> ## Documentation Index
> Fetch the complete documentation index at: https://docs.pulsedive.com/llms.txt
> Use this file to discover all available pages before exploring further.

# STIX/TAXII Reference

> Export indicators and threats using industry-standard STIX format through our TAXII 2.1 endpoint.

<Callout icon="map-pin" color="#8b5cf6" iconType="regular">
  To use this endpoint, you must have a Pulsedive [Pro](https://pulsedive.com/about/pro) or [Feed](https://pulsedive.com/about/feed) plan.
  Your export access and permissions are determined by your plan.
</Callout>

Pulsedive supports exporting indicators and threats using the STIX 2.1 format through a TAXII 2.1 server.

<Note>
  **Quick setup**: To jump right into configuring a supported third-party client, check out our [Quick Setup](/taxii/quick-setup) guide with common configuration parameters.
</Note>

## What is STIX/TAXII?

**STIX** (Structured Threat Information eXpression) is a standardized format for representing threat intelligence data.
**TAXII** (Trusted Automated eXchange of Intelligence Information) is the protocol for sharing STIX data between systems.

Pulsedive's TAXII server enables bulk exporting of threat intelligence data for integration into security platforms, SIEM systems, and threat intelligence tools.

## How TAXII Works

TAXII follows a simple three-step process:

1. **Discover the server**: Find available API roots and their capabilities.
2. **Browse collections**: Identify which collections contain the data you need.
3. **Retrieve objects**: Download STIX objects with optional filtering and pagination.

Each step provides the information needed for the next, creating a self-describing API structure that is easy to integrate with existing tools.

## Supported Standards

Pulsedive supports the latest versions of both specifications:

* **STIX 2.1**: Fully supported
* **TAXII 2.1**: Fully supported

STIX/TAXII 2.0 and earlier aren't supported.

## Pulsedive Extensions

Pulsedive extends the standard TAXII specification with additional features:

* **Enhanced filtering**: Filter by risk level, indicator type, retirement status, and more.
* **Flexible timestamps**: Filtering accepts both STIX format (`YYYY-MM-DDTHH:MM:SS.MMMZ`) and Pulsedive format (`YYYY-MM-DD HH:MM:SS`).
* **Query string authentication**: Use your API key in URL parameters for easier testing.
* **Flexible version negotiation**: Accept media types via query string for debugging.

TAXII requires servers to negotiate the TAXII version via the media type in the `Accept` HTTP header.
Pulsedive can accept the media type via the `accept` parameter in the query string for debugging purposes.
To learn more, visit [Versioning](/taxii/versioning/).

These extensions make integration easier while maintaining full TAXII 2.1 compatibility.

<Tip>
  **Try before you buy**: Evaluate our TAXII service using the free test collection with live Pulsedive data.
  You only need a free API key.
  Get one by [signing up for a free account](https://pulsedive.com/register).
</Tip>

## Resources

To learn more about the STIX and TAXII standards, visit:

* [OASIS Open CTI Documentation](https://oasis-open.github.io/cti-documentation/): Official documentation with sample data and additional resources.
* [STIX 2.1 Specification](https://docs.oasis-open.org/cti/stix/v2.1/cs02/stix-v2.1-cs02.html): Official formatting reference.
* [TAXII 2.1 Specification](https://docs.oasis-open.org/cti/taxii/v2.1/cs01/taxii-v2.1-cs01.html): Official protocol reference.