HoneyLabs
Lookup
Explore
CVEsEarly actorsPayloadsCampaignsAEI IndexPortsUser-agents
Integrations
OverviewMCPFeedsAPI / Enrich
DocsBlog

Integrations · OpenCTI

Pull HoneyLabs intel into OpenCTI over TAXII

OpenCTI subscribes to TAXII 2.1 collections out of the box (Data, then Ingestion, then TAXII Feeds), and HoneyLabs runs a TAXII server at honeylabs.net/taxii2/. Indicators arrive as full STIX objects: patterns, validity windows that expire quiet IPs on their own, and an external reference back to the HoneyLabs report. Nothing to deploy, and polling is incremental.

  1. 01

    Get an API key

    The TAXII collections are authenticated, so create a free API key on the HoneyLabs dashboard first. The key is the Basic password (the username can be anything); a Bearer token with just the key works too.

    https://honeylabs.net/dashboard?src=opencti  ->  API keys  ->  New key
  2. 02

    Add the exploiters ingester

    Under Data, then Ingestion, then TAXII Feeds, create an ingester with the HoneyLabs API root and the collection ID, plus a service account to attribute the objects to. Leave 'Import from date' empty; the collection carries its own window.

    # Data -> Ingestion -> TAXII Feeds -> Create
Name                : HoneyLabs exploiters
TAXII server URL    : https://honeylabs.net/taxii2/api/
TAXII collection    : 253ff00b-4863-571f-8949-9d05616de5b7
Authentication type : Basic user
  Username          : taxii
  Password          : <your API key>
User responsible    : your ingest service account
  3. 03

    Add the malware infrastructure ingester

    Repeat with the second collection to also ingest loader and C2 URLs extracted from captured payloads as url-pattern indicators.

    Name             : HoneyLabs malware infrastructure
TAXII collection : e144c129-a19a-55c8-b926-dd2dfbbd8138
  4. 04

    Watchlist feeds still work as CSV

    Any saved HoneyLabs query (a port, an ASN, a CVE, a boolean combination) can be minted as a tokened feed on the feeds page and ingested with a CSV mapper (ip column to IPv4-Addr observable) under CSV Feeds. Per-query TAXII collections are not available yet.

    URL : https://honeylabs.net/feed/<token>.csv
  5. 05

    Enrich on demand over the REST API

    For enrichment playbooks, the lookup endpoint returns the full verdict for one IP as JSON with the same key. REST calls are metered against the key's daily credit quota; TAXII polling is not.

    curl -H "Authorization: Bearer <key>" \
  "https://honeylabs.net/lookup/1.2.3.4?format=json"

Worth knowing

  • The exploiter window is 7 days and the malware window 14; valid_until mirrors them, so indicators expire in OpenCTI when the activity stops.
  • Recognised research and commercial scanners (Shadowserver, Censys and friends) are removed before the collections are built.
  • EclecticIQ, ThreatQ and anything else that polls TAXII 2.1 can use the same API root, collections and credentials.
  • Indicator IDs are stable per IP and URL, so re-polls update existing objects instead of duplicating them.

The feed is plain text (one IP per line), CSV, or JSON, is revocable per token, and is edge-cached for five minutes, so a tight refresh schedule never hammers anything. Create yours on the feeds page, or browse the other integrations.