHtmlUrl":164,"categories":165,"keywords":170,"publishedAt":44},"01M6F06SBHR9F0SDWE282Y8075","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002Fscientific_writer\u002F.claude\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[166,167,168,169],{"categoryNo":129,"categoryName":130,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":132,"categoryName":133,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":135,"categoryName":136,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":138,"categoryName":139,"taxonomyType":140,"taxonomyTypeDesc":141},[123,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161],{"skillNo":172,"name":123,"nameZh":6,"description":124,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":125,"licenseFileUrl":6,"sourceHtmlUrl":173,"categories":174,"keywords":179,"publishedAt":44},"01M6F02D4R14EJAPBWVDF9J9VQ","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002F.claude\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[175,176,177,178],{"categoryNo":129,"categoryName":130,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":132,"categoryName":133,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":135,"categoryName":136,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":138,"categoryName":139,"taxonomyType":140,"taxonomyTypeDesc":141},[123,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161],{"skillNo":181,"name":182,"nameZh":6,"description":183,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":125,"licenseFileUrl":6,"sourceHtmlUrl":184,"categories":185,"keywords":186,"publishedAt":44},"01M6F000KS6YB4MKS774G4R8ND","zarr-python","Chunked N-D arrays for cloud storage. Compressed arrays, parallel I\u002FO, S3\u002FGCS integration, NumPy\u002FDask\u002FXarray compatible, for large-scale scientific computing pipelines.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fzarr-python\u002FSKILL.md",[],[187,188,189,24,190,191,192,193,194,195,196,197,198,199,200],"python","zarr python","storage","s3","gcs","cloud","dask","parallel","pipelines","arrays","numpy","scientific computing","scale","scientific",{"skillNo":202,"name":203,"nameZh":6,"description":204,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":125,"licenseFileUrl":6,"sourceHtmlUrl":205,"categories":206,"keywords":208,"publishedAt":44},"01M6EZZJWFXM1GR78KTW6J0DN8","what-if-oracle","Run structured What-If scenario analysis with multi-branch possibility exploration. Use this skill when the user asks speculative questions like \"what if...\", \"what would happen if...\", \"what are the possibilities\", \"explore scenarios\", \"scenario analysis\", \"possibility space\", \"what could go wrong\", \"best case \u002F worst case\", \"risk analysis\", \"contingency planning\", \"strategic options\", or any question about uncertain futures. Also trigger when the user faces a fork-in-the-road decision, wants to stress-test an idea, or needs to think through consequences before committing.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fwhat-if-oracle\u002FSKILL.md",[207],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[209,210,211,212,213,214,215,216,217,218,219,154,155,220,221,222,223,224,225,226],"oracle","what if oracle","go","run","ux","futures","analysis","explore","decision","branch","question","idea","exploration","options","stress-test","strategies","scenario","stress",{"skillNo":228,"name":229,"nameZh":6,"description":230,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":125,"licenseFileUrl":6,"sourceHtmlUrl":231,"categories":232,"keywords":243,"publishedAt":44},"01M6EZZCXAEB49RXGQCJX5E8GB","venue-templates","Access comprehensive LaTeX templates, formatting requirements, and submission guidelines for major scientific publication venues (Nature, Science, PLOS, IEEE, ACM), academic conferences (NeurIPS, ICML, CVPR, CHI), research posters, and grant proposals (NSF, NIH, DOE, DARPA). This skill should be used when preparing manuscripts for journal submission, conference papers, research posters, or grant proposals and need venue-specific formatting requirements and templates.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fvenue-templates\u002FSKILL.md",[233,236,239,240],{"categoryNo":234,"categoryName":235,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":237,"categoryName":238,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000021","资料检索与研究",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":241,"categoryName":242,"taxonomyType":140,"taxonomyTypeDesc":141},"01JBSEEDCAT000000000000036","内容创作者",[244,245,246,247,248,249,250,251,151,252,154,155,156,253,254,255,256,257,200,258],"templates","venue templates","research","guidelines","NeurIPS","ICML","LaTeX","science","access","proposals","Academic","requirements","formatting","journal","chi"]