Overview
Customers who use OpenCTI as their threat intelligence platform can ingest Axur IOCs directly via the TAXII server, without the need for additional development. The integration is performed directly through the OpenCTI interface by simply filling in the configuration fields with the credentials and endpoint listed in the Axur API documentation.
Prerequisites
Active access to OpenCTI (self-hosted or SaaS)
Administrator or equivalent permissions in OpenCTI to create ingestion connectors
Axur platform API key
Step by Step
1. Access the ingestion area
After logging into OpenCTI, access the Ingestion tab through the left-side menu (bottom section) or directly via the URL:
<your-opencti-server>/dashboard/data/ingestion/connectors
2. Create a TAXII Feed
On the connectors screen:
Click TAXII Feeds
Click CREATE TAXII FEED
Fill in the fields according to the image below.
Notes:
The endpoint and collection ID can be obtained from the Axur API documentation (CTI TAXII Server)
The token is the same as the platform token and can be created in the user settings panel
(https://one.axur.com/preferences?tab=api-keys)The required collection is the IOCs collection
3. Activate the connector
After creation, the connector is disabled by default. To activate it:
Locate the created connector in the list
Click the three-dot icon (⋮) in the options
Select Start
ℹ️ If the button displayed is Stop, the connector is already active.
From this point on, the IOCs will begin to be received normally in OpenCTI.
Frequently Asked Questions
Is any development or custom script required?
No. OpenCTI has native TAXII integration. Simply fill in the fields in the interface.
Where can I find information about Axur’s STIX/TAXII server?
In the official Axur API documentation, available to customers who have CTI contracted.
Where can I get my API key?
In the user settings page of the Axur platform.
Are the IOCs automatically updated after activation?
Yes. Once active, the connector performs ingestion continuously according to the configured frequency.
If you have any questions, feel free to reach out at [email protected] 😊