Skip to main content
To use this endpoint, you must have a Pulsedive Pro or Feed plan. Your export access and permissions are determined by your plan.
Pulsedive supports exporting indicators and threats using the STIX 2.1 format through a TAXII 2.1 server.
Quick setup: To jump right into configuring a supported third-party client, check out our Quick Setup guide with common configuration parameters.

​
What is STIX/TAXII?

STIX (Structured Threat Information eXpression) is a standardized format for representing threat intelligence data. TAXII (Trusted Automated eXchange of Intelligence Information) is the protocol for sharing STIX data between systems. Pulsedive’s TAXII server enables bulk exporting of threat intelligence data for integration into security platforms, SIEM systems, and threat intelligence tools.

​
How TAXII Works

TAXII follows a simple three-step process:
  1. Discover the server: Find available API roots and their capabilities.
  2. Browse collections: Identify which collections contain the data you need.
  3. Retrieve objects: Download STIX objects with optional filtering and pagination.
Each step provides the information needed for the next, creating a self-describing API structure that is easy to integrate with existing tools.

​
Supported Standards

Pulsedive supports the latest versions of both specifications:
  • STIX 2.1: Fully supported
  • TAXII 2.1: Fully supported
STIX/TAXII 2.0 and earlier aren’t supported.

​
Pulsedive Extensions

Pulsedive extends the standard TAXII specification with additional features:
  • Enhanced filtering: Filter by risk level, indicator type, retirement status, and more.
  • Flexible timestamps: Filtering accepts both STIX format (YYYY-MM-DDTHH:MM:SS.MMMZ) and Pulsedive format (YYYY-MM-DD HH:MM:SS).
  • Query string authentication: Use your API key in URL parameters for easier testing.
  • Flexible version negotiation: Accept media types via query string for debugging.
TAXII requires servers to negotiate the TAXII version via the media type in the Accept HTTP header. Pulsedive can accept the media type via the accept parameter in the query string for debugging purposes. To learn more, visit Versioning. These extensions make integration easier while maintaining full TAXII 2.1 compatibility.
Try before you buy: Evaluate our TAXII service using the free test collection with live Pulsedive data. You only need a free API key. Get one by signing up for a free account.

​
Resources

To learn more about the STIX and TAXII standards, visit: