Flexible Intel Feed (TCTF-0003) — Spectra Intelligence

The Flexible Intel Feed (FIF) is a private threat intelligence feed delivered via the TAXII 2.1 protocol in STIX 2.1 format.

Unlike ReversingLabs' curated feeds (for example, the Ransomware Indicators Feed (TCTF-0001)), the Flexible Intel Feed is not curated by ReversingLabs. ReversingLabs does not select indicators at its own discretion or from the global malware corpus. Every indicator that can appear in your collection is derived exclusively from the samples you uploaded. The feed is, in effect, a structured STIX/TAXII view of the analysis results for your own submissions, enriched with context from across the ReversingLabs product portfolio.

The feed is read-only.
Data is scoped to your Spectra Intelligence account.
Supports integration with third-party platforms like OpenCTI.
A typical usage pattern is to poll the objects endpoint regularly using the added_after filter.

How Your Samples Become Feed Content

These rules determine what appears in your collection and for how long.

Samples are tracked for 30 days. After a file is uploaded, it stays in scope for feed generation for 30 days.
Indicators arrive over time, not all at once. As the various analyses performed by ReversingLabs complete, new indicators relating to that file may appear in your feed. A sample that produced no indicators when it was first uploaded may produce them later.
Every object has a 30-day TTL. Each STIX object in the feed is retained for 30 days, reflected in the valid_from and valid_until properties of indicator objects.
A sample can reappear in the feed. If a sample's metadata changes significantly after it was first processed — for example, its classification changes or new analysis results arrive — new or updated objects for that sample can be published to your collection again.
Extracted and dropped samples are included. If other samples are extracted from your original sample during static analysis, or dropped by the sample during execution in dynamic analysis, those samples may also appear in your collection, along with any indicators extracted from them.

From Sample to TAXII Collection

The general flow is:

The sample is uploaded, either via Spectra Analyze or directly to the Spectra Intelligence API.
The sample is processed by Spectra Intelligence.
The sample's metadata is analyzed.
Dropped and extracted samples are analyzed, if any exist.
Any STIX objects created are placed in your collection.
The objects remain available in the collection for 30 days.

Feed Scope Is per Uploader

Your collection contains indicators derived from your own submissions only. It is not a shared or global pool.

For example, if user A uploads file F1 and user B uploads file F2, then F2 — and every indicator derived from F2 — will not appear in user A's collection, and vice versa. Each account is assigned its own unique TAXII collection, available under a dedicated API root, and feed access is authenticated and personalized per account.

Activating the Feed

The Flexible Intel Feed is activated from Spectra Analyze. Enable the feed on the Spectra Analyze appliance — see the Spectra Analyze Flexible Intel Feed documentation for the procedure.

important

The credentials described below are issued once. Save them securely.

Once the feed is enabled, Spectra Analyze displays a pop-up with the connection details:

TAXII Discovery URL

The FIF feed supports the global TAXII discovery endpoint:

https://data.reversinglabs.com/api/taxii/taxii2/
API Root

The API root for FIF is:

https://data.reversinglabs.com/api/taxii/flexible-intel-feeds/
Collection ID

A unique ID assigned to your Spectra Intelligence account. Used to query your private STIX feed.
Username

Your Spectra Intelligence username with /fif appended.

Example: u/company/user/a1000 → u/company/user/a1000/fif
Password

Shown only once in the UI. Save it securely or regenerate it if lost.

Authentication

Access to the Flexible Intel Feed requires Basic Authentication using credentials provided when the feed was enabled.

All requests must include:

Authorization: Basic <base64(username:password)>
Accept: application/taxii+json;version=2.1
User-Agent: ReversingLabs TAXII FIF Public Docs Example

Integrations

The Flexible Intel Feed uses the same TAXII service as the Ransomware Indicators Feed (TCTF-0001), so it works with the same SIEM, SOAR, and TIP platforms that support ingestion of STIX/TAXII 2.1 objects.

Check out our integrations documentation for additional examples.

Endpoints

Discovery

GET https://data.reversinglabs.com/api/taxii/taxii2/

Returns a list of available TAXII API roots.

API Root

GET https://data.reversinglabs.com/api/taxii/flexible-intel-feeds/

Describes the Flexible Intel Feed root and its associated collections.

Response

{
  "description": "ReversingLabs Flexible Intel Feed data.",
  "title": "ReversingLabs Flexible Intel Feed STIX 2.1 Collections",
  "max_content_length": 999765625,
  "versions": [
    "application/taxii+json;version=2.1"
  ]
}

Collections

GET https://data.reversinglabs.com/api/taxii/flexible-intel-feeds/collections/

Returns the list of collections available under this root. Each user receives a single private collection.

Response

{
  "collections": [
    {
      "id": "49f2c125-4854-5a12-a0fd-62400f5a7af7",
      "title": "ReversingLabs Flexible Intel Feed Collection",
      "can_write": false,
      "can_read": true,
      "media_types": [
        "application/stix+json;version=2.1"
      ]
    }
  ]
}

STIX Objects

Retrieves STIX 2.1 objects from your private feed collection.

GET https://data.reversinglabs.com/api/taxii/flexible-intel-feeds/collections/<collection-id>/objects/

Supported Query Parameters

The Flexible Intel Feed is served by the same TAXII service as the Ransomware Indicators Feed (TCTF-0001) and supports the same filtering. Only the API root and collection ID differ.

Parameter	Description
`added_after`	A timestamp in RFC 3339 / ISO 8601 format. Returns only objects added after the specified timestamp.
`limit`	Maximum number of objects per response. Range: 1–500.
`match[type]`	A comma-separated list of STIX object types to filter on, such as `indicator`, `malware`, `relationship`.
`next`	A string value indicating the next record or set of records in the dataset. Returned in the response when more data is available.

Use these parameters when polling the objects endpoint.

Examples

Poll for Objects

curl --location 'https://data.reversinglabs.com/api/taxii/flexible-intel-feeds/collections/49f2c125-4854-5a12-a0fd-62400f5a7af7/objects/?added_after=2025-06-09T11%3A00%3A00.000Z&limit=500' \
  --header 'Accept: application/taxii+json;version=2.1' \
  --header 'User-Agent: ReversingLabs TAXII FIF Public Docs Example' \
  --header 'Authorization: Basic <base64_token>'

Filter by Timestamp

Use the added_after parameter to retrieve all objects added after the specified timestamp. The timestamp must be an RFC 3339-formatted timestamp using the format YYYY-MM-DDTHH:MM:SS.ssssssZ.

curl -u "username/fif:password" "https://data.reversinglabs.com/api/taxii/flexible-intel-feeds/collections/49f2c125-4854-5a12-a0fd-62400f5a7af7/objects/?added_after=2025-06-09T00:00:00.000000Z" -H "accept: application/taxii+json;version=2.1"

This is the recommended polling pattern: store the timestamp of your last successful poll and pass it as added_after on the next request.

Limit Returned Objects

Use the limit query parameter to retrieve a specified number of objects.

curl -u "username/fif:password" "https://data.reversinglabs.com/api/taxii/flexible-intel-feeds/collections/49f2c125-4854-5a12-a0fd-62400f5a7af7/objects/?limit=5" -H "accept: application/taxii+json;version=2.1"

Matching

Use the match[type] query parameter to filter objects by type.

curl -u "username/fif:password" "https://data.reversinglabs.com/api/taxii/flexible-intel-feeds/collections/49f2c125-4854-5a12-a0fd-62400f5a7af7/objects/?match[type]=indicator,malware,relationship" -H "accept: application/taxii+json;version=2.1"

Paging

Request 1 — make the first request using the limit query filter.

curl -u "username/fif:password" "https://data.reversinglabs.com/api/taxii/flexible-intel-feeds/collections/49f2c125-4854-5a12-a0fd-62400f5a7af7/objects/?limit=5" -H "accept: application/taxii+json;version=2.1"

Response — the response returns a more property with a boolean value, where true indicates more objects are available. The value of the next property is used for the subsequent request.

{
  "more": true,
  "next": "17562276",
  "objects": []
}

Request 2 — make the second request using the next query filter with the value returned in the previous response.

curl -u "username/fif:password" "https://data.reversinglabs.com/api/taxii/flexible-intel-feeds/collections/49f2c125-4854-5a12-a0fd-62400f5a7af7/objects/?next=17562276" -H "accept: application/taxii+json;version=2.1"

Error Handling

All errors are returned in the TAXII 2.1 standard format. For more details, view the official TAXII error handling page.

Example Response

{
  "description": "Unknown filter count encountered",
  "http_status": "400",
  "title": "ProcessingError"
}

Object Types

The feed returns STIX 2.1 objects wrapped in an {"objects": [...]} structure.

Typical object types include:

url, domain-name, ipv4-addr, file: Basic observable IOCs
indicator: Structured detection logic (e.g. "match if SHA256 is X")
malware: Classification and metadata about malware families
relationship: Links between objects (e.g., "this indicator indicates this malware")

The object structure follows the STIX 2.1 specification.

Objects carry the ReversingLabs label, and network indicators derived from a submitted sample additionally carry sample-source. Other labels supply classification and analysis context — file type and platform (PE/Exe, Win32), threat type and family (Backdoor, FormBook), observed behavior (malware-downloaded, malicious-network-source, sigma-suspicious-activity), and network context such as TCP-443.

One indicator per hash

For a submitted file, the feed emits a separate indicator object for each hash algorithm — one for SHA-1, one for SHA-256, and one for MD5 — each with a single-hash pattern and its own based-on relationship pointing at the same file object. This differs from the Ransomware Indicators Feed (TCTF-0001), which combines all three hashes into one OR'd pattern. If your platform keys on indicators rather than on the referenced file object, expect three indicators per file and deduplicate via the based-on relationship's target_ref.

Response Example

{
  "more": true,
  "next": "17562276",
  "objects": [
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--77f01347-e145-5e3c-ba42-a1ca466503a8",
      "created": "2026-08-06T12:06:05Z",
      "modified": "2026-08-06T12:06:05Z",
      "valid_from": "2026-08-06T12:06:05Z",
      "valid_until": "2026-09-05T12:06:05Z",
      "created_by_ref": "identity--d60fb2ad-4d85-59b8-91e6-987af9279b9a",
      "name": "3ddce244c308f1ce27307b16467f29bd7f3e2333c535cb4a0c5d93a0b7296230",
      "description": "Malware file activity was observed",
      "confidence": 100,
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern_type": "stix",
      "pattern": "[file:hashes.'SHA-256' = '3ddce244c308f1ce27307b16467f29bd7f3e2333c535cb4a0c5d93a0b7296230']",
      "labels": [
        "ReversingLabs",
        "PE/Exe",
        "Win32",
        "Backdoor",
        "FormBook",
        "sigma-suspicious-activity",
        "malicious-network-source"
      ],
      "external_references": [
        {
          "source_name": "mitre",
          "external_id": "TA0008",
          "description": "Mitre tactic",
          "url": "https://attack.mitre.org/tactics/TA0008/"
        },
        {
          "source_name": "mitre",
          "external_id": "T1055",
          "description": "Mitre technique | source: dynamic",
          "url": "https://attack.mitre.org/techniques/T1055/"
        },
        {
          "source_name": "mitre",
          "external_id": "T1036",
          "description": "Mitre technique | source: dynamic",
          "url": "https://attack.mitre.org/techniques/T1036/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "rl-flexible-intel-feed-kill-chain",
          "phase_name": "middle"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a099eaf6-8a3c-5e28-993d-0384584bbc95",
      "created": "2026-08-06T12:06:05Z",
      "modified": "2026-08-06T12:06:05Z",
      "created_by_ref": "identity--d60fb2ad-4d85-59b8-91e6-987af9279b9a",
      "relationship_type": "based-on",
      "source_ref": "indicator--77f01347-e145-5e3c-ba42-a1ca466503a8",
      "target_ref": "file--c94760fe-5cc2-5691-a426-b6f04488a9d1"
    },
    {
      "id": "file--c94760fe-5cc2-5691-a426-b6f04488a9d1",
      "type": "file",
      "hashes": {
        "SHA-1": "2d2dc3e2beb02d79d39c17c3388b51566f29edf2",
        "SHA-256": "3ddce244c308f1ce27307b16467f29bd7f3e2333c535cb4a0c5d93a0b7296230",
        "MD5": "f01afca27ee2c5d8779eed816bf8c91d"
      },
      "size": 283648,
      "name": "bin.exe"
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1686adfe-be95-552a-bece-f983d17ddfe6",
      "created": "2026-08-06T12:06:05Z",
      "modified": "2026-08-06T12:06:05Z",
      "valid_from": "2026-08-06T12:06:05Z",
      "valid_until": "2026-09-05T12:06:05Z",
      "created_by_ref": "identity--d60fb2ad-4d85-59b8-91e6-987af9279b9a",
      "name": "https://cashblaq.fit/bin.exe",
      "description": "Malware file was observed to contact an URL",
      "confidence": 100,
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern_type": "stix",
      "pattern": "[url:value = 'https://cashblaq.fit/bin.exe']",
      "labels": [
        "ReversingLabs",
        "sample-source",
        "malware-downloaded",
        "FormBook",
        "TCP-443"
      ],
      "external_references": [
        {
          "source_name": "mitre",
          "external_id": "TA0009",
          "description": "Mitre tactic",
          "url": "https://attack.mitre.org/tactics/TA0009/"
        },
        {
          "source_name": "mitre",
          "external_id": "T1114",
          "description": "Mitre technique | source: dynamic",
          "url": "https://attack.mitre.org/techniques/T1114/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "rl-flexible-intel-feed-kill-chain",
          "phase_name": "middle"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--059738b0-9113-575c-a447-d21c9baeb37c",
      "created": "2026-08-06T12:06:05Z",
      "modified": "2026-08-06T12:06:05Z",
      "created_by_ref": "identity--d60fb2ad-4d85-59b8-91e6-987af9279b9a",
      "relationship_type": "based-on",
      "source_ref": "indicator--1686adfe-be95-552a-bece-f983d17ddfe6",
      "target_ref": "url--b50b15f3-772e-53d5-9b60-e327a6f9adde"
    },
    {
      "id": "url--b50b15f3-772e-53d5-9b60-e327a6f9adde",
      "type": "url",
      "value": "https://cashblaq.fit/bin.exe",
      "spec_version": "2.1"
    }
  ]
}

Example Use Cases

Any file you submit to Spectra Intelligence becomes part of your Flexible Intel Feed, whether submitted manually, via API, through connectors, or from features like Bulk Search or YARA matching. Once analyzed, any verified malicious content is enriched with ReversingLabs metadata and exposed in STIX format via the TAXII API.

This is scoped to the account that uploaded the file. Files submitted by other users and other accounts never appear in your collection — your feed reflects your submissions and nothing else.

You can use this mechanism to enrich IOCs from multiple workflows, such as:

Bulk Search

Log into Spectra Analyze.
Perform a Bulk Search: paste a list of unstructured IOCs (e.g., hashes or URLs) copied from another threat source.
Review the Cloud matches, then select Fetch and Analyze.

If automatic uploads to Spectra Intelligence are disabled on the appliance, you can:
- Use Fetch and Analyze (Advanced) and check the Spectra Intelligence option
- Download the samples, then submit them to Spectra Intelligence using the Reanalyze sample action
The appliance will analyze the retrieved files. Any verified malicious IOCs will be enriched with ReversingLabs metadata and included in your Flexible Intel Feed. Because the retrieved samples are now your submissions, indicators extracted from them — and from any samples extracted or dropped by them — become part of your collection for the next 30 days.

This workflow converts external threat data into enriched, structured STIX IOCs accessible via TAXII — ready for integration into downstream tools like OpenCTI.

YARA

Log into Spectra Analyze.
Deploy a YARA rule to perform a live or retroactive hunt.
Review the Cloud matches, then select Fetch and Analyze.

If automatic uploads to Spectra Intelligence are disabled on the appliance, you can:
- Use Fetch and Analyze (Advanced) and check the Spectra Intelligence option
- Download the samples, then submit them to Spectra Intelligence using the Reanalyze sample action
The appliance will analyze the retrieved files and populate the Flexible Intel Feed with any verified malicious IOCs.

This enables you to extend YARA-based detection into a structured intelligence workflow, turning raw match results into curated, machine-readable STIX indicators.

Appendix A: Expected STIX Fields

The Flexible Intel Feed emits the same STIX 2.1 field set as the Ransomware Indicators Feed (TCTF-0001), including kill_chain_phases and MITRE ATT&CK external_references enrichment where the analysis produces them. Not every indicator carries every field — enrichment depends on what the analysis of your sample yielded.

Field	Description	Example Value
`type`	Specifies the type of the STIX Object. For Indicators, this MUST be `indicator`.	`indicator`
`spec_version`	The STIX specification version used to represent this object.	`2.1`
`id`	A unique identifier for this object, following the format `indicator--UUID`.	`indicator--77f01347-e145-5e3c-ba42-a1ca466503a8`
`created`	The time at which this object was originally created.	`2026-08-06T12:06:05Z`
`modified`	The time that this particular version of the object was last modified.	`2026-08-06T12:06:05Z`
`valid_from`	The time from which this Indicator is considered valid.	`2026-08-06T12:06:05Z`
`valid_until`	The time at which this Indicator should no longer be considered valid. Set 30 days after `valid_from`.	`2026-09-05T12:06:05Z`
`created_by_ref`	Specifies the ID of the Identity object that describes the entity that created this object.	`identity--d60fb2ad-4d85-59b8-91e6-987af9279b9a`
`name`	The value of the Indicator being defined. For file indicators this is the SHA-256; for network indicators it is the observable value.	`3ddce244c308f1ce27307b16467f29bd7f3e2333c535cb4a0c5d93a0b7296230`
`description`	A description that provides more details and context about the Indicator.	`Malware file activity was observed`
`confidence`	A value between 0 and 100 that describes the confidence in the correctness of the data contained within this object.	`100`
`indicator_types`	Specifies the type of indicator. For example, `malicious-activity`, `anomalous-activity`.	`malicious-activity`
`pattern_type`	Specifies the type of pattern used. Common values include `stix`, `snort`, `yara`.	`stix`
`pattern`	The detection pattern for the Indicator, expressed in the language defined by `pattern_type`. Each file indicator patterns on a single hash.	`[file:hashes.'SHA-256' = '3ddce244c308f1ce27307b16467f29bd7f3e2333c535cb4a0c5d93a0b7296230']`
`labels`	A set of labels applicable to this Indicator, providing additional context or metadata.	`ReversingLabs`, `PE/Exe`, `Win32`, `Backdoor`, `FormBook`, `sigma-suspicious-activity`, `malicious-network-source`
`external_references`	A list of external references that describe where this Indicator originated from or additional information. Both MITRE ATT&CK tactics (`TA` IDs, described as `Mitre tactic`) and techniques (`T` IDs, described as `Mitre technique`) associated with the indicator are linked here. Technique descriptions note the analysis that produced them, for example `source: dynamic`.	`{"source_name": "mitre", "external_id": "T1055", "description": "Mitre technique \| source: dynamic", "url": "https://attack.mitre.org/techniques/T1055/"}`
`kill_chain_phases`	Specifies the phase of the kill chain that this Indicator is associated with. The Flexible Intel Feed uses the `rl-flexible-intel-feed-kill-chain` kill chain name.	`rl-flexible-intel-feed-kill-chain: middle`
`revoked`	Indicates whether this object has been revoked.	`false`
`more`	Indicates if there are more objects available in the response.	`true`
`next`	A token that can be used to retrieve the next set of objects in a paginated response.	`17562276`

How Your Samples Become Feed Content​

From Sample to TAXII Collection​

Feed Scope Is per Uploader​

Activating the Feed​

Authentication​

Integrations​

Endpoints​

Discovery​

API Root​

Collections​

STIX Objects​

Supported Query Parameters​

Examples​

Poll for Objects​

Filter by Timestamp​

Limit Returned Objects​

Matching​

Paging​

Error Handling​

Object Types​

Response Example​

Example Use Cases​

Bulk Search​

YARA​

Appendix A: Expected STIX Fields​