What Is a TAXII Server and How Is It Different from a TAXII Client?

In today’s threat landscape, sharing cyber threat intelligence is of the essence. If an organization’s security teams and technologies work in silos, it cannot succeed in defending against advanced threats. Understanding adversaries’ tactics, techniques, and procedures (TTPs) gives valuable insight into their objectives, and TAXII helps achieve that by enabling threat intelligence sharing between organizations using STIX standards.

A TAXII server and a TAXII client are the two halves of that exchange: the server publishes and stores threat intelligence, while the client connects to it to request, ingest, or share that intelligence. Trusted Automated Exchange of Intelligence Information (TAXII) is an application-layer protocol for sharing cyber threat intelligence between organizations, boosting situational awareness. In simpler terms, TAXII is an open transport mechanism for communicating threat information in a standardized, scalable way.

What Is TAXII?

TAXII is a standardized protocol that defines how cyber threat intelligence is transported between producers and consumers over HTTPS. It doesn’t define what the intelligence says – that’s the job of STIX – but rather how it moves securely and automatically between systems. Together, STIX and TAXII form the backbone of modern, machine-to-machine threat intelligence sharing.

TAXII - The Transport Mechanism

TAXII allows for sharing of indicators and data in a way that can be automated, including supporting the exchange of more than just indicators. It is the preferred exchange mechanism for Structured Threat Information Expression (STIX), which is a language and serialization format used for exchanging cyber threat intelligence.

TAXII enables organizations to share threat intelligence by defining an API that cooperates with common sharing models like Source/Subscriber, Hub-and-Spoke, and Peer-to-Peer. Besides a RESTful API, TAXII defines a set of requirements – Collections and Channels – for TAXII Clients and Servers.

What is a TAXII Server?

A TAXII Server is like a database of indicators of compromise (IOCs) and other information used in cyber threat intelligence. A TAXII Client can read from or write to this data on a given TAXII Server.

A TAXII Server makes it easier for users to share and collect contextualized cyber threat intelligence. It offers a venue for sharing and collecting indicators of compromise (IOCs), and it also provides opportunities for comparing information about suspicious activities.

What is a TAXII Client?

Can a TAXII Client send data to other servers and clients? Can it receive data from them? The answer is yes – a TAXII Client can both send and receive data to and from other servers and clients.

A TAXII Client is a REST client that lets you connect to a TAXII Server, pull the latest cyber threat intelligence from it, and import that intelligence into your local database. It can also help you manage multiple TAXII Servers at once, so you don’t have to worry about server limitations like a cap on the number of connections allowed per day.

What is a TAXII Collection?

A TAXII Collection is an interface to a database of cyber threat intelligence objects provided by a TAXII Server, used by TAXII Clients to send information to, or request information from, the server. Within one API Root, a TAXII Server can host multiple Collections, which exchange information in a request-and-response fashion. In simpler terms, a Collection is used when a single TAXII Client makes a request to the TAXII Server and the server fulfills it.

What is a TAXII Channel?

Maintained by a TAXII Server, a TAXII Channel is a publish-and-subscribe communication channel used by TAXII Clients to exchange information with other TAXII Clients. Channel-based communication is used when a TAXII Client sends information to the TAXII Server, and that information is distributed to all the other TAXII Clients connected to the Channel. Within one API Root, a TAXII Server can host multiple Channels.

When it comes to connecting with cyber threat intelligence providers, TAXII Server and TAXII Client applications are required for the source and collection entities involved in the sharing mechanism. Let’s dig deeper into how they differ from one another.

TAXII Server vs TAXII Client

While both TAXII Clients and Servers exchange information in a request-response model, a TAXII Server is an entity that provides access to threat information on behalf of itself or another entity, and one or more TAXII Clients may interact with it. The server provides access to one or more Collections containing threat information, each holding one or more pieces of content.

The act of retrieving and sending threat information is called “polling.” The TAXII Client polls the TAXII Server, requesting threat information, and the server responds with the requested information (and/or an error response). Polling has no defined time period, so no time-based constraints apply. Put simply, a TAXII Client can request specific content from a TAXII Server by specifying a set of filters in its request.

While a TAXII Client only provides developers with the support to interact with TAXII Services, a TAXII Server enables developers to implement those TAXII Services for threat intelligence producers and consumers. In a broader sense, both are defined by their role in threat intelligence sharing, not by how they are built.

Share and Collect Threat Intel with CyTAXII

Cyware Intel Exchange is a next-generation connected threat intelligence platform that automates the ingestion, enrichment, analysis, and dissemination of threat data to internal security tools, teams, and stakeholders, as well as a trusted external network. It follows the hub-and-spoke model for bidirectional threat data exchange, with a central hub or server sharing threat intelligence with spokes in a bi-directional fashion.

Moreover, Cyware offers CyTAXII, an open-source TAXII Client that enables security teams to easily ingest and share threat intelligence in the latest STIX formats. Any organization using a threat intelligence platform such as Cyware Intel Exchange can leverage CyTAXII to accelerate threat intelligence sharing with its vendors, peers, and business units.

Book a free demo to learn more about Cyware’s Threat Intel Platform solutions.

Frequently Asked Questions

1) What is a TAXII server?

A TAXII server is a system that stores and publishes cyber threat intelligence, acting like a database of indicators and other threat data. TAXII clients connect to it to request, retrieve, or contribute intelligence over a standardized, secure protocol.

2) What is a TAXII client?

A TAXII client is a REST client that connects to one or more TAXII servers to pull the latest threat intelligence and import it locally, or to share intelligence back. It can manage multiple servers at once and both send and receive data.

3) How is a TAXII server different from a TAXII client?

A TAXII server provides access to threat intelligence on behalf of itself or another entity, while a TAXII client interacts with the server to request or send data. Both are defined by their role in threat intelligence sharing, not by how they are built.

4) What is TAXII used for?

TAXII is used to transport cyber threat intelligence between organizations in an automated, standardized way. It is the preferred exchange mechanism for STIX-formatted intelligence and supports sharing models such as hub-and-spoke, source/subscriber, and peer-to-peer.

5) What is a TAXII collection?

A TAXII collection is an interface to a database of threat intelligence objects on a TAXII server, used in a request-and-response model. A client requests content from a collection, and the server fulfills that request. A server can host multiple collections.

6) What is a TAXII channel?

A TAXII channel is a publish-and-subscribe communication channel maintained by a TAXII server. When a client sends information to the server over a channel, that information is distributed to all other clients subscribed to it.