Configure TAXII for the Trend Threat Intelligence feed

Procedure

1. Ensure you have a Trend Vision One API token. See Set up the API for Trend Threat Intelligence Feed.
2. Identify your regional TAXII 2.1 discovery URL.

   Region	TAXII feed URL
   United States	https://api.xdr.trendmicro.com/v3.0/threatintel/feeds/taxii2
   European Union	https://api.xdr.trendmicro.com/v3.0/threatintel/feeds/taxii2
   Singapore	https://api.sg.xdr.trendmicro.com/v3.0/threatintel/feeds/taxii2
   Japan	https://api.xdr.trendmicro.co.jp/v3.0/threatintel/feeds/taxii2
   Australia	https://api.au.xdr.trendmicro.com/v3.0/threatintel/feeds/taxii2
   India	https://api.in.xdr.trendmicro.com/v3.0/threatintel/feeds/taxii2
   United Arab Emirates	https://api.mea.xdr.trendmicro.com/v3.0/threatintel/feeds/taxii2

3. Authenticate all requests with either basic or bearer token authentication.
   • Basic authentication
     • Username: your_business_id
       Locate your business ID:
       1. From the profile menu, select Business Profile.
       2. Copy the Business ID under Registered Business.
     • Password: your_vision_one_api_token
   • Bearer token authentication
     • Authorization: Bearer <your_vision_one_api_token>
4. Include the following HTTP header in every request:
   • Accept: application/taxii+json;version=2
5. Query server and API root endpoints using the regional TAXII 2.1 URL table above. The collection ID targets a specific threat data object.
   • GET <TAXII_DISCOVERY_URL>
   • Retrieve API root information: GET <TAXII_DISCOVERY_URL>/api/collections
   • List collections: GET <TAXII_DISCOVERY_URL>/api/collections

   Purpose	API path	URL parameters	Data type	Parameter description
   Server discovery	GET /taxii2/
   Get API root information	GET /taxii2/api/
   Get collections	GET /taxii2/api/collections/
   Get a collection	GET /taxii2/api/collections/91a7b528-80eb-42ed-a74d-c6fbd5a26116
   Get STIX objects	GET /taxii2/api/collections/91a7b528-80eb-42ed-a74d-c6fbd5a26116/objects/	added_after	String, ISO8601 timestamp	Only return objects with date_added greater than the specified value
   		limit	String	Number of objects per page Default: 1,000 Min: 1,000 Max: 10,000
   		match[id]	String	Filter by specific object ID
   		match[type]	String	Filter by object type
   		next	String	Pagination token to retrieve the next page of results
   Get a STIX object	GET /taxii2/api/collections/91a7b528-80eb-42ed-a74d-c6fbd5a26116/objects/{object_id}	added_after	String, ISO8601 timestamp	Only return objects with date_added greater than the specified value
   Get object manifests	GET /taxii2/api/collections/91a7b528-80eb-42ed-a74d-c6fbd5a26116/manifest/	added_after	String, ISO8601 timestamp	Only return objects with date_added greater than the specified value
   		limit	String	Number of objects per page Default: 1,000 Min: 1,000 Max: 10,000
   		match[id]	String	Filter by specific object ID
   		match[type]	String	Filter by object type
   		next	String	Pagination token to retrieve the next page of results

6. Refer to the below Python example to authenticate and count objects.
   Packages:

   • taxii2-client
   • requests

   import requests
   from taxii2client.v21 import Server
   
   
   DISCOVERY_URL = 'https://api.xdr.trendmicro.com/v3.0/threatintel/feeds/taxii2'  # Please refer to appendix: Trend Micro Threat Intelligence Feed for TAXII Discovery URL
   TOKEN = '...'  # Trend Micro Vision One API Token
   BUSINESS_ID = '...'  # Your Business ID
   
   
   class BearerAuth(requests.auth.AuthBase):
       def __init__(self, token):
           self.token = token
       def __call__(self, r):
           r.headers['Authorization'] = f'Bearer {self.token}'
           return r
   
   # Get Server
   # AuthBasic Authentication
   server = Server(DISCOVERY_URL, user=BUSINESS_ID, password=TOKEN)
   # Bearer Token Authentication
   server = Server(DISCOVERY_URL, auth=BearerAuth(TOKEN))
   print(f'Server title: {server.title}')
   print(f'API Roots: {server.api_roots}')
   
   # Get API Root
   api_root = server.api_roots[0]
   print(f'\nAPI Root title: {api_root.title}')
   
   # Get Collections
   collections = api_root.collections
   print('\nCollections:')
   for col in collections:
       print(f'- {col.title} (id: {col.id})')
   
   # Get Collection
   collection = collections[0]
   # or collection = Collection(f'{DISCOVERY_URL}/api/collections/91a7b528-80eb-42ed-a74d-c6fbd5a26116/, auth=BearerAuth(TOKEN))
   print(f'\nCollection Info:\nID: {collection.id}\nTitle: {collection.title}')
   
   # Get Manifest
   manifest = collection.get_manifest()
   print(f'\nManifest:\n{json.dumps(manifest, indent=2)}')
   
   # Get a STIX Object
   try:
       empty_object = collection.get_object('object-id')
       print(f'\nSTIX Object (empty):\n{json.dumps(empty_object, indent=2)}')
   except Exception as error:
       print(f'Object is not found: {error}')
   
   # Get STIX Objects (single page)
   objects = collection.get_objects()
   print('\nSTIX Objects:')
   for obj in objects['objects']:
       print(json.dumps(obj, indent=2))
   
   # Get STIX Objects (with match["id"])
   objs_by_id = collection.get_objects(id='campaign--8e3e4a78-1b6c-4b4c-97c0-d90f5fcbdc12')
   print(f'\nSTIX Objects (with match["id"]):\n{json.dumps(objs_by_id, indent=2)}')
   
   # Get STIX Objects (with match["type"])
   objs_by_type = collection.get_objects(type='campaign')
   print(f'\nSTIX Objects (with match["type"]):\n{json.dumps(objs_by_type, indent=2)}')
   
   # Get STIX Objects (with as_pages)
   print('\nSTIX Objects (as_pages):')
   yesterday = datetime.datetime.now() - datetime.timedelta(days=1)
   for i, bundle in enumerate(as_pages(collection.get_objects, added_after=yesterday, per_request=1000), 1):
       print(f'Page {i}: {len(bundle["objects"])} {bundle["objects"][-1]["created"]}')