PAGES
← all tools
◆ Threat Intelligence

opentaxii

0.9.3 open-source

Python implementation of TAXII server services for sharing cyber threat intelligence.

source ↗ website ↗ rss ↗ What is a cyber toolchain?

Summary

opentaxii is an open-source TAXII server, written in Python, that lets organizations share and receive cyber threat intelligence over the TAXII 1.1 and 2.1 protocols. It runs as a service, either installed from PyPI or launched via the provided Docker image, storing data in SQLite or another SQLAlchemy-supported database and configurable through CLI commands for setting up API roots, collections, and access permissions. It is aimed at threat-intelligence teams and the engineers who operate STIX/TAXIISTIX/TAXIISTIX is an OASIS-maintained JSON schema for expressing threat intelligence objects; TAXII is the companion HTTP protocol for exchanging them, giving cyber tools a vendor-neutral way to share indicators and threat data. feeds for their organization, rather than at analysts consuming intelligence directly. Its README notes compatibility with Cabby, the TAXII client library, and it comes from EclecticIQ, positioning it as core infrastructure for TAXII-based sharing rather than a competing product.

Python implementation of TAXII server services for sharing cyber threat intelligence.

How opentaxii helps

Which of my partners can pull our threat intelligence without us managing their credentials?

API roots and collections can be configured for public read access, so a feed can be exposed without provisioning an account for every consumer

Which feeds do outside organizations have permission to write into versus only read from?

access permissions are set per collection through the account and API root configuration, distinguishing public write from public read from restricted access

Can a partner running an older TAXII client still pull our feed?

serves both TAXII 1.1 and TAXII 2.1 from the same instance, so consumers on either version of the protocol can connect

Where is my shared threat intelligence actually stored, and can I query it directly?

content is persisted through a SQLAlchemy-backed database layer, defaulting to SQLite but usable with another supported database, so the underlying data is queryable outside the server itself

Did a change to our TAXII 2 setup silently stop returning unauthorized requests correctly?

the persistence and authorization layer raises proper unauthorized responses for TAXII 2 rather than failing with a generic server error

How many API roots and collections are actually configured on this server right now?

configuration is managed through CLI commands that set up and list API roots, collections, and their access permissions, giving a direct read of the current setup

all 9 features, with the evidence for each →

Languages

Not documented

Features

9 capabilities · 1 backed by code, an API document or a real run

Built from opentaxii's releases, docs, README and our own runs. “Seen” marks the month we first spotted a release the vendor didn't date. Group names and tags are our labels.

Compare with peers →

What opentaxii offers you

All capabilities 9 capabilities
Collection management verified Allows users to create and configure TAXII collections by setting a title, description, API root, public read/write access, and an optional custom UUID. 22 releases · 8 other sources · first seen Apr 2015

Also counts toward: Command-line interface

release 22 total

  • Enables TAXII 2.1 in the default configuration out of the box. 0.10.0b1 · Jan 2026 · source · release history
  • SQLAlchemy 1.3 is no longer supported; deployments must upgrade to a supported SQLAlchemy version. 0.10.0b1 · Jan 2026 · source · release history
  • Improves get-objects query performance, unlocking faster retrieval at scale. 0.10.0b1 · Jan 2026 · source · release history
  • gunicorn >=22 is now required; deployments pinned to an older gunicorn version must upgrade. 0.10.0b1 · Jan 2026 · source · release history
  • Add public write support. 0.9.3 · Oct 2022 · source · release history
  • allow_custom_properties config option allows enabling custom TAXII properties 0.9.0 · Jun 2022 · source · release history

docs

  • Python implementation of TAXII server services for sharing cyber threat intelligence.

command line

example

  • Connect a TAXII 2 client to OpenTAXII 0.7.0 using the new endpoint structure. curl -k https://server.example.com/taxii2/discovery 0.7.0 · May 2022 · source
Persistence domain retrieval shipped Extends the persistence API with a method to retrieve a specific domain associated with a given service ID. 3 releases · 1 other source · first seen Jul 2015

release

  • Allows passing engine_parameters to SQLDatabaseAPI for custom SQLAlchemy configuration 0.1.11 · Feb 2019 · source · release history
  • Extends Persistence and Auth APIs with new CRUD methods required for unified data synchronization 0.1.10 · Jun 2018 · source · release history
  • Persistence API gains get_domain(service_id) method 0.1.2 · Jul 2015 · source · release history

example

  • Use the new Persistence API method to retrieve domain. domain = persistence_api.get_domain('service_id') 0.1.2 · Jul 2015 · source
Content block removal shipped Allows programmatic deletion of content blocks from storage via API and CLI. 3 releases · first seen Jun 2016

Also counts toward: Command-line interface

release

  • Sets acceptable_destination key in status details instead of extended headers 0.1.11 · Feb 2019 · source · release history
  • Adds delete_content_blocks method to the Persistence API for programmatic block removal 0.1.6 · Jun 2016 · source · release history
  • Adds opentaxii-delete-blocks CLI command to remove content blocks from storage 0.1.6 · Jun 2016 · source · release history
Service health monitoring shipped Exposes a dedicated endpoint to verify the operational status and liveness of the cyber tool service. 2 releases · first seen Jul 2015

release

  • Sets acceptable_destination key in status details instead of extended headers 0.1.11 · Feb 2019 · source · release history
  • Adds healthcheck endpoint for service monitoring 0.1.2 · Jul 2015 · source · release history
SQL database configuration shipped Allows passing custom engine parameters to the SQL database API for tailored SQLAlchemy configuration. 1 release · 1 other source · first seen Feb 2019

release

  • Allows passing engine_parameters to SQLDatabaseAPI for custom SQLAlchemy configuration 0.1.11 · Feb 2019 · source · release history

example

  • Example of initializing SQLDatabaseAPI with specific engine parameters. import opentaxii.storage storage = opentaxii.storage.SQLDatabaseAPI( db_url='sqlite:///opentaxii.db', engine_parameters={'pool_size': 10, 'max_overflow': 2} ) 0.1.11 · Feb 2019 · source
Logging configuration aliases shipped Allows users to reference the root logger by an alias named 'root' within the logging configuration. 2 releases · first seen Apr 2015

release

  • Ensures consistent JSON logging when running via Gunicorn 0.1.11 · Feb 2019 · source · release history
  • Adds root as an alias for the root logger in the logging configuration 0.1.1 · Apr 2015 · source · release history
XML parsing configuration shipped Allows users to configure the XML parser to support very deep trees and long text content by disabling specific security restrictions. 1 release · first seen Feb 2017

release

  • xml_parser_supports_huge_tree: When set to yes or true, the XML parser is forced to support very deep trees and very long text content by disabling security restrictions. 0.1.8 · Feb 2017 · source · release history
Service deployment configuration shipped Provides Docker configuration files to facilitate the containerized deployment of the cyber tool. 1 release · first seen Jul 2015

release

Request context data access shipped Makes account and token information available within the request scope for internal use during processing. 1 release · first seen Apr 2015

release

  • Exposes a context object in request scope holding account and token data 0.1.1 · Apr 2015 · source · release history

Lines in monospace are the tool's own words: help text parsed from its source, or an endpoint from its API document. Under release, a line is our summary of a dated release. Under docs, it is quoted from the tool's own documentation or website. Each links back to the source it came from.

Score card

  1. Shipping velocity releases a month, last 12 months
  2. Documentation quality release-notes rubric, 0–100
  3. Breaking-change discipline how rarely a release breaks users, and notice given
  4. Maintenance risk quiet time against its own cadence, maintainers
  5. Innovation & surface new capabilities, API and MCP surface
  6. Community health
  7. Contributor trend distinct committers, this year against last
  8. Maintainer concentration bus factor now against a year ago
  9. Issue backlog trend issues closed per issue opened, 12 months
  10. Responsiveness median time to a maintainer’s first reply

Nine scores for opentaxii, each built from the releases, notes and API history this site tracks — and, on Researcher and Business, where it stands among every measured tool in its category and how that has moved.

Score cards are part of every paid plan.

See plans →

Each score is 0–100 on a published rubric, derived from data this site already shows. A dimension we cannot measure says so — it is never scored 0 and never enters a rank.

How this is scored
  • Shipping velocity — releases a month over the last 12 months, on a log scale where 16 a month scores 100. Needs 3 releases in the window.
  • Documentation quality — the release-notes rubric published on the analytics page, unchanged.
  • Breaking-change discipline — the share of releases carrying a breaking change (none scores 100, half or more scores 0). Only projects that label breaking changes are measured: a clean record cannot be told from an unlabelled one.
  • Maintenance risk — quiet time measured against the tool's own release cadence (quiet longer than 90 days and three typical gaps scores 0), plus the number of active maintainers and whether contributors are growing, where known. Higher is lower risk.
  • Innovation & surface — new capabilities in the feature ledger this year, API and MCP operations added, and the share of commits that are features: the mean of whichever we hold.
  • Community health (open-source tools only) — each is a direction, not a size: contributors this year against last, the bus factor now against a year ago, and issues closed per issue opened, where steady scores 50, doubled 100 and halved 0; plus the median time to a maintainer's first reply (an hour scores about 100, a month or more 0). A commercial card has no repository and carries none of the four.
  • Documented delivery (commercial tools) — when a vendor's documented new capabilities have slowed against its own baseline, that counts against the overall standing as heavily as two low dimensions. Steady delivery, or too little history to judge, leaves the standing alone; it is never a sixth score.
  • Open-source tools are scored on repository signals; commercial tools on their published changelog. Ranks compare tools within one category and one profile and need at least five measured peers; the overall standing needs three ranked dimensions. Best-in-breed or consolidator is a shape, not a quality, and is never scored.

Release-note detail over time

See how much detail opentaxii puts in its release notes, quarter by quarter, and compare it with tracked tools in the same category. This history uses up to ten retained, reviewed notes per tool; sparse or blank older quarters may reflect that limit.

Checking release-note history…

Explore the full chart →

Releases

Show

16 entries

  1. January 20261
  3. October 20221
  5. June 20222
  8. May 20224
  13. April 20221
  15. December 20211
  17. February 20191
  19. June 20181
  21. February 20171
  23. June 20161
  25. July 20151
  27. April 20151
    Show

    16 entries

    1. 0.10.0b1 Prerelease Jan 5, 2026 · release notes

      OpenTAXII 0.10.0b1 adds --public/--id CLI params, enables TAXII 2.1TAXII 2.1An OASIS-standard HTTP-based protocol for exchanging cyber threat intelligence, letting cyber tools publish and subscribe to structured threat data across organizations without custom integration work. by default, and boosts get-objects performance.

      └──▷ GET THIS VERSION 
      $ git clone --branch 0.10.0b1 https://github.com/eclecticiq/OpenTAXII.git
# already have the repo? check out this version:
$ git checkout 0.10.0b1
      └──▷ TRY IT
      Register a new public API root with a specific ID when setting up a multi-tenant TAXII 2.1 server.
      $ opentaxii-add-api-root --public --id <api-root-id>
      • Adds --public and --id params to the opentaxii-add-api-root CLI command for more flexible API root configuration.
      • Enables TAXII 2.1 in the default configuration out of the box.
      • Improves get-objects query performance, unlocking faster retrieval at scale.

      3 details in Everything

      └──▷ BREAKING ON UPGRADE
      • !Python 3.6, 3.7, 3.8, and 3.9 are no longer supported; deployments running these versions must upgrade Python.
      • !SQLAlchemy 1.3 is no longer supported; deployments must upgrade to a supported SQLAlchemy version.
      • !gunicorn >=22 is now required; deployments pinned to an older gunicorn version must upgrade.
    2. 0.9.3 Oct 11, 2022 · release notes

      OpenTAXII 0.9.3 adds public write support for TAXII servers.

      └──▷ GET THIS VERSION 
      $ git clone --branch 0.9.3 https://github.com/eclecticiq/OpenTAXII.git
# already have the repo? check out this version:
$ git checkout 0.9.3
      • Add public write support.

      1 detail in Everything

    3. 0.9.0 Jun 13, 2022 · release notes

      OpenTAXII 0.9.0 adds the allow_custom_properties config option to enable custom properties

      └──▷ GET THIS VERSION 
      $ git clone --branch 0.9.0 https://github.com/eclecticiq/OpenTAXII.git
# already have the repo? check out this version:
$ git checkout 0.9.0
    4. 0.8.0 Jun 5, 2022 · release notes

      OpenTAXII 0.8.0 adds taxii2 job detail nesting and count-only mode

      └──▷ GET THIS VERSION 
      $ git clone --branch 0.8.0 https://github.com/eclecticiq/OpenTAXII.git
# already have the repo? check out this version:
$ git checkout 0.8.0
      • taxii2 jobs now nest details inside the payload.
      • Taxii2 jobs support count-only mode without details.

      2 details in Everything

    5. 0.7.0 May 27, 2022 · release notes

      OpenTAXII 0.7.0 nests TAXII 2 endpoints under /taxii2/

      └──▷ GET THIS VERSION 
      $ git clone --branch 0.7.0 https://github.com/eclecticiq/OpenTAXII.git
# already have the repo? check out this version:
$ git checkout 0.7.0
      └──▷ TRY IT
      Connect a TAXII 2 client to OpenTAXII 0.7.0 using the new endpoint structure.
      $ curl -k https://server.example.com/taxii2/discovery
      • /taxii2/ endpoint path prefix for all TAXII 2 traffic

      1 detail in Everything

      └──▷ BREAKING ON UPGRADE
      • !TAXII 2 clients must now address the server at /taxii2/* instead of the previous root-path endpoints.
    6. 0.6.0 May 25, 2022 · release notes

      OpenTAXII 0.6.0 adds public_discovery config option and publicly readable TAXII 2 API roots.

      └──▷ GET THIS VERSION 
      $ git clone --branch 0.6.0 https://github.com/eclecticiq/OpenTAXII.git
# already have the repo? check out this version:
$ git checkout 0.6.0
      • Add public_discovery option to taxii2 config
      • Add support for publicly readable taxii 2 api roots

      2 details in Everything

    7. 0.5.0 May 24, 2022 · release notes

      OpenTAXII 0.5.0 adds support for publicly readable TAXII 2 collections

      └──▷ GET THIS VERSION 
      $ git clone --branch 0.5.0 https://github.com/eclecticiq/OpenTAXII.git
# already have the repo? check out this version:
$ git checkout 0.5.0
    8. 0.4.0 May 20, 2022 · release notes

      OpenTAXII 0.4.0 adds TAXII 2.1TAXII 2.1An OASIS-standard HTTP-based protocol for exchanging cyber threat intelligence, letting cyber tools publish and subscribe to structured threat data across organizations without custom integration work. protocol support via OpenTAXII2PersistenceAPI

      └──▷ GET THIS VERSION 
      $ git clone --branch 0.4.0 https://github.com/eclecticiq/OpenTAXII.git
# already have the repo? check out this version:
$ git checkout 0.4.0
      • Implement taxii2.1 support

      1 detail in Everything

    9. 0.3.0 Apr 13, 2022 · release notes

      OpenTAXII 0.3.0 adds TAXII 2.1TAXII 2.1An OASIS-standard HTTP-based protocol for exchanging cyber threat intelligence, letting cyber tools publish and subscribe to structured threat data across organizations without custom integration work. support

      └──▷ GET THIS VERSION 
      $ git clone --branch 0.3.0 https://github.com/eclecticiq/OpenTAXII.git
# already have the repo? check out this version:
$ git checkout 0.3.0
      • Implements TAXII 2.1 protocol support

      1 detail in Everything

    10. 0.3.0a2 Prerelease Dec 27, 2021 · release notes

      OpenTAXII 0.3.0a2 merges 0.2.3 maintenance fixes; 0.3.0a1 adds Python 3.10 support and enables TAXII 2 implementation groundwork.

      └──▷ GET THIS VERSION 
      $ git clone --branch 0.3.0a2 https://github.com/eclecticiq/OpenTAXII.git
# already have the repo? check out this version:
$ git checkout 0.3.0a2
      • Adds Python 3.10 compatibility via updated dependency constraints
      • Enables foundational code structure for future TAXII 2 protocol implementation

      2 details in Everything

    11. 0.1.11 Feb 13, 2019 · release notes

      OpenTAXII 0.1.11 adds engine_parameters passthrough to SQLDatabaseAPI and standardizes JSON logging.

      • Allows passing engine_parameters to SQLDatabaseAPI for custom SQLAlchemy configuration
      • Sets acceptable_destination key in status details instead of extended headers
      • Ensures consistent JSON logging when running via Gunicorn

      3 details in Everything

    12. 0.1.10 Jun 3, 2018 · release notes

      New opentaxii-sync-data CLI command replaces separate setup process with single entry point

      └──▷ GET THIS VERSION 
      $ git clone --branch 0.1.10 https://github.com/eclecticiq/OpenTAXII.git
# already have the repo? check out this version:
$ git checkout 0.1.10
      • Adds the opentaxii-sync-data CLI command to replace separate service/collection/account creation steps with a single interface
      • Extends Persistence and Auth APIs with new CRUDCRUDThe four basic database operations — Create, Read, Update, Delete — used as shorthand for any system that manages persistent data records, giving cyber tools a standard model for interacting with stored information. methods required for unified data synchronization
      • Adds ability to read and modify collection-level Access Control Lists (ACLACLAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource.)

      3 details in Everything

      └──▷ BREAKING ON UPGRADE
      • !DB models for default implementation of Persistence API and Auth API were changed; no automatic migration code is provided, requiring manual DB migration
      • !Python 2.7 is dropped from testing scope
    13. 0.1.8 Feb 21, 2017 · release notes

      Adds xml_parser_supports_huge_tree config property to control XML parser tree depth limits.

      • xml_parser_supports_huge_tree: When set to yes or true, the XML parser is forced to support very deep trees and very long text content by disabling security restrictions.

      1 detail in Everything

    14. 0.1.6 Jun 1, 2016 · release notes

      Opentaxii 0.1.6 adds opentaxii-delete-blocks CLI command and Persistence API method for content block deletion.

      • Adds opentaxii-delete-blocks CLI command to remove content blocks from storage
      • Adds delete_content_blocks method to the Persistence API for programmatic block removal
      • Enforces unique collection names in the default SQL DB Auth API implementation

      3 details in Everything

      └──▷ BREAKING ON UPGRADE
      • !Collection's name is required to be unique in default SQL DB Auth API implementation; existing deployments with duplicate collection names will fail validation.
    15. 0.1.2 Jul 24, 2015 · release notes

      Opentaxii 0.1.2 adds Docker config, health check API endpoint, basic auth support, and Persistence API domain method.

      └──▷ TRY IT
      Verify the cyber tool is running correctly via HTTP.
      $ curl http://localhost:8000/healthcheck
      Configure Basic Auth in your service configuration.
      yaml 
      basic_auth: true
username: admin
password: secret
      Use the new Persistence API method to retrieve domain.
      python 
      domain = persistence_api.get_domain('service_id')
      • Adds healthcheck endpoint for service monitoring
      • Adds Basic Authentication support via configuration
      • Docker configuration files added for deployment
      • Persistence API gains get_domain(service_id) method

      4 details in Everything

    16. 0.1.1 Apr 8, 2015 · release notes

      Adds root logger alias, per-request context object, and OPTIONS support for version negotiation.

      • Adds root as an alias for the root logger in the logging configuration
      • Exposes a context object in request scope holding account and token data
      • Supports OPTIONS HTTP requests to enable auto version negotiation

      3 details in Everything

    Project health

    Issue, contributor and maintainer activity in eclecticiq/OpenTAXII, 2023-10 – 2026-09, as of 2026-09-25. Twelve-month figures first; the trend lines run the whole window.

    1. Contributors 4 +3 vs prior 12 months
    2. Maintainers 1 +1 joined · −0 left, last 12 months
    3. Bus factor 1 committers behind half the commits
    4. Community-filed 100% of issues opened, last 12 months
    5. Median time to close 3.2 years issues closed, last 12 months
    6. Open backlog 8 of 146 issues ever filed
    1. Issues opened / month 0 · 0 communitymaintainers
    2. Open backlog 8
    3. Contributors / month 0
    4. Commits / month 0
    5. Stars 215
    Issue themes, last 12 months
    • features 50%
    • other 50%

    Counts from the project's public repository and git history; no individuals are identified. Maintainers are the committers covering 80% of the last year's commits. how we measure this

    Add the badge to your README

    Maintain this project? The badge links readers straight to this page, so they can follow every release here.

    Tracked by Cyber Toolchain Choose a badge style and copy the code →
    compare.md

      Free the public facts, no sign-in Any paid plan all other sections Researcher & Business pricing history and category rank

      my-toolchain — 0 tools

        Betas, release candidates and previews. Turn it off to see final releases only. It also applies to changes you ask for over MCP when you're signed in.
        browse all tools → score card for your toolchain →
        cyber-toolchain / feedback

        Send us feedback