PrecisionSec publishes the ClickFix feed as its own STIX/TAXII 2.1 collection, separate from the full PrecisionSec TAXII2 feed. It carries only ClickFix indicators, so you can pull it straight into a TIP, SIEM or firewall without filtering out unrelated malware families. For the full multi-family feed, see the STIX/TAXII Integration Guide instead.
Credentials required. If you have not yet received your free ClickFix feed credentials, sign up here.
The feed uses TAXII 2.1. Use the following connection details:
| Field | Value |
|---|---|
| Discovery URL | https://opencti.precisionsec.com/taxii2 |
| API Root URL | https://opencti.precisionsec.com/taxii2/root/ |
| Collection Title | PrecisionSec ClickFix Feed |
| Collection ID | 615e5a98-c0c3-4680-9a46-39b09ecbca49 |
| Collection URL | https://opencti.precisionsec.com/taxii2/root/collections/615e5a98-c0c3-4680-9a46-39b09ecbca49/ |
| Authentication | Bearer token (or HTTP Basic username/password) |
Configure your TAXII client to send your API token as an Authorization: Bearer <token> header on all requests. If your client only supports username and
password (e.g. Microsoft Sentinel), use HTTP Basic authentication with the same
credentials instead.
What’s in the collection
The collection contains STIX indicator objects only — no observables,
malware or campaign objects — labelled clickfix, authored by PrecisionSec,
and refreshed within the last 60 days. If you need the underlying observables
or the broader relationship graph, use the full feed instead.
Microsoft Sentinel
Follow the Microsoft Sentinel Integration Guide, substituting the Collection ID above for the full-feed one in step 2.
Troubleshooting
- 401 / authentication error — the bearer token or username/password is missing or incorrect. Re-check the credentials from your sign-up email.
- Only one collection listed — expected. ClickFix credentials are scoped to this collection and cannot see the full PrecisionSec TAXII2 feed.
- No objects returned — check that your client’s own polling window isn’t narrower than the feed’s 60-day lookback, and that you’re pointed at the Collection ID above rather than the full feed’s.