STIX / TAXII feed

Action-oriented Harpia intelligence, published as STIX 2.1 objects over a standards-compliant TAXII 2.1 server. Subscribe to a remediation, hunting, supply-chain, regional, or synchronization view without maintaining a custom parser.

On this page: Why TAXII · Quickstart · Endpoints · Collections · Object model · Delta sync · Use cases · Client setup · Auth & limits · Custom collections & on-prem · FAQ

Why a TAXII feed - and when to use it over the API

Harpia exposes the same intelligence two ways. Pick by consumer, not by preference:

Use the JSON API when…	Use the TAXII feed when…
You are writing code: CI gates, SOAR playbooks, dashboards, ad-hoc lookups.	You are feeding a platform: MISP, OpenCTI, a SIEM's TAXII ingester, any TIP.
You need SSVC decisions, search, facets, per-asset context.	You need standardized objects flowing into an existing correlation pipeline.
Request/response, you pull exactly what you ask for.	Subscription model: the client keeps itself current with `added_after` polling.

STIX gives every consumer the same vocabulary - a vulnerability object from Harpia correlates natively with indicators, malware, and ATT&CK objects your platform already holds. That correlation is the whole point: your TIP can answer "which of the IPs attacking us exploit CVEs we actually run?" without any glue code.

Quickstart

# 1 - discovery: what does this server offer?
curl -s -H "Accept: application/taxii+json;version=2.1" \
  "https://harpia.ae/threatintel/"

# 2 - list collections
curl -s -H "Accept: application/taxii+json;version=2.1" \
  "https://harpia.ae/threatintel/collections/"

# 3 - pull the highest-signal collection
curl -s -H "Accept: application/taxii+json;version=2.1" \
  "https://harpia.ae/threatintel/collections/exploited-in-wild/objects/?limit=50"

Three requests, zero setup. Prefer a visual first look? Open the STIX explorer and browse the same collections in the browser.

Endpoints

API root: https://harpia.ae/threatintel/. Every request carries the TAXII media type:

Accept: application/taxii+json;version=2.1

Endpoint	Returns
GET /threatintel/	Discovery - server title, supported versions, content limits.
GET /threatintel/collections/	Every collection with id, title, description.
GET /threatintel/collections/{id}/	One collection's metadata.
GET /threatintel/collections/{id}/objects/	STIX 2.1 objects. Supports `limit` and `added_after`.
GET /threatintel/collections/{id}/objects/{object-id}/	A single STIX object by id.
GET /threatintel/collections/{id}/objects/{object-id}/versions/	Available versions of a STIX object.
GET /threatintel/collections/{id}/manifest/	Object manifest - ids, versions, timestamps, no bodies. Cheap way to diff before pulling.
GET /threatintel/search/?q=…	Convenience search across the feed, returns a STIX bundle. Harpia extension - handy for spot checks, not part of the TAXII spec.

Collections - sixteen operational views

Every collection is a curated view over the same underlying feed - same freshness, same objects, different selection and ordering. Subscribe to what your workflow consumes instead of filtering the firehose client-side. Grouped by what they are for:

Remediate and monitor

Collection id	Carries	Use it for
`patch-now`	Exploited CVEs with a fix available.	Open remediation tickets and drive the emergency patch queue.
`mitigate-now`	Exploited CVEs without a known fix.	Launch compensating-control and exposure-reduction playbooks.
`newly-exploited`	Exploited CVEs published in the last 30 days.	Maintain SIEM watch-lists and alert on fast-moving disclosures.
`internet-exploitation`	Exploited CVEs mapped to ATT&CK T1190.	Prioritize public-facing services and hunt exploitation paths.
`high-probability-next-30d`	Unconfirmed CVEs with EPSS above 50%.	Patch likely next-wave exploitation before confirmation arrives.

Investigate and hunt

Collection id	Carries	Use it for
`cisa-kev`	CISA KEV entries with required actions and context.	Track authoritative known-exploitation obligations and reporting.
`ransomware-exploitation`	Ransomware-associated CVEs with full STIX relationships.	IR readiness, campaign investigation, and ransomware briefs.
`threat-actor-exploitation`	CVEs attributed to named actors.	Follow actor, geography, sector, software, and ATT&CK relationships.
`weaponized-automatable`	Weaponized CVEs with automatable exploit paths.	Anticipate scalable exploitation and focus red/blue-team work.
`public-exploit-code`	CVEs with public PoC or exploit repositories.	Assess exploit availability and inspect repository evidence.
`trending`	The 25 highest-momentum CVEs.	Produce a compact daily threat brief.

Protect software delivery

Collection id	Carries	Use it for
`malicious-packages`	Recently published malicious packages.	Block known-bad packages in registries and build pipelines.
`supply-chain-threats`	Malicious packages plus exploited or high-EPSS npm, PyPI, Maven, Go, and NuGet vulnerabilities.	Correlate SBOMs and dependency inventories against one AppSec feed.

Regional awareness and synchronization

Collection id	Carries	Use it for
`uae-targeted-threats`	CVEs linked to campaigns targeting the UAE.	Regional CTI, sector briefs, and UAE-focused hunting.
`exploited-in-wild`	A lean capped snapshot of confirmed exploitation.	Broad correlation and local exploited-CVE mirrors.
`recent-vulnerabilities`	The 50,000 most recently published scored vulnerabilities.	Bulk synchronization without claiming to contain the complete corpus.

Suggested subscriptions by team

Team	Subscribe to	Cadence
SOC / IR	`newly-exploited` · `internet-exploitation` · `ransomware-exploitation`	Hourly delta
Vulnerability management	`patch-now` · `mitigate-now` · `high-probability-next-30d`	Daily delta
Threat intelligence	`threat-actor-exploitation` · `trending` · `uae-targeted-threats`	Daily delta
Platform / DevSecOps	`malicious-packages` · `supply-chain-threats`	Hourly delta
MSSP	`exploited-in-wild` · `cisa-kev` · `patch-now`	Hourly delta, fan out downstream

Object model

Collections contain standard STIX 2.1 objects:

vulnerability SDOs - one per CVE: description, external references (CVE id, advisory aliases, KEV), publication timestamps.
relationship SROs - vulnerabilities linked to ATT&CK techniques (via the CWE → technique bridge) and malware associations, so graph views connect out of the box.
identity and marking-definition - producer identity and TLP marking, referenced by every object.

{
  "type": "vulnerability",
  "spec_version": "2.1",
  "id": "vulnerability--…",
  "created_by_ref": "identity--…",
  "name": "CVE-2024-3400",
  "description": "A command injection … in Palo Alto Networks PAN-OS …",
  "external_references": [
    { "source_name": "cve", "external_id": "CVE-2024-3400" },
    { "source_name": "cisa-kev", "url": "…" }
  ],
  "object_marking_refs": ["marking-definition--…"]
}

Pagination & delta sync

Object listings page with limit; keep pulling while the envelope reports "more": true, passing the returned next cursor. For continuous ingestion, checkpoint on time and poll with added_after:

# initial backfill
curl -s -H "Accept: application/taxii+json;version=2.1" \
  "https://harpia.ae/threatintel/collections/exploited-in-wild/objects/?limit=100"

# every following pull - only what changed since your checkpoint
curl -s -H "Accept: application/taxii+json;version=2.1" \
  "https://harpia.ae/threatintel/collections/exploited-in-wild/objects/?added_after=2026-07-16T00:00:00Z"

Record the timestamp of each successful pull; use it as the next added_after. Idempotent - overlapping windows just re-deliver objects your client dedupes by STIX id.
A daily delta of exploited-in-wild is typically small; use recent-vulnerabilities only when you need a broad synchronization view.
Use /manifest/ to diff cheaply (ids + versions, no bodies) before deciding to pull.

Use cases

1 · SIEM watch-list that maintains itself

Subscribe your SIEM's TAXII ingester to newly-exploited. Detection rules that reference the watch-list react to recently published CVEs with confirmed exploitation, without an analyst maintaining spreadsheets.

2 · TIP correlation (MISP / OpenCTI)

Harpia vulnerability objects land in the same graph as your indicators, sightings, and ATT&CK data. The questions that used to need glue code become queries:

"Which actively exploited CVEs intersect software we run?" - correlate against your asset inventory events.
"This campaign's malware - which CVEs does it ride on, and are they weaponized?" - follow the relationship objects.

3 · Separate patching from mitigation

Route patch-now into remediation tickets and mitigate-now into compensating-control playbooks. The collection communicates the action instead of leaving each downstream consumer to reconstruct it from scores and flags.

4 · MSSP distribution - one upstream, many tenants

Pull once from Harpia, fan out internally to per-customer TAXII collections or SIEM instances. STIX objects carry stable ids and TLP markings, so downstream dedup and redistribution policy are already solved. Custom volume terms for this pattern - talk to us.

5 · Registry and SBOM guard

Use malicious-packages to block known-bad components in registry proxies. Correlate supply-chain-threats against SBOMs to catch exploited and high-probability risk in npm, PyPI, Maven, Go, and NuGet dependencies.

6 · Morning threat brief, automated

trending is deliberately capped at 25 entries. Combine it with threat-actor-exploitation and uae-targeted-threats for a concise daily brief covering movement, attribution, and regional relevance.

Client setup

MISP

Add a TAXII 2.1 server: URL https://harpia.ae/threatintel/, version 2.1, then select collections (start with patch-now + newly-exploited). MISP maps vulnerability SDOs to events automatically.

OpenCTI

Deploy the standard TAXII 2 connector with the same root URL and collection ids - objects arrive as vulnerabilities with relationships intact.

Generic / custom

Any TAXII 2.1-conformant client works - the server implements standard discovery, collections, objects, and manifests. For a human look before wiring anything, use the STIX explorer.

Auth & limits

Collection, object, and manifest access is available on the Enterprise plan. Authenticate with your API key (Authorization: Bearer …). Discovery remains public so conformant clients can identify the server before authentication. Enforcement follows the JSON API's limits, explained covers all five, including the exact 429 bodies and Retry-After behavior.

Backfills are the expensive part: do them once, authenticated, off-peak; then live on deltas.
One key per consumer (SIEM, TIP, registry guard) keeps usage attributable and one noisy integration from starving the rest.

Custom collections & on-premises

The sixteen default collections are the views most teams need - but they are configuration, not architecture. The TAXII server builds each collection from a filter over the feed, which means the set is extensible:

Custom collections - scoped to your vendor stack ("exploited CVEs affecting Palo Alto, F5, Citrix"), your ecosystems ("npm + PyPI malware only"), your thresholds ("EPSS > 0.7 AND automatable"), or your compliance regime.
On-premises / air-gapped deployment - the entire platform (feed, JSON API, decision engine, TAXII server) runs inside your perimeter, with scheduled feed updates delivered as signed data drops. Your TIP talks TAXII to a server that never leaves your network - and custom collections are defined by you, on your instance.
High-volume mirrors - full-feed replication on contractual terms with SLAs.

Harpia is a new service and these arrangements are actively being shaped with early customers. If any of the above fits your environment, get in touch with your volume, platforms, and whether you need on-prem - we will come back with a concrete proposal, not a sales deck.

FAQ

How fresh are the collections?

Collections are views over the live feed - they update as the feed rebuilds (hours, not days). A CVE that goes active appears in exploited-in-wild on the next feed build; your next added_after poll picks it up.

What TLP are the objects?

Every object carries an explicit marking-definition reference. The public feed is distribution-safe for internal security use; redistribution as a competing product needs an agreement (ToS).

Is this real TAXII or "TAXII-inspired"?

Standard TAXII 2.1: discovery, collections, objects, manifests, standard envelopes, standard media types. The only extension is /threatintel/search/, which is additive and clearly outside the spec surface. If your conformant client fails against the server, that is a bug - tell us.

TAXII or JSON API for my case?

Feeding a platform → TAXII. Writing logic (decisions, search, gates) → the JSON API. Many teams run both: TAXII into the TIP, API in the pipelines.