# TAXII Feed Subscription (TCTF-0003) — Spectra Intelligence

> Query the Spectra Intelligence Flexible Intel Feed (TCTF-0003) via TAXII 2.1 to receive private STIX 2.1 IOCs scoped to your account's submissions, with OpenCTI integration support.

The **Flexible Intel Feed** is a curated, private threat intelligence feed delivered via the [TAXII 2.1](https://docs.oasis-open.org/cti/taxii/v2.1/os/taxii-v2.1-os.html) protocol in [STIX 2.1](https://docs.oasis-open.org/cti/stix/v2.1/os/stix-v2.1-os.html) format.

This feed provides structured Indicators of Compromise (IOCs) based on your organization's submissions to Spectra Intelligence. The data is enriched with context from across the ReversingLabs product portfolio and made available through a TAXII-compatible API.

- The feed is **read-only**.
- Data is scoped to your Spectra Intelligence account configured on the Spectra Analyze appliance.
- Supports integration with third-party platforms like **OpenCTI**.
- A typical usage pattern is to poll the objects endpoint regularly using the `added_after` filter.

**Note: **Retention period**: The feed contains data submitted within the past **30 days**.**


Feed access is authenticated and personalized per account. Each user is assigned a unique TAXII collection, available under a dedicated API root.

## Enable Feed (Authentication & Access)

**Important: To enable the feed and obtain connection credentials, refer to the Spectra Analyze [Flexible Intel Feed](/SpectraAnalyze/Administration/integrations-connectors/flexible-intel-feed/) documentation.**


Once the feed is enabled, Spectra Analyze displays a pop-up with the connection details:

- **TAXII Discovery URL**

  The FIF feed supports the global TAXII discovery endpoint:

  `https://data.reversinglabs.com/api/taxii/taxii2/`

- **API Root**

  The API root for FIF is:

  `https://data.reversinglabs.com/api/taxii/flexible-intel-feeds/`

- **Collection ID**

  A unique ID assigned to your Spectra Intelligence account. Used to query your private STIX feed.

- **Username**

  Your Spectra Intelligence username with `/fif` appended

  Example: `u/company/user/a1000` → `u/company/user/a1000/fif`

- **Password**

  Shown only once in the UI. Save it securely or regenerate it if lost.

---

### Authentication

Access to the Flexible Intel Feed requires **Basic Authentication** using credentials provided when the feed was enabled.

All requests must include:

```http
Authorization: Basic <base64(username:password)>
Accept: application/taxii+json;version=2.1
User-Agent: ReversingLabs TAXII FIF Public Docs Example
```

---

## Endpoints

### Discovery

```
GET https://data.reversinglabs.com/api/taxii/taxii2/
```

Returns a list of available TAXII API roots.

---

### API Root

```
GET https://data.reversinglabs.com/api/taxii/flexible-intel-feeds/
```

Describes the Flexible Intel Feed root and its associated collections.

---

### Collections

```
GET https://data.reversinglabs.com/api/taxii/flexible-intel-feeds/collections/
```

Returns the list of collections available under this root. Each user receives a single private collection.

### STIX Objects

Retrieves STIX 2.1 objects from your private feed collection.

```
GET https://data.reversinglabs.com/api/taxii/flexible-intel-feeds/collections/<collection-id>/objects/
```

### Supported Query Parameters

| Parameter     | Description                                                                                                      |
| ------------- | ---------------------------------------------------------------------------------------------------------------- |
| `added_after` | RFC 3339 / ISO 8601 timestamp. Returns only objects added after the given time.                                  |
| `limit`       | Maximum number of objects per response. Supported range: **1–500**.                                              |
| `match[type]` | Comma-separated list of STIX object types to filter on (e.g. `indicator`, `malware`, `threat-actor`).            |
| `next`        | Pagination token for retrieving the next batch of results. Returned in the response when more data is available. |

Use these parameters when polling the objects endpoint.

#### Example

```
curl --location 'https://data.reversinglabs.com/api/taxii/flexible-intel-feeds/collections/49f2c125-4854-5a12-a0fd-62400f5a7af7/objects/?added_after=2025-06-09T11%3A00%3A00.000Z&limit=500' \
  --header 'Accept: application/taxii+json;version=2.1' \
  --header 'User-Agent: ReversingLabs TAXII FIF Public Docs Example' \
  --header 'Authorization: Basic <base64_token>'
```

## Response Example

### Object Types

The feed returns STIX 2.1 objects wrapped in a `{"objects": [...]}` structure.

Typical object types include:

- `url`, `domain-name`, `ipv4-addr`, `file`: Basic observable IOCs
- `indicator`: Structured detection logic (e.g. "match if SHA256 is X")
- `malware`: Classification and metadata about malware families
- `relationship`: Links between objects (e.g., "this indicator indicates this malware")

The object structure follows the [STIX 2.1 specification](https://docs.oasis-open.org/cti/stix/v2.1/os/stix-v2.1-os.html).

```json
{
  "objects": [
    {
      "id": "url--8e9478a4-ea09-5679-8b79-9661ee249f68",
      "type": "url",
      "value": "http://down.yueshou.net",
      "spec_version": "2.1"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9e7e69a6-7782-5be1-91a9-faa524e4e4b2",
      "created": "2025-06-09T11:09:41Z",
      "modified": "2025-06-09T11:09:41Z",
      "created_by_ref": "identity--b0228148-e101-5bcb-ae0f-220c1a65f2f0",
      "relationship_type": "based-on",
      "source_ref": "indicator--af979875-b9b8-5dd4-9417-66e1560bcd23",
      "target_ref": "url--8e9478a4-ea09-5679-8b79-9661ee249f68"
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--af979875-b9b8-5dd4-9417-66e1560bcd23",
      "created": "2025-06-09T11:09:41Z",
      "modified": "2025-06-09T11:09:41Z",
      "valid_from": "2025-06-09T11:09:41Z",
      "valid_until": "2025-07-09T11:09:41Z",
      "created_by_ref": "identity--b0228148-e101-5bcb-ae0f-220c1a65f2f0",
      "name": "http://down.yueshou.net",
      "description": "Malware file was observed to contact an URL",
      "confidence": 60,
      "indicator_types": ["malicious-activity"],
      "pattern_type": "stix",
      "pattern": "[url:value = 'http://down.yueshou.net']",
      "labels": ["ReversingLabs", "sample-source"]
    },
    {
      "id": "domain-name--d4bb29e6-946c-5718-9179-5d49f9656337",
      "type": "domain-name",
      "value": "bzqcb.kxq79.com",
      "spec_version": "2.1"
    },
    {
      "id": "file--d0ad5c70-a0b4-5585-beeb-1f8b6879c4c6",
      "type": "file",
      "hashes": {
        "SHA-1": "62defcf5a81f6def01e80822cec8f5cac8e5c807",
        "SHA-256": "ef087454771bc2a6bd9a00d110451baa2ba79ca58be7339b7e05abcc3eeb4a62",
        "MD5": "68ad68a69313bc151f2de06e3d68f4f0"
      },
      "size": 2347784,
      "name": "62defcf5a81f6def01e80822cec8f5cac8e5c807.rl"
    }
  ]
}
```

---

## Example Use Cases

Any file submitted to Spectra Intelligence becomes part of the Flexible Intel Feed, whether submitted manually, via API, through connectors, or from features like Bulk Search or YARA matching. Once analyzed, any verified malicious content is enriched with ReversingLabs metadata and exposed in STIX format via the TAXII API.

You can use this mechanism to enrich IOCs from multiple workflows, such as:

### Bulk Search

1. Log into [Spectra Analyze](/SpectraAnalyze/).

2. Perform a [Bulk Search](/SpectraAnalyze/search-page/#bulk-search): Paste a list of unstructured IOCs (e.g., hashes or URLs) copied from another threat source

3. Review the Cloud matches, then select [Fetch and Analyze](/SpectraAnalyze/search-page/#spectra-intelligence-sample-actions).

   If automatic uploads to Spectra Intelligence are disabled on the appliance, you can:

   - Use **Fetch and Analyze (Advanced)** and check the Spectra Intelligence option
   - Download the samples, then submit them to Spectra Intelligence using the **Reanalyze** sample action

4. The appliance will analyze the retrieved files. Any verified malicious IOCs will be enriched with ReversingLabs metadata and included in your Flexible Intel Feed.

This workflow converts external threat data into enriched, structured STIX IOCs accessible via TAXII — ready for integration into downstream tools like OpenCTI.

### YARA

1. Log into [Spectra Analyze](/SpectraAnalyze/).
2. [Deploy a YARA](/SpectraAnalyze/yara/#creating-new-yara-rulesets) rule to perform a live or retroactive hunt.
3. Review the Cloud matches, then select [Fetch and Analyze](/SpectraAnalyze/yara/#managing-yara-ruleset-matches).

   If automatic uploads to Spectra Intelligence are disabled on the appliance, you can:

   - Use **Fetch and Analyze (Advanced)** and check the Spectra Intelligence option
   - Download the samples, then submit them to Spectra Intelligence using the **Reanalyze** sample action

4. The appliance will analyze the retrieved files and populate the Flexible Intel Feed with any verified malicious IOCs.

This enables you to extend **YARA-based detection** into a structured intelligence workflow, turning raw match results into curated, machine-readable STIX indicators.
