STIX/TAXII Intelligence Skill

Overview

This skill provides STIX/TAXII threat intelligence format creation, querying, and sharing capabilities.

Capabilities

• Create STIX 2.1 bundles
• Query TAXII servers
• Generate threat reports
• Create indicator relationships
• Map to MITRE ATT&CK
• Support OpenIOC format
• Validate STIX syntax
• Share intelligence feeds

Target Processes

• threat-intelligence-research.js
• malware-analysis.js
• security-advisory-writing.js

Dependencies

• stix2 library (Python)
• taxii2-client
• Python 3.x
• TAXII server access (optional)

Usage Context

This skill is essential for:

• Threat intelligence sharing
• IOC standardization
• Intelligence feed management
• Threat report generation
• Intelligence correlation

Integration Notes

• Supports STIX 2.0 and 2.1
• Can publish to TAXII servers
• Integrates with MISP
• Supports multiple IOC formats
• Can generate human-readable reports