Skip to main content
OneFirewall exposes its threat intelligence through a TAXII 2.1 server, alongside the existing REST API and STIX 2.0 lookup endpoint. Any TAXII 2.1-compatible client — MISP, OpenCTI, Anomali, or a custom ingestion pipeline — can discover, pull, and (new) push OneFirewall indicators using the standard TAXII discovery/collections model, instead of a custom integration against the REST feeds.
TAXII 2.1 logo

​
Pull: Discover and Sync Indicators

  • Discovery — GET /taxii2/ returns the server title, description, and the available API Root.
  • API Root — GET /taxii2/onefirewall/ exposes server-wide information and the supported TAXII version.
  • Collections — GET /taxii2/onefirewall/collections/ lists three collections, each a live, consensus-scored view over OneFirewall’s shared threat data:
    • ip-indicators — malicious IPv4 addresses
    • domain-indicators — malicious domains
    • url-indicators — malicious URLs
  • Objects — GET .../collections/{collection-id}/objects/ returns STIX 2.1 Indicator objects, with standard added_after, limit, and next pagination for efficient incremental sync.
  • Manifest — GET .../collections/{collection-id}/manifest/ returns lightweight id/date_added/version metadata without full object content, for clients that want to check what’s changed before fetching.
  • Single object lookup — GET .../collections/{collection-id}/objects/{object-id}/ fetches one indicator by its STIX id.
Each Indicator is generated live from OneFirewall’s own consensus scoring — IPv4 scores reflect real-time decay by age, exactly as they do in the REST feeds. Every indicator’s STIX id is deterministic (derived from the indicator value itself), so repeated syncs are stable and safe to de-duplicate against.

​
New: Push Indicators via TAXII

Collections are now writable. POST .../collections/{collection-id}/objects/ accepts a standard TAXII envelope of up to 50 STIX 2.1 Indicator objects per call and submits them through the same validation and scoring pipeline as the REST API — so a TAXII push behaves identically to a normal OneFirewall submission, just over the standard TAXII wire format. The server responds with a TAXII Status resource reporting per-object success or failure, so a client submitting a mixed batch can see exactly which indicators were accepted:
A TAXII submission always contributes to the shared consensus score — it never forces an explicit block/allow decision on your own firewall, and never auto-forwards to the OneFirewall Alliance network. Those remain deliberate, explicit actions via the REST API.

​
Authentication & Access

The TAXII server uses the same credentials as the rest of the OneFirewall API — no separate signup or key required:
  • Bearer JWT (or HTTP Basic, for service accounts) — identical to REST API auth.
  • Requires your organization’s plan to include Threat Intel access, same as the existing STIX lookup endpoint.
  • Reading objects/manifests is metered against your normal OneFirewall token balance; discovery and the collection listing are free.

​
Summary

  • Two-way interoperability — pull the shared feed and push findings back into it through any TAXII 2.1-native platform, without building a custom REST integration.
  • Standard pagination and filtering — added_after/next behave the same as in other TAXII feeds.
  • Shared authentication — the same organization, token, and access scope work across the REST API, the STIX lookup endpoint, and TAXII.