Integrating Threat Intelligence with SIEM and SOAR
Threat intelligence is only as valuable as the actions it enables. While human-readable reports are crucial for strategic planning, machine-readable intelligence is what actually stops attacks in real-time. Feeding your SIEM with a live TAXII feed is the most direct way to get there.
Enhancing the SIEM with CTI
Security Information and Event Management (SIEM) solutions like Microsoft Sentinel, Splunk, and Elastic are the central nervous system of the SOC. By piping structured Threat Intelligence directly into your SIEM, you can achieve:
- Real-time Correlation: Automatically matching incoming network traffic and endpoint logs against high-confidence malicious indicators.
- Alert Enrichment: Providing Tier 1 analysts with immediate context. Instead of just an "anomalous connection," the alert immediately details whether the IP is associated with a known APT group.
- Reduced Triage Time: Filtering out low-priority alerts by cross-referencing external intel on benign or noisy network scanners.
Which SIEMs Ingest TAXII Natively?
The good news: virtually every major SIEM ships with TAXII ingestion built in. Here's how the leading platforms handle it:
| Vendor / Platform | TAXII Support | Details |
|---|---|---|
| Microsoft Sentinel | Native, built-in | Built-in TAXII data connector acts as a native client, ingesting STIX indicators from TAXII 2.0 and 2.1 servers directly into the platform's threat intelligence tables for immediate use in analytics, workbooks, and hunting queries. |
| Splunk Enterprise Security | Native to ES, via Threat Intel Framework | Native Threat Intelligence Framework lets administrators configure, manage, and ingest TAXII feeds directly through the UI to drive automated correlation and alerting. |
| IBM QRadar | Supported, via official App | TAXII ingestion is managed via the official QRadar Threat Intelligence application. A centralized dashboard configures TAXII endpoints and automatically maps STIX observables to QRadar Reference Sets for seamless integration into correlation rules. |
| Elastic Security | Supported, via Custom TI Integration | Handles STIX/TAXII feeds through its Custom Threat Intelligence integration. Acting as a TAXII client, it establishes a polling pipeline that automatically standardizes incoming STIX data into the Elastic Common Schema (ECS) for real-time analysis. |
| Exabeam | Supported, via Cloud Collector | Ingests external threat data using its STIX/TAXII Cloud Collector. The platform natively polls TAXII endpoints to automatically generate indicator context tables that continuously inform and enrich its behavioral analytics engine. |
Wiring the Threat Landscape TAXII Feed
Pointing any of these platforms at the Threat Landscape TAXII server takes the same set of parameters:
| Parameter | Value |
|---|---|
| TAXII Server URL | https://api.threatlandscape.io/taxii2/ |
| Collection ID | 4c3b2a1d-5e6f-4a8b-8c0d-e1f2a3b4c5d6 (IOC Feed) |
| Collection ID | 91aae408-a1e4-4b3a-84b4-de6f7f6c52e6 (Intelligence Feed) |
| Authentication | HTTP Basic — username ignored, API key as password |
| Polling | Incremental after the first sync |
For SIEM correlation, start with the IOC Feed — lean, deduplicated indicator objects (IPs, domains, URLs, file hashes) with defined validity windows, ideal for matching against raw logs. If you also want context for enrichment, the Intelligence Feed adds the full STIX 2.1 object graph — threat actors, malware, campaigns, TTPs and relationships.
All feeds are delivered over standard HTTP Basic auth: the username is ignored, and your Threat Landscape API key goes in the password field. After the first sync, polling is incremental — the connector tracks where it left off, so you only pull what's new. Some TAXII clients expose this via the added_after parameter, using the X-TAXII-Date-Added-Last response header as the starting point for the next run.
Automating Response with SOAR
Security Orchestration, Automation, and Response (SOAR) tools take the enriched alerts from the SIEM and execute predefined playbooks. Adding CTI to this process ensures that automation is driven by verified, high-confidence data.
A typical integrated workflow looks like this:
- SIEM detects a connection to an unknown IP.
- SOAR automatically checks the TIP for the IP's reputation.
- If the TIP confirms the IP is a known C2 server, the SOAR automatically updates the perimeter firewall to block the connection and isolates the internal host.
Next Steps
SIEM ingestion covers detection, but endpoints need the same intelligence — see integrating Threat Intelligence with EDR. And if you also run a TIP, the identical feed powers your OpenCTI TAXII ingestion for the central knowledge graph.
The Threat Landscape API documents the full TAXII server reference, and the Threat Landscape Platform brings the same intelligence to life with its AI Assistant.