The discovery URL was changed from /taxii/ to /taxii2/.The DNS SRV record was changed from taxii to taxii2.TAXII 2.1 differs from TAXII 2.0 in the following ways: TAXII design principles include minimizing operational changes needed for adoption easy integration with existing sharing agreements, and support for all widely used threat sharing models: hub-and-spoke, peer-to-peer, source-subscriber. It is important to note that STIX and TAXII are independent standards: the structures and serializations of STIX do not rely on any specific transport mechanism, and TAXII can be used to transport non-STIX data. However, TAXII can also be used to share data in other formats. TAXII was specifically designed to support the exchange of CTI represented in STIX, and support for exchanging STIX 2.1 content is mandatory to implement. In addition, TAXII uses HTTPS as the transport for all communications, and it uses HTTP for content negotiation and authentication.
In particular, TAXII Servers are discovered within a network via DNS Service records (and/or by a Discovery Endpoint, described in the next section).
TAXII relies on existing protocols when possible. API Roots are logical groupings of TAXII Channels and Collections and can be thought of as instances of the TAXII API available at different URLs, where each API Root is the “root” URL of that particular instance of the TAXII API. For example, they can be grouped to support the needs of a particular trust group.Ī TAXII server instance can support one or more API Roots. Channels and their services will be defined in a later version of TAXII.Ĭollections and Channels can be organized in different ways.
Note: The TAXII 2.1 specification reserves the keywords required for Channels but does not specify Channel services. As depicted below, TAXII defines two primary services to support a variety of common sharing models:Ĭollection - A Collection is an interface to a logical repository of CTI objects provided by a TAXII Server that allows a producer to host a set of CTI data that can be requested by consumers: TAXII Clients and Servers exchange information in a request-response model.Ĭhannel - Maintained by a TAXII Server, a Channel allows producers to push data to many consumers and consumers to receive data from many producers: TAXII Clients exchange information with other TAXII Clients in a publish-subscribe model. TAXII defines a RESTful API (a set of services and message exchanges) and a set of requirements for TAXII Clients and Servers. Trusted Automated Exchange of Intelligence Information (TAXII™) is an application protocol for exchanging CTI over HTTPS.
0 kommentar(er)
