Skip to main content
If you’re already familiar with TAXII, use these configuration values for commonly used TAXII clients. We support STIX/TAXII version 2.1.

​
Server Endpoints

Your TAXII client may ask for one or both of these values:

​
Authentication

All TAXII requests use HTTP Basic authentication:

​
Available Collections

Available collections include:
CollectionIDAccess Level
Test collection981c4916-ebb2-4567-aece-54ae970c4230Free (live sample data)
Indicator collectiona5cffbfe-c0ff-4842-a235-cb3a7a040a37Feed plan required
Threat collectiondc9ecfa5-7769-4cf3-b699-38a9776b431dFeed plan required
You need a Pulsedive API key for all requests, including access to the free test collection. Create a free account to get your API key.

​
Platform Configuration

Configure Pulsedive’s TAXII server with these platform-specific settings for popular threat intelligence tools.
Try before you buy: Evaluate our TAXII service using the free test collection with live Pulsedive data. You only need a free API key. Get one by signing up for a free account.

​
Microsoft Azure Sentinel

Use Microsoft Azure Sentinel’s native TAXII data connector with the server endpoints and authentication details above. Visit Microsoft’s official blog post for detailed setup instructions.

​
OpenCTI (Native TAXII Import)

OpenCTI supports native automated import for several formats, including TAXII. Configure OpenCTI’s TAXII 2.1 import using these values:
  • TAXII Server URL: https://pulsedive.com/taxii2/api/
  • Username: taxii2
  • Password: <YOUR_API_KEY>
  • Collection IDs: Select from the collection IDs above

​
OpenCTI (Legacy TAXII2 Connector)

For older OpenCTI versions that don’t support native automated import for TAXII, use the TAXII2 connector. Configure these environment variables: 
TAXII2_V21=true
TAXII2_DISCOVERY_URL=https://pulsedive.com/taxii2/
TAXII2_USERNAME=taxii2
TAXII2_PASSWORD=<YOUR_API_KEY> # Create a free Pulsedive account to get an API key.
TAXII2_COLLECTIONS=api.Pulsedive test data,api.Pulsedive indicator data,api.Pulsedive threat data
Legacy connectors use collection names instead of IDs. The names above correspond to the Test, Indicator, and Threat collections, respectively. Adjust these values depending on which collections you want to ingest.