TAXII 2.1 Server

TAXII 2.1 Server — STIX 2.1 Threat Feed

A read-only TAXII 2.1 server that exposes this platform's own indicators as STIX 2.1 objects. Point any TAXII-aware consumer — OpenCTI, MISP, Anomali, a SIEM connector, or plain curl — at the discovery URL below and it can subscribe to and poll collections, instead of downloading one-shot files. All responses use application/taxii+json;version=2.1; object listings stream in bounded id-cursor pages and carry X-TAXII-Date-Added-First/Last headers. The server is read-only — write requests are refused (can_write:false).

Indicators

953.2K
total in database

STIX-mappable

915.9K
served as indicator SDOs

Collections

6
pollable feeds

Spec

2.1
TAXII & STIX

Discovery & Endpoints

Every TAXII client starts at the discovery endpoint:

Discovery
https://threats.quantus.biz/taxii2.php?path=%2Ftaxii2%2F
API Root
https://threats.quantus.biz/taxii2.php?path=%2Fapi%2F
Collections
https://threats.quantus.biz/taxii2.php?path=%2Fapi%2Fcollections%2F

Native TAXII clients expect path-based routing. On Apache add a rewrite so /taxii2/… maps to taxii2.php?path=/…; the query form above works everywhere (curl, scripts).

curl Example

No credentials required to read this feed.

# 1. Discover the server
curl -H 'Accept: application/taxii+json;version=2.1' \
  'https://threats.quantus.biz/taxii2.php?path=%2Ftaxii2%2F'

# 2. List collections
curl 'https://threats.quantus.biz/taxii2.php?path=%2Fapi%2Fcollections%2F'

# 3. Poll the "all" collection (STIX 2.1 envelope)
curl 'https://threats.quantus.biz/taxii2.php?path=%2Fapi%2Fcollections%2Fall%2Fobjects%2F&limit=5000'

# 4. Page with the returned "next" cursor
curl 'https://threats.quantus.biz/taxii2.php?path=%2Fapi%2Fcollections%2Fall%2Fobjects%2F&limit=5000&next=CURSOR'

# 5. Incremental poll (only new since a timestamp)
curl 'https://threats.quantus.biz/taxii2.php?path=%2Fapi%2Fcollections%2Fall%2Fobjects%2F&added_after=2026-08-06T16:19:19Z'

Collections

Each collection is pollable at …/api/collections/<id-or-alias>/objects/. You may address a collection by its stable UUID or its short alias.

TitleAliasCollection ID (UUID)ObjectsManifest
All Indicators
Every indicator of compromise in the platform, as STIX 2.1 indicator SDOs.
 all f1685744-25b9-5f7f-a615-4584cd95abf6
953.2K indicators
 objects → manifest →
IPv4 Indicators
Malicious IPv4 address indicators.
 ipv4 d413fa97-ab32-53a5-81ce-8088563793f9
440K indicators
 objects → manifest →
Domain Indicators
Malicious domain-name indicators.
 domain 05db15f2-3a66-52ac-bd3f-3d00f60b6020
347.8K indicators
 objects → manifest →
URL Indicators
Malicious URL indicators.
 url cd3238f3-094a-5e88-bb68-19174a5e9a9e
93.3K indicators
 objects → manifest →
File Hash Indicators
MD5 / SHA-1 / SHA-256 / SHA-512 file hash indicators.
 file b1db1305-0044-5a95-ba93-0892f5c33a88
34.8K indicators
 objects → manifest →
Email Indicators
Malicious email-address indicators.
 email 7ab9280d-8861-5c1f-afe8-eeaa431b77d6
0 indicators
 objects → manifest →

Response Shape

The objects endpoint returns a TAXII envelope. The first page also carries an identity SDO for this platform and a TLP marking-definition, so the feed is self-describing. Pagination is by next (an id cursor) with more:true while further pages remain. 

{
  "objects": [
    { "type": "identity", "spec_version": "2.1", ... },
    { "type": "marking-definition", "definition": {"tlp":"amber"}, ... },
    { "type": "indicator", "spec_version": "2.1",
      "pattern": "[ipv4-addr:value = '8.8.8.8']",
      "pattern_type": "stix", "confidence": 80, ... }
  ],
  "more": true,
  "next": "48213"
}

Query Parameters

limitMax objects per page (default 5000, cap 10000).
nextId cursor from the previous page's next value.
added_afterISO timestamp — only indicators first seen after it.
tlpwhite / green / amber / red marking (default amber).

Prefer one-shot downloads instead? See Export (STIX/MISP/CSV).

Workstation · Copilot · AI Skills · Automation · Playbooks · Lookups · Docs · Reports

🤖 AI Copilot

⚡ AI Skills

All SkillsResolveEnrichCorrelateSummarize

🔍 Lookup & Enrich

EnrichmentsPivotLink Analysis

📚 Docs & Reports

DocumentationGenerate ReportAPIPlatforms Hub

💡 Recommendations

⚙ Automation

Operations Center

Cron: 0 * * * * php /home/zaptf0zdggll/public_html/threats/cron.php

📜 Playbook

Open Response Playbook

🔗 Related Tools

Mission CommandAdvanced SearchOperations Center