STIX TAXII: 1.x Service

Endpoint

https://api.recordedfuture.com/taxii

The TAXII 1.x service conforms to the TAXII HTTPS 1.0 and TAXII XML 1.1 message binding standards. All responses are in STIX 1.1.1 XML format.

Authentication

Requests must include one of:

HTTP Basic Auth — any username with your Recorded Future API token as the password
X-RFToken header — your API token passed directly in the X-RFToken request header

Supported services

The following TAXII services are available (as per the OASIS TAXII standard):

Service	Description
Discovery	Returns information about the available services on the TAXII server
Collection Management	Returns information about the available collections
Poll	Returns indicators from a specified collection

The Inbox service is not supported — this is a read-only feed.

Collections

The service provides 280 collections organized by IOC type. Each collection corresponds to either a full/large risk list or a specific risk rule sub-list.

IOC Type	Collections	Includes
IP addresses	92	`ip_full` (default), `ip_large`, plus 90 individual risk rule lists
Domains	80	`domain_full` (default), `domain_large`, plus 78 individual risk rule lists
Vulnerabilities	44	`vulnerability_full` (default), `vulnerability_large`, plus 42 individual risk rule lists
URLs	42	`url_full` (default), `url_large`, plus 40 individual risk rule lists
Hashes	22	`hash_full` (default), `hash_large`, plus 20 individual risk rule lists

Each sub risk list includes all indicators that match a single risk rule (e.g., ip_actively_communicating_cc_server contains only IPs triggering that specific rule). The _full lists aggregate all risk-scored indicators for that IOC type. The _large lists use a lower risk threshold and contain significantly more records.

These risk lists are available as TAXII Data Sets. TAXII Data Feeds are not supported.

Example calls

Using libtaxii scripts:

Discover available services:

discovery_client \
  --url https://api.recordedfuture.com/taxii/ \
  --user [username] \
  --pass [API Token]

List available collections:

collection_information_client \
  --url https://api.recordedfuture.com/taxii \
  --user [username] \
  --pass [API Token]

Poll a collection for indicators:

poll_client \
  --url https://api.recordedfuture.com/taxii \
  --user [username] \
  --pass [API Token] \
  --collection ip_actively_communicating_cc_server

Each indicator is returned as a separate STIX 1.1.1 XML package.

Performance considerations

Some collections are large (>100k records). Client applications have occasionally reported issues during data download, typically caused by memory constraints in the TAXII client. If you experience issues:

Use a TAXII client with better memory management, such as cabby
Decrease the STIX block size so that each request receives a smaller number of packages