# Elastic support STIX and/or TAXII

**URL:** <https://discuss.elastic.co/t/elastic-support-stix-and-or-taxii/319076>\
**Category:** Elastic Security\
**Created:** [November 16, 2022, 12:29pm UTC](https://discuss.elastic.co/t/elastic-support-stix-and-or-taxii/319076 "2022-11-16T12:29:24Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![oyuskeseliev](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/oyuskeseliev/32/113421_2.png) [@oyuskeseliev](https://discuss.elastic.co/u/oyuskeseliev)\
**Post date:** [November 16, 2022, 12:29pm UTC](https://discuss.elastic.co/t/elastic-support-stix-and-or-taxii/319076/1 "2022-11-16T12:29:24Z")

</div>

Hi all,

i’m trying to find out if Elastic has support for STIX/TAXII. I do not see any info about this in the documentation, does anyone know?

regards  
Ognyan

---

<div class="post-metadata">

**Author:** ![wsouza](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wsouza/32/92547_2.png) [@wsouza](https://discuss.elastic.co/u/wsouza)\
**Post date:** [November 16, 2022, 1:30pm UTC](https://discuss.elastic.co/t/elastic-support-stix-and-or-taxii/319076/2 "2022-11-16T13:30:35Z")

</div>

HI, @oyuskeseliev!

I found this information in the intel threat module of filebeat:

> **[Threat Intel module | Filebeat Reference \[8.11\] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-threatintel.html)**

> [@oyuskeseliev](#):
>
> STIX

---

<div class="post-metadata">

**Author:** ![jamesspi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jamesspi/32/24479_2.png) [@jamesspi](https://discuss.elastic.co/u/jamesspi)\
**Post date:** [November 16, 2022, 3:01pm UTC](https://discuss.elastic.co/t/elastic-support-stix-and-or-taxii/319076/3 "2022-11-16T15:01:40Z")

</div>

Hey @oyuskeseliev ,

Thanks for reaching out. Some of the native TI integrations we have are indeed STIX feeds from a TAXII server. We support the protocol and the format as part of the wider Elastic Agent integration eco system using the "Custom API" integration.

Hope this helps.

James

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 14, 2022, 3:02pm UTC](https://discuss.elastic.co/t/elastic-support-stix-and-or-taxii/319076/4 "2022-12-14T15:02:33Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.