STIX/TAXII (Beta)

Enrich incoming events with indicators of compromise from a STIX/TAXII 2.1 server

Overview

STIX/TAXII enrichment is in beta. Please share any bug reports and feature requests with your Panther support team.

STIX (Structured Threat Information Expression) and TAXII (Trusted Automated Exchange of Intelligence Information) are open standards for sharing threat intelligence. Panther's STIX/TAXII enrichment connects to any TAXII 2.1 server you have access to (commercial, open-source, or self-hosted) and pulls STIX Indicator objects from the collections you choose. The Panther-managed STIX/TAXII enrichment matches these indicators of compromise (IoCs) against log events ingested into Panther for high-fidelity alerts.

Unlike Panther's other enrichment sources, which typically require only an API key, STIX/TAXII requires you to connect Panther to a TAXII server you have access to: provide a discovery URL and credentials, and Panther walks the server's API roots to enumerate available collections for you to choose from.

How STIX/TAXII enrichment works in Panther

By default, STIX/TAXII enrichment is configured to run against every log type in your Panther environment (yet is possible to disable for a log type, if desired). Panther will attempt to match each incoming log event, across all log types, against the Panther-managed STIX/TAXII enrichment before it passes through the detection engine.

If Panther identifies a match between an incoming event and a STIX/TAXII entry, STIX/TAXII data is appended to the matching log event under a top-level p_enrichment key. It can then be referenced in detection logic and searches.

Panther polls each selected collection on your TAXII server once per hour by default. Each poll fetches only the indicators added to the collection since the last successful poll (tracked per-collection using the TAXII server's X-TAXII-Date-Added-Last cursor), so previously pulled indicators aren't re-fetched. Indicators are retained in the enrichment table until their valid_until date passes or they age past the configured Max age (Days) setting, at which point they're automatically filtered out.

For more information on detection writing using an enrichment source, see Writing a detection using custom enrichment data.

How a match between a log event and STIX/TAXII is made

A log event is enriched with Panther-managed STIX/TAXII enrichment data (under p_enrichment) if a match is found between:

• Any of the values of the Selector field(s) configured for each associated log type.

  • For each log type, the default Selectors are the Indicator Fields (represented by p_any_*) associated with the enrichment table's primary key's indicator field designations (though the Selectors are configurable). Learn more about this auto-mapping here.

• The value of the value key in a STIX/TAXII table entry in Panther.

  • value is the primary key of the STIX/TAXII table and contains the indicator value (IP address, domain, URL, file hash, email address, or MAC address, extracted from the STIX indicator's pattern).

  • See an example of value in the Example STIX/TAXII enrichment table entry below.

Setting up STIX/TAXII enrichment

Step 1: Gather your TAXII server details

Before configuring STIX/TAXII enrichment in Panther, gather the following from your TAXII server (or its administrator):

• The discovery URL, which must end with /taxii2/ (per the TAXII 2.1 specification).

• Credentials for one of the two supported authentication methods:

  • Bearer Token — a single API token.

  • Basic Auth — a username (optional, depending on your server) and password.

You'll also need to allow Panther's egress IP address on your TAXII server. This IP is displayed during setup (see Step 2 below).

Step 2: Create the STIX/TAXII enrichment in Panther

To configure STIX/TAXII enrichment in Panther:

1. In the left-hand navigation bar of your Panther Console, click Enrichments.

2. In the upper-right corner, click Create New.

3. Click STIX/TAXII.

   

   The "What type of enrichment would you like to setup" screen shows Custom Enrichment options followed by a grid of Supported Enrichments, including Anomali, Open Threat Exchange, GreyNoise, Google Threat Intelligence, VirusTotal, and STIX/TAXII (circled), Snowflake Audit, Google Workspace, and Okta.
4. On the Enrichment Settings step, provide values for the following fields:

   • Name: Enter a descriptive name for your integration.

   • TAXII Discovery URL: Enter your server's discovery URL (must end with /taxii2/).

   • Authentication Method: Choose Bearer Token or Basic Auth.

     • If Bearer Token, enter your API Token.

     • If Basic Auth, enter your Username (optional) and Password.

   • Max age (Days): Configure the maximum age, in days, for indicators to be retained in the enrichment table. Indicators older than this cutoff (based on their valid_from date) are not pulled, and previously pulled indicators older than this cutoff are automatically filtered out during each refresh.

   • Note the displayed egress IP and confirm it's allowed on your TAXII server.

   

   The Enrichment Settings step shows fields for Name, TAXII Discovery URL, Authentication Method (Bearer Token or Basic Auth), API Token, and Indicator TTL (Max age in Days), along with a notice displaying Panther's egress IP.
5. Click Continue. Panther will attempt to connect to your discovery URL with the provided credentials.

   • If the connection fails, an error banner is displayed and you can adjust your settings and retry.

6. On the Select Collections step, choose which of the discovered collections to ingest indicators from.

   • Use the filter box to narrow down the list by collection name or description.

   • Select individual collections, or use the header checkbox to select all currently filtered collections.

   • You can select up to 50 collections. If you exceed this limit, an inline warning is shown and you won't be able to continue until you deselect some collections.

   

   The Select Collections step shows an Enrichment Info sidebar with the previously entered settings, and a Select Collections panel with a filter box and a table of discovered collections, each with a checkbox, Collection Name, and Description.
7. Click Continue.

8. On the Verification step, confirm the integration was created successfully, then click View Enrichments.

   • Your new STIX/TAXII configuration will be visible in the Enrichments page.

After adding a STIX/TAXII enrichment, there may be a delay (a few minutes) before incoming log data begins to be enriched. This allows time for the initial data synchronization to complete.

Managing collections after setup

You can view or change which collections a STIX/TAXII enrichment ingests from at any time:

1. In the left-hand navigation bar of your Panther Console, click Enrichments.

2. Click the name of the STIX/TAXII enrichment you'd like to manage.

3. Click on the Collections tab to view the collections currently enabled for this integration.

   

   The Collections tab of a STIX/TAXII enrichment shows a table of enabled collections, each with a Collection Name and Description, and an Edit Collections button in the upper-right.
4. Click Edit Collections to return to the Select Collections step of the wizard and change your selection.

Editing an existing STIX/TAXII enrichment never requires you to re-enter your credentials — leave the token/password field blank to keep the currently stored value.

Enabling, disabling, or modifying STIX/TAXII enrichment for a log type

STIX/TAXII enrichment is enabled by default for each log type in your Panther instance.

If you'd like to disable (or later enable) STIX/TAXII enrichment for a certain log type, or alter a log type's selectors:

1. In the left-hand navigation bar in your Panther Console, click Enrichments.

2. In the list of Enrichments, locate the STIX/TAXII source you'd like to modify, and click its name.

3. Click on the Enriched Log Types tab.

4. On the right-hand side, click Edit Log Types.

   • If you'd like to enable this enrichment for a new log type, click Add Log Type.

     • In the new row that populates, select a Log Type and, in the Selectors field, at least one event field.

   • If you'd like to disable this enrichment for a log type, locate that log type's row, and click the trash icon.

     • If you don't see a log type listed, click on the drop-down arrow next to Auto-mapped Log Types. Locate the log type's row and click the edit icon.

   • If you'd like to alter the selectors for a log type, click into the Selectors field and add or remove selections for event fields.

5. In the upper-right corner, click Save.

Example STIX/TAXII enrichment table entry

The below is an example of a STIX Indicator object pulled by Panther over TAXII. Each indicator from a selected collection creates its own row, with the indicator value stored in the value field.

{
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--b3eb5e07-2f0e-4e04-9d21-38f4a2d0d20e",
  "created": "2025-03-10T14:00:00.000Z",
  "modified": "2025-03-10T14:00:00.000Z",
  "name": "Malicious IP associated with C2 activity",
  "indicator_types": ["malicious-activity"],
  "pattern": "[ipv4-addr:value = '198.51.100.42']",
  "pattern_type": "stix",
  "valid_from": "2025-03-10T14:00:00.000Z",
  "valid_until": "2025-09-10T14:00:00.000Z",
  "labels": ["c2", "malware"],
  "confidence": 85,
  "value": "198.51.100.42",
  "ioc_type": "ip_address",
  "p_event_time": "2025-03-10T14:00:00.000Z",
  "p_log_type": "STIX.Indicator",
  "p_parse_time": "2025-03-10T15:00:00.000Z",
  "p_row_id": "abc123def456ghi789",
  "p_schema_version": 0
}

STIX.Indicator schema

The following is the Panther-managed STIX.Indicator schema, representing how STIX Indicator objects pulled over TAXII are stored in Panther. Each indicator becomes its own row.

schema: STIX.Indicator
description: STIX 2.1 Indicator objects with the IoC value and type extracted from the pattern property.
referenceURL: https://docs.oasis-open.org/cti/stix/v2.1/os/stix-v2.1-os.html#_muftrcpnf89v
fields:
  - name: type
    required: true
    description: The type of this object, MUST be 'indicator'.
    type: string
  - name: spec_version
    required: true
    description: The version of the STIX specification used to represent this object.
    type: string
  - name: id
    required: true
    description: The unique identifier for this Indicator.
    type: string
  - name: created_by_ref
    description: The id of the Identity object that created this Indicator.
    type: string
  - name: created
    required: true
    description: The time at which this Indicator was originally created.
    type: timestamp
    timeFormats:
      - rfc3339
  - name: modified
    required: true
    description: The time that this particular version of the Indicator was last modified.
    type: timestamp
    timeFormats:
      - rfc3339
  - name: revoked
    description: Whether this Indicator has been revoked.
    type: boolean
  - name: labels
    description: A set of terms used to describe this Indicator.
    type: array
    element:
      type: string
  - name: confidence
    description: The confidence that the creator has in the correctness of their data (0-100).
    type: bigint
  - name: lang
    description: The language of the text content in this object.
    type: string
  - name: external_references
    description: A list of external references which refer to non-STIX information.
    type: array
    element:
      type: object
      fields:
        - name: source_name
          description: The name of the source that the external-reference is defined within.
          type: string
        - name: description
          description: A human-readable description of the external reference.
          type: string
        - name: url
          description: A URL reference to an external resource.
          type: string
          indicators:
            - url
        - name: hashes
          description: Hashes for the contents of the url, as a dictionary of hash-algorithm to value.
          type: json
        - name: external_id
          description: An identifier for the external reference content.
          type: string
  - name: object_marking_refs
    description: The list of marking-definition objects that apply to this Indicator.
    type: array
    element:
      type: string
  - name: granular_markings
    description: The set of granular markings that apply to this Indicator.
    type: json
  - name: extensions
    description: A dictionary of extension-specific properties, keyed by extension identifier (the STIX 2.1 mechanism for vendor-specific data).
    type: json
  - name: name
    description: A name used to identify this Indicator.
    type: string
  - name: description
    description: A description that provides more details and context about this Indicator.
    type: string
  - name: indicator_types
    description: A set of categorizations for this Indicator (e.g. malicious-activity).
    type: array
    element:
      type: string
  - name: pattern
    required: true
    description: The detection pattern for this Indicator.
    type: string
  - name: pattern_type
    required: true
    description: The pattern language used in the pattern property (e.g. stix, yara).
    type: string
  - name: pattern_version
    description: The version of the pattern language used in the pattern property.
    type: string
  - name: valid_from
    required: true
    description: The time from which this Indicator is considered a valid indicator of the behaviors it is related to.
    type: timestamp
    timeFormats:
      - rfc3339
    isEventTime: true
  - name: valid_until
    description: The time at which this Indicator should no longer be considered a valid indicator.
    type: timestamp
    timeFormats:
      - rfc3339
  - name: kill_chain_phases
    description: The kill chain phases for which this Indicator corresponds.
    type: array
    element:
      type: object
      fields:
        - name: kill_chain_name
          description: The name of the kill chain.
          type: string
        - name: phase_name
          description: The name of the phase in the kill chain.
          type: string
  - name: value
    description: The IoC value extracted from the pattern; the enrichment key.
    type: string
    indicators:
      - ip
      - domain
      - url
      - md5
      - sha1
      - sha256
      - email
      - mac
  - name: ioc_type
    description: 'The IoC type extracted from the pattern (one of: ip_address, domain_name, url, file, email, mac_address).'
    type: string

Only STIX Indicator objects (type: indicator) using the STIX pattern language (pattern_type: stix) are ingested. Other STIX object types (e.g. identity, malware, attack-pattern) and non-STIX pattern languages (e.g. yara, pcre, sigma) are skipped. Only patterns Panther can extract a single IoC value from (IP address, domain, URL, file hash, email address, or MAC address) are supported; indicators with more complex or unsupported patterns are also skipped.

Example of using STIX/TAXII data in detections

STIX/TAXII enrichment data can be used in detection logic to identify known threats. The following example checks whether an event matched a STIX/TAXII indicator and surfaces its confidence and labels:

def rule(event):
    enrichment = event.get('p_enrichment', {})
    stix_data = enrichment.get('STIX.Indicator', {})

    if not stix_data:
        return False

    return stix_data.get('confidence', 0) >= 75


def title(event):
    stix_data = event.deep_get('p_enrichment', 'STIX.Indicator', default={})
    return f"Match against STIX/TAXII indicator: {stix_data.get('name', stix_data.get('value'))}"

Troubleshooting STIX/TAXII enrichment

Common issues

• Connection fails during setup: Confirm your discovery URL ends with /taxii2/, your credentials are correct, and Panther's egress IP is allowed on your TAXII server.

• No data being pulled: Make sure at least one collection is selected on the Select Collections step, and that the selected collections actually contain STIX Indicator objects with a supported pattern (see the hint above). Also check your Max age (Days) setting — indicators with a valid_from older than this cutoff are filtered out on ingest.

• Some collections missing data intermittently: A collection that fails to be reached during a given poll is skipped for that cycle and retried on the next poll; other, healthy collections are unaffected. If a collection's health check consistently fails, it's flagged unhealthy on the enrichment's details page.

• Data freshness: STIX/TAXII collections are polled once per hour. Check your Max age (Days) setting to ensure it's appropriate for your use case.

For additional troubleshooting, visit the Panther Knowledge Base to view articles about enrichment that answer frequently asked questions and help you resolve common errors and issues.