OpenCTI TAXII Feeds: How to Integrate Threat Intelligence via TAXII

OpenCTI doesn't only ingest intelligence through connectors — it also pulls data natively over TAXII 2.1, the standard protocol for sharing threat intelligence between platforms. Because the Threat Landscape TAXII server speaks the same protocol, you can wire a feed into OpenCTI in minutes, with no custom connector to deploy or maintain.

The Threat Landscape TAXII server is a read-only Collections Server compatible with any TAXII 2.1 client. It exposes two collections: the Intelligence Feed (full STIX 2.1 object graph) and the IOC Feed (indicator objects only). Every endpoint except discovery requires your Threat Landscape API key.

The Threat Landscape TAXII Server

The TAXII server is served from a single base URL:

https://api.threatlandscape.io/taxii2/

Each collection has its own ID, and you pick whichever matches your use case:

The Intelligence Feed delivers the full STIX 2.1 object graph — threat actors, groups and campaigns, malware families, victims and target sectors, CVEs, MITRE ATT&CK TTPs, reports, relationships and full source provenance. The IOC Feed delivers only deduplicated indicator objects with validity windows — perfect for feeding firewalls, SIEMs and blocklists.

Best Practices Before You Start

Before configuring the feed, OpenCTI recommends two practices to keep your environment secure and traceable:

• Create a dedicated user per source — create a user named [F] Threat Landscape and assign it to the Connectors group.
• Create a dedicated organization — create an organization named after the source and set it as the Default author on the feed.

This gives you clean rights management per source and clear traceability to each entity's creator — useful for source evaluation, dashboards and data filtering.

Adding the TAXII Feed in OpenCTI

In OpenCTI, go to Data > Ingestion > TAXII Feeds, click to create a new feed, and fill in the following:

OpenCTI finds the collections from the root automatically — you just paste the collection ID. If you've followed the best practices above, select [F] Threat Landscape as the user responsible for data creation. Leave Import from date empty to import the full historical dataset, or set a date to start from a specific point.

Choosing the Right Collection

Pick the Intelligence Feed when you want the full knowledge graph for correlation, enrichment and investigation in OpenCTI. Pick the IOC Feed when you want a lean, deduplicated stream of indicators — one per unique IOC value — without the surrounding context objects.

You can add both feeds as separate ingesters in OpenCTI. Each appears independently in the ingestion list, and you can manage, suspend, or export them individually.

Next Steps

The TAXII feed is the no-connector alternative to the setup described in OpenCTI Connectors — both land the same STIX 2.1 bundles in OpenCTI, just through different pipes. The same feed can also drive your endpoint defenses, as shown in integrating Threat Intelligence with EDR, and your SIEM and SOAR workflows for automated detection and response.