Feed delivery
Intelligence that merges into your graph, not onto a pile
PrecisionSec delivers STIX 2.1 objects over TAXII 2.x: indicators arrive already linked to the malware they detect, with stable IDs so every hourly update resolves into what your platform already holds instead of stacking up duplicates.
Evaluation credentials · no credit card · work email required
{
"type": "bundle",
"id": "bundle--a1f0937c-0e64-4b2a-9d8f-15c7be02da44",
"objects": [
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--8f2c41d6-5b90-4d33-9a17-2c6f0be4a913",
"created": "2026-08-14T14:00:07.000Z",
"valid_from": "2026-08-14T14:00:07.000Z",
"pattern_type": "stix",
"pattern": "[file:hashes.'SHA-256' = 'e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855']",
"labels": [
"malicious-activity"
]
},
{
"type": "malware",
"spec_version": "2.1",
"id": "malware--4d10c7a2-91ef-4c58-b0d6-7ac3159e26b7",
"name": "AgentTesla",
"is_family": true
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--c73b8e15-4a02-49d7-bb6c-8e1f2a90c4d3",
"relationship_type": "indicates",
"source_ref": "indicator--8f2c41d6-5b90-4d33-9a17-2c6f0be4a913",
"target_ref": "malware--4d10c7a2-91ef-4c58-b0d6-7ac3159e26b7"
},
{
"type": "domain-name",
"spec_version": "2.1",
"id": "domain-name--b6e39f04-2d71-4ab8-8c15-49f0a7d3e5c8",
"value": "mail.example-c2.invalid"
}
]
}Illustrative bundle. Objects arrive with their relationships already built, and stable identifiers mean each refresh merges into the entities you have instead of duplicating them.
Works with
Deploy the same feed across your stack
One collection, several destinations. Every tool below reads the identical STIX 2.1 objects, including the relationships between them.
- Microsoft SentinelIngest through the built-in Threat Intelligence – TAXII connector.
- OpenCTIConnect as a TAXII2 collection or an OpenCTI live stream; objects merge into your existing graph.
- MISPPull the feed directly, or enrich attributes with the PrecisionSec MISP module instead.
- MaltegoPivot from an indicator into the malware and infrastructure it's linked to.
- FortiGateFeed active C2 and malware infrastructure straight into firewall policy.
- Any TAXII 2.x clientStandards-based delivery, no PrecisionSec-specific SDK required.
Frequently asked questions
Version, cadence and access
Which TAXII version does this use?
TAXII 2.x, served from a discovery endpoint with one API root and one collection. Any TAXII 2.x-capable client can connect once you have credentials.
Is the data STIX 2.0 or STIX 2.1?
STIX 2.1. Objects carry stable identifiers, so a client that already holds an earlier version of an object updates it in place rather than creating a duplicate.
How often does the feed update?
Hourly. New and updated objects, indicators, malware entities and the relationships between them, become available on your next poll.
Do I poll, or is there a push option?
TAXII 2.x is poll-based: your client requests new objects from the collection on its own schedule. OpenCTI users can alternatively subscribe to a live stream instead of polling.
What happens if I ingest the same object twice?
Nothing duplicates. Every object keeps the same STIX ID across refreshes, so a client that deduplicates on ID (as OpenCTI, MISP and Sentinel all do) merges it into what it already has.
How do I get credentials?
Request evaluation credentials below. We'll follow up with your bearer token and the setup guide for your specific client.
Is STIX/TAXII included in the 15-day trial?
Yes. A trial evaluation includes STIX/TAXII access alongside CSV, JSON and REST API delivery, so you can test it against your actual client before committing.
Get started
Request STIX/TAXII evaluation credentials
Tell us which client you're connecting and we'll follow up as quickly as we can with a bearer token and setup help.
Evaluate STIX/TAXII delivery in your stack
Request evaluation credentials and connect your SIEM, TIP or threat-hunting tool to a live, hourly-updated STIX 2.1 collection.