STIX TAXII: Collections

Recommended collections by use case

These collections are available in both TAXII 1.x (as named collections) and TAXII 2.1 (within the appropriate API root). Collection names below use the TAXII 1.x naming convention; for TAXII 2.1, use the corresponding collection ID from the Get Collections endpoint.

C2 server detection

Use case	Collections	Refresh frequency
Detect IP traffic to known C2 servers	`ip_current_cc_server`, `ip_actively_communicating_cc_server`	Every 60 minutes
Detect domain traffic to known C2 servers	`domain_cc_dns_name`	Every 120 minutes

Broad malicious indicator detection

Use case	Collections	Refresh frequency
Detect traffic to/from any known malicious IPs	`ip_full`	Every 60 minutes
Detect traffic to/from any known malicious domains	`domain_full`	Every 120 minutes

Weaponized content detection

Use case	Collections	Refresh frequency
Detect weaponized URLs	`url_recently_active_url_on_weaponized_domain`	Every 120 minutes
Detect file hashes exploited in the wild	`hash_recently_active_targeting_vulnerabilities_in_the_wild`	Every 1,440 minutes (daily)

Note: Some collections (particularly URL lists) may contain more indicators than certain SIEM ingestion limits allow. If possible, increase the threat intelligence size limit on your STIX/TAXII client.

Known issues and platform compatibility

Microsoft Sentinel

Cannot import vulnerability IOCs. Sentinel only supports Indicator STIX Domain Objects (SDOs), which are used for domains, IPs, URLs, and hashes. Cyber-vulnerabilities are represented as Vulnerability SDOs, which Sentinel does not currently support.

LogRhythm

Only imports indicator names — the full risk details and evidence are not ingested.
Cannot handle pagination. Only indicators from the first page are imported, meaning a maximum of 1,000 IOCs per collection.

OpenCTI

OpenCTI has issues with deeply nested STIX structures and large collection sizes. Use the dedicated opencti API root in TAXII 2.1, which:

Flattens the EvidenceDetails object into the labels field
Limits collections to 1,000 objects

General performance tips

Large collections (>100k records): If your client struggles with large responses, reduce the page size using the limit parameter (TAXII 2.1) or decrease the STIX block size (TAXII 1.x).
Memory-constrained clients: Consider using cabby as a TAXII 1.x client — it handles memory more efficiently than some reference implementations.
Snapshot behavior (TAXII 2.1): Collections are generated live at request time, not from cached snapshots. The added_after parameter has no effect since all objects in a response share the same timestamp.