Skip to main content
TAXII 2.1 is the OASIS protocol for exchanging STIX over HTTPS. Clients discover API roots, list collections, and poll objects — the same workflow CERTs and MSSPs already use for commercial TI.

​
How it works (Reyhford)

  1. Discovery — GET /taxii2/ (public)
  2. Collections — GET /taxii2/collections/ (API key)
  3. Objects — GET /taxii2/collections/{id}/objects/ (API key, supports added_after, limit)
Base URL: https://reyhford.com/api (see Quickstart).

​
Why TAXII matters for National CERTs

TAXII is the interoperability layer between vendors. Reyhford’s ICS honeypot feed plugs into the same automation that already ingests commercial and ISAO feeds — no custom agent required.

​
Personal sensor collections

Customer-enrolled sensors can expose a sensor-scoped TAXII collection (org-owned) so operators see attacks hitting their own sensor without receiving only the pooled feed. See authentication and portal sensor setup. Next: Indicators of Compromise, Confidence scoring.