Our CTI now talks STIX 2.1 over a real TAXII 2.1 server.
We kept getting the same question from members running MISP or OpenCTI: "can we just pull this over TAXII instead of hitting your REST API?" So we built it. Discovery, collections, pull, and — new this release — push, all in STIX 2.1.
We adapted to the standard everyone else already built for
Most of the Alliance's data has always been reachable through our own REST endpoints, and honestly that's still the fastest way to get a Crime Score for a single IP. But if you already run a threat intel platform — MISP, OpenCTI, Anomali, ThreatConnect, whatever your team standardised on — those tools expect to speak STIX 2.1 over TAXII 2.1, not a bespoke JSON schema. Writing and maintaining a custom parser for every member's platform doesn't scale. The server sits alongside the existing REST API and the older STIX 2.0 endpoint — nothing was ripped out, we just added the plumbing most CTI tooling already expects.
Standard TAXII 2.1 discovery-to-object walk
If your client already talks TAXII, this should just work — that was the point.
GET /taxii2/ | Discovery — server metadata and the API root. No auth required. |
GET /taxii2/onefirewall/ | API root — version and capability info for the OneFirewall root. |
GET /taxii2/onefirewall/collections/ | Lists the three live collections: IP, domain, and URL indicators. |
GET /collections/{id}/objects/ | Paginated STIX 2.1 Indicators. Supports added_after, limit, next. |
POST /collections/{id}/objects/ | Push — submit up to 50 STIX 2.1 Indicators. New this release. |
GET /collections/{id}/manifest/ | Lightweight change-detection metadata, without pulling full objects. |
STIX and TAXII FAQ
What is STIX 2.1?
STIX 2.1 is the OASIS standard language and serialisation format for describing cyber threat intelligence, so organisations and tools can exchange it consistently.
What is TAXII 2.1?
TAXII 2.1 is the OASIS application protocol for transporting STIX intelligence. OneFirewall's TAXII 2.1 server supports discovery, collections, pull and push.
Which tools can connect?
Platforms such as MISP, OpenCTI, Anomali and ThreatConnect, or any TAXII-compatible client, can connect. Discovery calls need no authentication; other calls use the JWT or Basic Auth credentials you already have.
Is the older REST API still available?
Yes. The TAXII server sits alongside the existing REST API and the STIX 2.0 endpoint, so existing integrations keep working.