HoneyLabs
Lookup
Explore
CVEsEarly actorsPayloadsCampaignsEmissions IndexPortsUser-agents
Integrations
OverviewMCPFeedsAPI / EnrichSplunkMicrosoft SentinelElasticMISPOpenCTICrowdSec
PricingDocsBlog

Integrations · OpenCTI

Pull HoneyLabs intel into OpenCTI over TAXII

OpenCTI subscribes to TAXII 2.1 collections out of the box (Data, then Ingestion, then TAXII Feeds), and HoneyLabs runs a TAXII server at honeylabs.net/taxii2/. Indicators arrive as full STIX objects: a pattern, a confidence score, a kill chain phase, and an external reference back to the HoneyLabs report on that address. Nothing to deploy, and polling is incremental.

One indicator as OpenCTI stored it after polling our TAXII collection: the STIX pattern, our confidence carried through as the score, the exploitation kill chain phase, and a description naming the ASN, country and observation window.
Live capture · our lab instance
  1. 01

    Get an API key

    The TAXII collections are authenticated, so create a free API key on the HoneyLabs dashboard first. The key is the Basic password (the username can be anything); a Bearer token with just the key works too.

    https://honeylabs.net/dashboard?src=opencti  ->  API keys  ->  New key
  2. 02

    Add the exploiters ingester

    Under Data, then Ingestion, then TAXII Feeds, create an ingester with the HoneyLabs API root and the collection ID, plus a service account to attribute the objects to. Leave 'Import from date' empty; the collection carries its own window.

    # Data -> Ingestion -> TAXII Feeds -> Create
Name                : HoneyLabs exploiters
TAXII server URL    : https://honeylabs.net/taxii2/api/
TAXII collection    : 253ff00b-4863-571f-8949-9d05616de5b7
Authentication type : Basic user
  Username          : taxii
  Password          : <your API key>
User responsible    : your ingest service account
  3. 03

    Add the malware infrastructure ingester

    Repeat with the second collection to also ingest loader and C2 URLs extracted from captured payloads as url-pattern indicators.

    Name             : HoneyLabs malware infrastructure
TAXII collection : e144c129-a19a-55c8-b926-dd2dfbbd8138
  4. 04

    Watchlist feeds still work as CSV

    Any saved HoneyLabs query (a port, an ASN, a CVE, a boolean combination) can be minted as a tokened feed on the feeds page and ingested with a CSV mapper (ip column to IPv4-Addr observable) under CSV Feeds. Per-query TAXII collections are not available yet.

    URL : https://honeylabs.net/feed/<token>.csv
  5. 05

    Enrich on demand over the REST API

    For enrichment playbooks, the lookup endpoint returns the full verdict for one IP as JSON with the same key. REST calls are metered against the key's daily credit quota; TAXII polling is not.

    curl -H "Authorization: Bearer <key>" \
  "https://honeylabs.net/lookup/1.2.3.4?format=json"

Worth knowing

  • The exploiter window is 7 days and the malware window 14, and valid_until on the object mirrors them. OpenCTI does not honour that value: it applies its own decay rule instead (470 days on the built-in IPv4 rule) and ages the indicator score over that lifetime. Add a matching rule under Settings, Customization, Decay rules if you want our window to govern expiry.
  • Confidence rides along as the OpenCTI score when you enable 'Copy confidence level to OpenCTI scores' on the ingester, which is what the decay rule then ages.
  • Recognised research and commercial scanners (Shadowserver, Censys and friends) are removed before the collections are built.
  • EclecticIQ, ThreatQ and anything else that polls TAXII 2.1 can use the same API root, collections and credentials.
  • Indicator IDs are stable per IP and URL, so re-polls update existing objects instead of duplicating them.

The feed is plain text (one IP per line), CSV, or JSON, is revocable per token, and is edge-cached for five minutes, so a tight refresh schedule never hammers anything. Create yours on the feeds page, or browse the other integrations.