[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71DYMP6N45VNJ9JFJT852EK":3,"skill-same:01M71DYMP6N45VNJ9JFJT852EK":91},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":64,"commitSha":65,"skillDirectory":66,"forksCount":14,"repositoryHtmlUrl":67,"repositoryHomepageUrl":6,"ownerHtmlUrl":68,"ownerBlogUrl":6,"ownerDescription":69,"updatedAt":70,"install":71,"resources":84},"01M71DYMP6N45VNJ9JFJT852EK","feeds-stix-audit",null,"STIX (Structured Threat Information eXpression) and TAXII (Trusted Automated eXchange of Intelligence Information) are OASIS open standards for representing and transporting cyber threat intelligence.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fintel\u002Ffeeds\u002Fstix\u002Faudit\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"audit","feeds stix audit","stix","feeds","sonnet","threat","intelligence","read","de","threat-intelligence","threat intelligence","mitre-attack","Bash","information","cybersecurity","open","expression","cm","oasis","feed-integration","2026-11-10 10:12:30",false,"---\nname: feeds-stix-audit\ndescription: STIX (Structured Threat Information eXpression) and TAXII (Trusted Automated eXchange of Intelligence Information) are OASIS open standards for representing and transporting cyber threat intelligence.\ndomain: cybersecurity\nsubdomain: threat-intelligence\ntags:\n- threat-intelligence\n- cti\n- ioc\n- mitre-attack\n- stix\n- taxii\n- feed-integration\n- oasis\nnist_csf:\n- ID.RA-01\n- ID.RA-05\n- DE.CM-01\n- DE.AE-02\nmodel: sonnet\nmaxTurns: 20\ntools: [Read, Bash, Glob, Grep]\nmitre_attack:\n- T1070\n- T1082\ncve:\n- CVE-2021-26855\ncapec: []\n---\n\n# Implementing STIX\u002FTAXII Feed Integration\n\n## Overview\n\nSTIX (Structured Threat Information eXpression) and TAXII (Trusted Automated eXchange of Intelligence Information) are OASIS open standards for representing and transporting cyber threat intelligence. This skill covers implementing a STIX\u002FTAXII 2.1 feed consumer and producer using Python, configuring TAXII server discovery, collection management, polling for new intelligence, parsing STIX 2.1 objects, and integrating feeds into SIEM and TIP platforms.\n\n\n## When to Use\n\n- When deploying or configuring implementing stix taxii feed integration capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- Python 3.9+ with `taxii2-client`, `stix2`, `cti-taxii-client` libraries\n- Understanding of STIX 2.1 data model (SDOs, SCOs, SROs)\n- Understanding of TAXII 2.1 protocol (discovery, API roots, collections)\n- Network access to TAXII servers (MITRE ATT&CK TAXII, Anomali STAXX)\n- Optional: medallion for running a local TAXII 2.1 server\n\n## Key Concepts\n\n### TAXII 2.1 Architecture\n\nTAXII defines a RESTful API with three service types:\n- **Discovery**: Returns information about available API roots\n- **API Root**: Contains collections and serves as the main interaction point\n- **Collection**: A logical grouping of STIX objects accessible via GET\u002FPOST\n\n### STIX 2.1 Object Model\n\nSTIX objects are categorized as:\n- **SDOs (STIX Domain Objects)**: Indicator, Malware, Threat Actor, Campaign, Attack Pattern, Tool, Infrastructure, Vulnerability, Identity, Location, Note, Opinion, Report, Grouping\n- **SCOs (STIX Cyber Observables)**: IPv4-Addr, Domain-Name, URL, File, Email-Addr, Process, Network-Traffic, Artifact\n- **SROs (STIX Relationship Objects)**: Relationship, Sighting\n- **Meta Objects**: Marking Definition (TLP), Language Content, Extension Definition\n\n### STIX Bundle\n\nA Bundle is a collection of STIX objects transmitted together. Bundles have a unique ID and contain an array of objects. TAXII collections serve bundles in response to GET requests.\n\n## Workflow\n\n### Step 1: TAXII Server Discovery\n\n```python\nfrom taxii2client.v21 import Server, Collection, as_pages\n\n# Connect to MITRE ATT&CK TAXII server\nserver = Server(\"https:\u002F\u002Fcti-taxii.mitre.org\u002Ftaxii2\u002F\", user=\"\", password=\"\")\n\nprint(f\"Title: {server.title}\")\nprint(f\"Description: {server.description}\")\n\n# List API roots\nfor api_root in server.api_roots:\n    print(f\"\\nAPI Root: {api_root.title}\")\n    print(f\"  URL: {api_root.url}\")\n\n    # List collections\n    for collection in api_root.collections:\n        print(f\"  Collection: {collection.title} (ID: {collection.id})\")\n        print(f\"    Can Read: {collection.can_read}\")\n        print(f\"    Can Write: {collection.can_write}\")\n```\n\n### Step 2: Fetch STIX Objects from Collection\n\n```python\nfrom taxii2client.v21 import Collection, as_pages\nimport json\n\n# Connect to Enterprise ATT&CK collection\nENTERPRISE_ATTACK_ID = \"95ecc380-afe9-11e4-9b6c-751b66dd541e\"\ncollection = Collection(\n    f\"https:\u002F\u002Fcti-taxii.mitre.org\u002Fstix\u002Fcollections\u002F{ENTERPRISE_ATTACK_ID}\u002F\",\n    user=\"\",\n    password=\"\",\n)\n\nprint(f\"Collection: {collection.title}\")\n\n# Fetch all objects (paginated)\nall_objects = []\nfor envelope in as_pages(collection.get_objects, per_request=50):\n    objects = envelope.get(\"objects\", [])\n    all_objects.extend(objects)\n    print(f\"  Fetched {len(objects)} objects (total: {len(all_objects)})\")\n\nprint(f\"\\nTotal objects retrieved: {len(all_objects)}\")\n\n# Categorize by type\ntype_counts = {}\nfor obj in all_objects:\n    obj_type = obj.get(\"type\", \"unknown\")\n    type_counts[obj_type] = type_counts.get(obj_type, 0) + 1\n\nfor obj_type, count in sorted(type_counts.items()):\n    print(f\"  {obj_type}: {count}\")\n```\n\n### Step 3: Parse STIX 2.1 Objects with stix2 Library\n\n```python\nfrom stix2 import parse, Filter, MemoryStore\n\n# Load objects into a MemoryStore for querying\nstore = MemoryStore(stix_data=all_objects)\n\n# Query for all indicators\nindicators = store.query([Filter(\"type\", \"=\", \"indicator\")])\nprint(f\"Indicators: {len(indicators)}\")\n\nfor ind in indicators[:5]:\n    print(f\"  {ind.name}: {ind.pattern}\")\n\n# Query for malware\nmalware_list = store.query([Filter(\"type\", \"=\", \"malware\")])\nprint(f\"\\nMalware families: {len(malware_list)}\")\n\n# Query for threat actors\nactors = store.query([Filter(\"type\", \"=\", \"intrusion-set\")])\nprint(f\"Threat actors: {len(actors)}\")\n\n# Find relationships for a specific object\ndef get_related(store, source_id):\n    relationships = store.query([\n        Filter(\"type\", \"=\", \"relationship\"),\n        Filter(\"source_ref\", \"=\", source_id),\n    ])\n    return relationships\n\n# Example: Get all techniques used by APT28\napt28 = store.query([\n    Filter(\"type\", \"=\", \"intrusion-set\"),\n    Filter(\"name\", \"=\", \"APT28\"),\n])\nif apt28:\n    rels = get_related(store, apt28[0].id)\n    for rel in rels:\n        target = store.get(rel.target_ref)\n        if target:\n            print(f\"  {rel.relationship_type} -> {target.name} ({target.type})\")\n```\n\n### Step 4: Implement Custom TAXII Consumer\n\n```python\nfrom taxii2client.v21 import Collection, as_pages\nfrom stix2 import parse, Bundle\nfrom datetime import datetime, timedelta\nimport json\n\nclass TAXIIConsumer:\n    \"\"\"Consume STIX\u002FTAXII 2.1 feeds and extract IOCs.\"\"\"\n\n    def __init__(self, collection_url, user=\"\", password=\"\"):\n        self.collection = Collection(collection_url, user=user, password=password)\n        self.last_poll = None\n\n    def poll_new_objects(self, added_after=None):\n        \"\"\"Poll for objects added after a specific timestamp.\"\"\"\n        if added_after is None:\n            added_after = (\n                self.last_poll or\n                (datetime.utcnow() - timedelta(days=1)).strftime(\n                    \"%Y-%m-%dT%H:%M:%S.000Z\"\n                )\n            )\n\n        all_objects = []\n        kwargs = {\"added_after\": added_after}\n\n        for envelope in as_pages(\n            self.collection.get_objects, per_request=100, **kwargs\n        ):\n            objects = envelope.get(\"objects\", [])\n            all_objects.extend(objects)\n\n        self.last_poll = datetime.utcnow().strftime(\"%Y-%m-%dT%H:%M:%S.000Z\")\n        return all_objects\n\n    def extract_indicators(self, objects):\n        \"\"\"Extract actionable indicators from STIX objects.\"\"\"\n        indicators = []\n        for obj in objects:\n            if obj.get(\"type\") == \"indicator\":\n                indicators.append({\n                    \"id\": obj.get(\"id\"),\n                    \"name\": obj.get(\"name\", \"\"),\n                    \"pattern\": obj.get(\"pattern\", \"\"),\n                    \"pattern_type\": obj.get(\"pattern_type\", \"\"),\n                    \"valid_from\": obj.get(\"valid_from\", \"\"),\n                    \"valid_until\": obj.get(\"valid_until\", \"\"),\n                    \"indicator_types\": obj.get(\"indicator_types\", []),\n                    \"confidence\": obj.get(\"confidence\", 0),\n                    \"labels\": obj.get(\"labels\", []),\n                })\n        return indicators\n\n    def extract_observables(self, objects):\n        \"\"\"Extract STIX Cyber Observables.\"\"\"\n        observables = []\n        observable_types = {\n            \"ipv4-addr\", \"ipv6-addr\", \"domain-name\", \"url\",\n            \"file\", \"email-addr\", \"network-traffic\",\n        }\n        for obj in objects:\n            if obj.get(\"type\") in observable_types:\n                observables.append({\n                    \"type\": obj[\"type\"],\n                    \"value\": obj.get(\"value\", \"\"),\n                    \"id\": obj.get(\"id\"),\n                })\n        return observables\n\n\n# Usage\nconsumer = TAXIIConsumer(\n    f\"https:\u002F\u002Fcti-taxii.mitre.org\u002Fstix\u002Fcollections\u002F{ENTERPRISE_ATTACK_ID}\u002F\"\n)\nnew_objects = consumer.poll_new_objects()\nindicators = consumer.extract_indicators(new_objects)\nprint(f\"New indicators: {len(indicators)}\")\n```\n\n### Step 5: Set Up Local TAXII Server with Medallion\n\n```python\n# medallion configuration (medallion.conf)\nTAXII_CONFIG = {\n    \"backend\": {\n        \"module_class\": \"MemoryBackend\",\n    },\n    \"users\": {\n        \"admin\": \"admin_password\",\n        \"readonly\": \"readonly_password\",\n    },\n    \"taxii\": {\n        \"max_content_length\": 10485760,\n    },\n}\n\n# Run medallion server:\n# pip install medallion\n# python -m medallion --config medallion.conf --port 5000\n\n# Add objects to local TAXII server\nimport requests\n\ndef push_to_taxii(server_url, collection_id, stix_bundle, user, password):\n    \"\"\"Push STIX bundle to a TAXII 2.1 collection.\"\"\"\n    url = f\"{server_url}\u002Fcollections\u002F{collection_id}\u002Fobjects\u002F\"\n    headers = {\n        \"Content-Type\": \"application\u002Fstix+json;version=2.1\",\n        \"Accept\": \"application\u002Ftaxii+json;version=2.1\",\n    }\n    response = requests.post(\n        url,\n        json=stix_bundle,\n        headers=headers,\n        auth=(user, password),\n        timeout=30,\n    )\n    return response.json()\n```\n\n## Validation Criteria\n\n- TAXII server discovery returns valid API roots and collections\n- STIX objects fetched and parsed correctly from TAXII collections\n- Indicators extracted with valid STIX patterns\n- Pagination handled correctly for large collections\n- Consumer tracks polling state for incremental updates\n- Local TAXII server accepts and serves STIX bundles\n\n## References\n\n- [STIX 2.1 Specification](https:\u002F\u002Fdocs.oasis-open.org\u002Fcti\u002Fstix\u002Fv2.1\u002Fstix-v2.1.html)\n- [TAXII 2.1 Specification](https:\u002F\u002Fdocs.oasis-open.org\u002Fcti\u002Ftaxii\u002Fv2.1\u002Ftaxii-v2.1.html)\n- [taxii2-client PyPI](https:\u002F\u002Fpypi.org\u002Fproject\u002Ftaxii2-client\u002F)\n- [stix2 Python Library](https:\u002F\u002Fstix2.readthedocs.io\u002F)\n- [MITRE ATT&CK TAXII Server](https:\u002F\u002Fcti-taxii.mitre.org\u002Ftaxii2\u002F)\n- [Medallion TAXII Server](https:\u002F\u002Fgithub.com\u002Foasis-open\u002Fcti-taxii-server)\n","# Implementing STIX\u002FTAXII Feed Integration\n\n## Overview\n\nSTIX (Structured Threat Information eXpression) and TAXII (Trusted Automated eXchange of Intelligence Information) are OASIS open standards for representing and transporting cyber threat intelligence. This skill covers implementing a STIX\u002FTAXII 2.1 feed consumer and producer using Python, configuring TAXII server discovery, collection management, polling for new intelligence, parsing STIX 2.1 objects, and integrating feeds into SIEM and TIP platforms.\n\n\n## When to Use\n\n- When deploying or configuring implementing stix taxii feed integration capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- Python 3.9+ with `taxii2-client`, `stix2`, `cti-taxii-client` libraries\n- Understanding of STIX 2.1 data model (SDOs, SCOs, SROs)\n- Understanding of TAXII 2.1 protocol (discovery, API roots, collections)\n- Network access to TAXII servers (MITRE ATT&CK TAXII, Anomali STAXX)\n- Optional: medallion for running a local TAXII 2.1 server\n\n## Key Concepts\n\n### TAXII 2.1 Architecture\n\nTAXII defines a RESTful API with three service types:\n- **Discovery**: Returns information about available API roots\n- **API Root**: Contains collections and serves as the main interaction point\n- **Collection**: A logical grouping of STIX objects accessible via GET\u002FPOST\n\n### STIX 2.1 Object Model\n\nSTIX objects are categorized as:\n- **SDOs (STIX Domain Objects)**: Indicator, Malware, Threat Actor, Campaign, Attack Pattern, Tool, Infrastructure, Vulnerability, Identity, Location, Note, Opinion, Report, Grouping\n- **SCOs (STIX Cyber Observables)**: IPv4-Addr, Domain-Name, URL, File, Email-Addr, Process, Network-Traffic, Artifact\n- **SROs (STIX Relationship Objects)**: Relationship, Sighting\n- **Meta Objects**: Marking Definition (TLP), Language Content, Extension Definition\n\n### STIX Bundle\n\nA Bundle is a collection of STIX objects transmitted together. Bundles have a unique ID and contain an array of objects. TAXII collections serve bundles in response to GET requests.\n\n## Workflow\n\n### Step 1: TAXII Server Discovery\n\n```python\nfrom taxii2client.v21 import Server, Collection, as_pages\n\n# Connect to MITRE ATT&CK TAXII server\nserver = Server(\"https:\u002F\u002Fcti-taxii.mitre.org\u002Ftaxii2\u002F\", user=\"\", password=\"\")\n\nprint(f\"Title: {server.title}\")\nprint(f\"Description: {server.description}\")\n\n# List API roots\nfor api_root in server.api_roots:\n    print(f\"\\nAPI Root: {api_root.title}\")\n    print(f\"  URL: {api_root.url}\")\n\n    # List collections\n    for collection in api_root.collections:\n        print(f\"  Collection: {collection.title} (ID: {collection.id})\")\n        print(f\"    Can Read: {collection.can_read}\")\n        print(f\"    Can Write: {collection.can_write}\")\n```\n\n### Step 2: Fetch STIX Objects from Collection\n\n```python\nfrom taxii2client.v21 import Collection, as_pages\nimport json\n\n# Connect to Enterprise ATT&CK collection\nENTERPRISE_ATTACK_ID = \"95ecc380-afe9-11e4-9b6c-751b66dd541e\"\ncollection = Collection(\n    f\"https:\u002F\u002Fcti-taxii.mitre.org\u002Fstix\u002Fcollections\u002F{ENTERPRISE_ATTACK_ID}\u002F\",\n    user=\"\",\n    password=\"\",\n)\n\nprint(f\"Collection: {collection.title}\")\n\n# Fetch all objects (paginated)\nall_objects = []\nfor envelope in as_pages(collection.get_objects, per_request=50):\n    objects = envelope.get(\"objects\", [])\n    all_objects.extend(objects)\n    print(f\"  Fetched {len(objects)} objects (total: {len(all_objects)})\")\n\nprint(f\"\\nTotal objects retrieved: {len(all_objects)}\")\n\n# Categorize by type\ntype_counts = {}\nfor obj in all_objects:\n    obj_type = obj.get(\"type\", \"unknown\")\n    type_counts[obj_type] = type_counts.get(obj_type, 0) + 1\n\nfor obj_type, count in sorted(type_counts.items()):\n    print(f\"  {obj_type}: {count}\")\n```\n\n### Step 3: Parse STIX 2.1 Objects with stix2 Library\n\n```python\nfrom stix2 import parse, Filter, MemoryStore\n\n# Load objects into a MemoryStore for querying\nstore = MemoryStore(stix_data=all_objects)\n\n# Query for all indicators\nindicators = store.query([Filter(\"type\", \"=\", \"indicator\")])\nprint(f\"Indicators: {len(indicators)}\")\n\nfor ind in indicators[:5]:\n    print(f\"  {ind.name}: {ind.pattern}\")\n\n# Query for malware\nmalware_list = store.query([Filter(\"type\", \"=\", \"malware\")])\nprint(f\"\\nMalware families: {len(malware_list)}\")\n\n# Query for threat actors\nactors = store.query([Filter(\"type\", \"=\", \"intrusion-set\")])\nprint(f\"Threat actors: {len(actors)}\")\n\n# Find relationships for a specific object\ndef get_related(store, source_id):\n    relationships = store.query([\n        Filter(\"type\", \"=\", \"relationship\"),\n        Filter(\"source_ref\", \"=\", source_id),\n    ])\n    return relationships\n\n# Example: Get all techniques used by APT28\napt28 = store.query([\n    Filter(\"type\", \"=\", \"intrusion-set\"),\n    Filter(\"name\", \"=\", \"APT28\"),\n])\nif apt28:\n    rels = get_related(store, apt28[0].id)\n    for rel in rels:\n        target = store.get(rel.target_ref)\n        if target:\n            print(f\"  {rel.relationship_type} -> {target.name} ({target.type})\")\n```\n\n### Step 4: Implement Custom TAXII Consumer\n\n```python\nfrom taxii2client.v21 import Collection, as_pages\nfrom stix2 import parse, Bundle\nfrom datetime import datetime, timedelta\nimport json\n\nclass TAXIIConsumer:\n    \"\"\"Consume STIX\u002FTAXII 2.1 feeds and extract IOCs.\"\"\"\n\n    def __init__(self, collection_url, user=\"\", password=\"\"):\n        self.collection = Collection(collection_url, user=user, password=password)\n        self.last_poll = None\n\n    def poll_new_objects(self, added_after=None):\n        \"\"\"Poll for objects added after a specific timestamp.\"\"\"\n        if added_after is None:\n            added_after = (\n                self.last_poll or\n                (datetime.utcnow() - timedelta(days=1)).strftime(\n                    \"%Y-%m-%dT%H:%M:%S.000Z\"\n                )\n            )\n\n        all_objects = []\n        kwargs = {\"added_after\": added_after}\n\n        for envelope in as_pages(\n            self.collection.get_objects, per_request=100, **kwargs\n        ):\n            objects = envelope.get(\"objects\", [])\n            all_objects.extend(objects)\n\n        self.last_poll = datetime.utcnow().strftime(\"%Y-%m-%dT%H:%M:%S.000Z\")\n        return all_objects\n\n    def extract_indicators(self, objects):\n        \"\"\"Extract actionable indicators from STIX objects.\"\"\"\n        indicators = []\n        for obj in objects:\n            if obj.get(\"type\") == \"indicator\":\n                indicators.append({\n                    \"id\": obj.get(\"id\"),\n                    \"name\": obj.get(\"name\", \"\"),\n                    \"pattern\": obj.get(\"pattern\", \"\"),\n                    \"pattern_type\": obj.get(\"pattern_type\", \"\"),\n                    \"valid_from\": obj.get(\"valid_from\", \"\"),\n                    \"valid_until\": obj.get(\"valid_until\", \"\"),\n                    \"indicator_types\": obj.get(\"indicator_types\", []),\n                    \"confidence\": obj.get(\"confidence\", 0),\n                    \"labels\": obj.get(\"labels\", []),\n                })\n        return indicators\n\n    def extract_observables(self, objects):\n        \"\"\"Extract STIX Cyber Observables.\"\"\"\n        observables = []\n        observable_types = {\n            \"ipv4-addr\", \"ipv6-addr\", \"domain-name\", \"url\",\n            \"file\", \"email-addr\", \"network-traffic\",\n        }\n        for obj in objects:\n            if obj.get(\"type\") in observable_types:\n                observables.append({\n                    \"type\": obj[\"type\"],\n                    \"value\": obj.get(\"value\", \"\"),\n                    \"id\": obj.get(\"id\"),\n                })\n        return observables\n\n\n# Usage\nconsumer = TAXIIConsumer(\n    f\"https:\u002F\u002Fcti-taxii.mitre.org\u002Fstix\u002Fcollections\u002F{ENTERPRISE_ATTACK_ID}\u002F\"\n)\nnew_objects = consumer.poll_new_objects()\nindicators = consumer.extract_indicators(new_objects)\nprint(f\"New indicators: {len(indicators)}\")\n```\n\n### Step 5: Set Up Local TAXII Server with Medallion\n\n```python\n# medallion configuration (medallion.conf)\nTAXII_CONFIG = {\n    \"backend\": {\n        \"module_class\": \"MemoryBackend\",\n    },\n    \"users\": {\n        \"admin\": \"admin_password\",\n        \"readonly\": \"readonly_password\",\n    },\n    \"taxii\": {\n        \"max_content_length\": 10485760,\n    },\n}\n\n# Run medallion server:\n# pip install medallion\n# python -m medallion --config medallion.conf --port 5000\n\n# Add objects to local TAXII server\nimport requests\n\ndef push_to_taxii(server_url, collection_id, stix_bundle, user, password):\n    \"\"\"Push STIX bundle to a TAXII 2.1 collection.\"\"\"\n    url = f\"{server_url}\u002Fcollections\u002F{collection_id}\u002Fobjects\u002F\"\n    headers = {\n        \"Content-Type\": \"application\u002Fstix+json;version=2.1\",\n        \"Accept\": \"application\u002Ftaxii+json;version=2.1\",\n    }\n    response = requests.post(\n        url,\n        json=stix_bundle,\n        headers=headers,\n        auth=(user, password),\n        timeout=30,\n    )\n    return response.json()\n```\n\n## Validation Criteria\n\n- TAXII server discovery returns valid API roots and collections\n- STIX objects fetched and parsed correctly from TAXII collections\n- Indicators extracted with valid STIX patterns\n- Pagination handled correctly for large collections\n- Consumer tracks polling state for incremental updates\n- Local TAXII server accepts and serves STIX bundles\n\n## References\n\n- [STIX 2.1 Specification](https:\u002F\u002Fdocs.oasis-open.org\u002Fcti\u002Fstix\u002Fv2.1\u002Fstix-v2.1.html)\n- [TAXII 2.1 Specification](https:\u002F\u002Fdocs.oasis-open.org\u002Fcti\u002Ftaxii\u002Fv2.1\u002Ftaxii-v2.1.html)\n- [taxii2-client PyPI](https:\u002F\u002Fpypi.org\u002Fproject\u002Ftaxii2-client\u002F)\n- [stix2 Python Library](https:\u002F\u002Fstix2.readthedocs.io\u002F)\n- [MITRE ATT&CK TAXII Server](https:\u002F\u002Fcti-taxii.mitre.org\u002Ftaxii2\u002F)\n- [Medallion TAXII Server](https:\u002F\u002Fgithub.com\u002Foasis-open\u002Fcti-taxii-server)\n",{"cve":44,"name":5,"tags":46,"capec":50,"model":23,"tools":51,"domain":33,"maxTurns":55,"nist_csf":56,"subdomain":28,"description":7,"mitre_attack":61},[45],"CVE-2021-26855",[28,47,48,30,21,49,38,37],"cti","ioc","taxii",[],[52,31,53,54],"Read","Glob","Grep",20,[57,58,59,60],"ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02",[62,63],"T1070","T1082","main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Fintel\u002Ffeeds\u002Fstix\u002Faudit","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":72,"prompt":82,"zipAvailable":83},[73,76,79],{"tool":74,"command":75},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill feeds-stix-audit",{"tool":77,"command":78},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill feeds-stix-audit",{"tool":80,"command":81},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill feeds-stix-audit","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fintel\u002Ffeeds\u002Fstix\u002Faudit\u002FSKILL.md",true,[85],{"path":86,"resourceType":87,"resourceTypeDesc":88,"sizeBytes":89,"sourceHtmlUrl":90},"index.json","REFERENCE","参考文档",659,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fintel\u002Ffeeds\u002Fstix\u002Faudit\u002Findex.json",[92,115,136,157,179,195],{"skillNo":93,"name":94,"nameZh":6,"description":95,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":96,"categories":97,"keywords":98,"publishedAt":39},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[99,100,101,102,103,27,36,104,105,106,107,108,109,110,111,112,113,33,114],"services","detect","services wmi persistence detect","wmi","persistence","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":116,"name":117,"nameZh":6,"description":118,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":119,"categories":120,"keywords":121,"publishedAt":39},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[122,99,123,102,124,125,126,33,31,127,128,129,130,131,27,132,133,26,134,135],"exploit","services wmi exec exploit","exec","remote","traffic","analysis","team","across","crackmapexec","native","command","lateral movement","lateral-movement","Impacket",{"skillNo":137,"name":138,"nameZh":6,"description":139,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":140,"categories":141,"keywords":142,"publishedAt":39},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[143,144,145,146,147,148,33,31,149,127,150,151,27,26,152,153,154,155,156,23],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper",{"skillNo":158,"name":159,"nameZh":6,"description":160,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":161,"categories":162,"keywords":163,"publishedAt":39},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[100,164,165,166,167,168,169,36,170,33,114,171,172,173,174,175,176,177,178,27],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":180,"name":181,"nameZh":6,"description":182,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":183,"categories":184,"keywords":185,"publishedAt":39},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[186,187,100,188,166,168,189,36,190,170,33,114,127,191,192,193,194,178,27,104],"thread","processes thread injection detect","injection","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":196,"name":197,"nameZh":6,"description":198,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":199,"categories":200,"keywords":201,"publishedAt":39},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[202,100,166,203,189,36,204,205,33,114,206,207,208,209,210,211,27,104,212,213],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]