Configure TAXII for the Trend Threat Intelligence feed

Procedure

1. Ensure you have a Trend Vision One API token. See Set up the API for Trend Threat Intelligence Feed.
2. Identify your regional TAXII 2.1 discovery URL.

   Region	TAXII feed URL
   United States	https://api.xdr.trendmicro.com/v3.0/threatintel/feeds/taxii2
   European Union	https://api.xdr.trendmicro.com/v3.0/threatintel/feeds/taxii2
   Singapore	https://api.sg.xdr.trendmicro.com/v3.0/threatintel/feeds/taxii2
   Japan	https://api.xdr.trendmicro.co.jp/v3.0/threatintel/feeds/taxii2
   Australia	https://api.au.xdr.trendmicro.com/v3.0/threatintel/feeds/taxii2
   India	https://api.in.xdr.trendmicro.com/v3.0/threatintel/feeds/taxii2
   United Arab Emirates	https://api.mea.xdr.trendmicro.com/v3.0/threatintel/feeds/taxii2

3. Ensure requests include these required headers:
   • Authorization: Bearer <yourvisiononeapitoken>
   • Accept: application/taxii+json; version=2.1
4. Query server and API root endpoints using the regional TAXII 2.1 URL table above. The collection ID targets a specific threat data object.
   • GET <TAXII_DISCOVERY_URL>
   • Retrieve API root information: GET <TAXII_DISCOVERY_URL>/api/collections
   • List collections: GET <TAXII_DISCOVERY_URL>/api/collections

   Purpose	API path	URL parameters	Data type	Parameter description
   Server discovery	GET /taxii2/
   Get API root information	GET /taxii2/api/
   Get collections	GET /taxii2/api/collections/
   Get a collection	GET /taxii2/api/collections/91a7b528-80eb-42ed-a74d-c6fbd5a26116
   Get STIX objects	GET /taxii2/api/collections/91a7b528-80eb-42ed-a74d-c6fbd5a26116/objects/	added_after	String, ISO8601 timestamp	Only return objects with date_added greater than the specified value
   		limit	String	Number of objects per page Default: 1,000 Min: 1,000 Max: 10,000
   		match[id]	String	Filter by specific object ID
   		match[type]	String	Filter by object type
   		next	String	Pagination token to retrieve the next page of results
   Get a STIX object	GET /taxii2/api/collections/91a7b528-80eb-42ed-a74d-c6fbd5a26116/objects/{object_id}	added_after	String, ISO8601 timestamp	Only return objects with date_added greater than the specified value
   Get object manifests	GET /taxii2/api/collections/91a7b528-80eb-42ed-a74d-c6fbd5a26116/manifest/	added_after	String, ISO8601 timestamp	Only return objects with date_added greater than the specified value
   		limit	String	Number of objects per page Default: 1,000 Min: 1,000 Max: 10,000
   		match[id]	String	Filter by specific object ID
   		match[type]	String	Filter by object type
   		next	String	Pagination token to retrieve the next page of results

5. Refer to the below Python example to authenticate and count objects.
   Packages:

   • taxii2-client
   • requests

   import requests
   from taxii2client.v21 import Server
   
   DISCOVERY_URL = "<your regional TAXII discovery URL>"
   TOKEN = "<your Vision One API token>"
   
   class BearerAuth(requests.auth.AuthBase):
       def __init__(self, token):
           self.token = token
       def __call__(self, r):
           r.headers["Authorization"] = f"Bearer {self.token}"
           return r
   
   # Get server
   server = Server(DISCOVERY_URL, auth=BearerAuth(TOKEN))
   print(f'Server title: {server.title}')
   print(f'API Roots: {server.api_roots}')
   
   # Get API root
   api_root = server.api_roots[0]
   print(f'\nAPI Root title: {api_root.title}')
   
   # Get collections
   collections = api_root.collections
   print('\nCollections:')
   for col in collections:
       print(f'- {col.title} (id: {col.id})')
   
   # Get collection
   collection = collections[0]
   # or collection = Collection(f'{DISCOVERY_URL}/api/collections/91a7b528-80eb-42ed-a74d-c6fbd5a26116/, auth=BearerAuth(TOKEN))
   print(f'\nCollection Info:\nID: {collection.id}\nTitle: {collection.title}')
   
   # Get manifest
   manifest = collection.get_manifest()
   print(f'\nManifest:\n{json.dumps(manifest, indent=2)}')
   
   # Get a STIX Object
   try:
       empty_object = collection.get_object('object-id')
       print(f'\nSTIX Object (empty):\n{json.dumps(empty_object, indent=2)}')
   except Exception as error:
       print(f'Object is not found: {error}')
   
   # Get STIX objects, single page
   objects = collection.get_objects()
   print('\nSTIX Objects:')
   for obj in objects['objects']:
       print(json.dumps(obj, indent=2))
   
   # Get STIX objects with match["id"]
   objs_by_id = collection.get_objects(id='campaign--8e3e4a78-1b6c-4b4c-97c0-d90f5fcbdc12')
   print(f'\nSTIX Objects (with match["id"]):\n{json.dumps(objs_by_id, indent=2)}')
   
   # Get STIX objects with match["type"]
   objs_by_type = collection.get_objects(type='campaign')
   print(f'\nSTIX Objects (with match["type"]):\n{json.dumps(objs_by_type, indent=2)}')
   
   # Get STIX objects with as_pages
   print('\nSTIX Objects (as_pages):')
   yesterday = datetime.datetime.now() - datetime.timedelta(days=1)
   for i, bundle in enumerate(as_pages(collection.get_objects, added_after=yesterday, per_request=1000), 1):
       print(f'Page {i}: {len(bundle["objects"])} {bundle["objects"][-1]["created"]}')