TAXII 2.1 Feed

Primary Endpoint

GET/taxii2/collections/{id}/objects/

Authentication

Bearer sk_... | Basic auth | public for discovery

Daily Quota

Tier-based (per indicator)

Content-Type

application/taxii+json;version=2.1

← Back to Overview

Request

SikkerAPI provides a STIX 2.1 threat intelligence feed served over the TAXII 2.1 protocol. Every malicious IP detected by our honeypot network is published as a STIX Indicator with confidence scores, behavioral labels, and MITRE ATT&CK references. Connect your SIEM and start receiving automated IP reputation updates.

curl "https://api.sikkerapi.com/taxii2/" \
  -H "Accept: application/taxii+json;version=2.1"

import requests

response = requests.get(
    "https://api.sikkerapi.com/taxii2/",
    headers={"Accept": "application/taxii+json;version=2.1"}
)

api_root = response.json()
print(f"Title: {api_root['title']}")
print(f"Versions: {api_root['versions']}")

const response = await fetch(
  "https://api.sikkerapi.com/taxii2/",
  {
    headers: {
      "Accept": "application/taxii+json;version=2.1"
    }
  }
);

const apiRoot = await response.json();
console.log(`Title: ${apiRoot.title}`);
console.log(`Versions: ${apiRoot.versions}`);

<?php
$ch = curl_init("https://api.sikkerapi.com/taxii2/");
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        "Accept: application/taxii+json;version=2.1"
    ]
]);

$response = curl_exec($ch);
$data = json_decode($response, true);
echo "Title: " . $data['title'];

package main

import (
    "encoding/json"
    "fmt"
    "net/http"
)

func main() {
    req, _ := http.NewRequest("GET",
        "https://api.sikkerapi.com/taxii2/", nil)
    req.Header.Set("Accept", "application/taxii+json;version=2.1")

    client := &http.Client{}
    resp, _ := client.Do(req)
    defer resp.Body.Close()

    var data map[string]interface{}
    json.NewDecoder(resp.Body).Decode(&data)
    fmt.Printf("Title: %v\n", data["title"])
}

import java.net.http.*;
import java.net.URI;

HttpClient client = HttpClient.newHttpClient();
HttpRequest request = HttpRequest.newBuilder()
    .uri(URI.create("https://api.sikkerapi.com/taxii2/"))
    .header("Accept", "application/taxii+json;version=2.1")
    .build();

HttpResponse<String> response = client.send(request,
    HttpResponse.BodyHandlers.ofString());
System.out.println(response.body());

using System.Net.Http;

var client = new HttpClient();
client.DefaultRequestHeaders.Accept.ParseAdd(
    "application/taxii+json;version=2.1");

var response = await client.GetAsync(
    "https://api.sikkerapi.com/taxii2/");
var content = await response.Content.ReadAsStringAsync();
Console.WriteLine(content);

import java.net.http.*
import java.net.URI

val client = HttpClient.newHttpClient()
val request = HttpRequest.newBuilder()
    .uri(URI.create("https://api.sikkerapi.com/taxii2/"))
    .header("Accept", "application/taxii+json;version=2.1")
    .build()

val response = client.send(request, HttpResponse.BodyHandlers.ofString())
println(response.body())

require 'net/http'
require 'json'

uri = URI("https://api.sikkerapi.com/taxii2/")
request = Net::HTTP::Get.new(uri)
request["Accept"] = "application/taxii+json;version=2.1"

response = Net::HTTP.start(uri.hostname, uri.port, use_ssl: true) do |http|
  http.request(request)
end

data = JSON.parse(response.body)
puts "Title: #{data['title']}"

use reqwest::header::{ACCEPT, HeaderMap};

#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
    let mut headers = HeaderMap::new();
    headers.insert(ACCEPT, "application/taxii+json;version=2.1".parse()?);

    let client = reqwest::Client::new();
    let resp = client
        .get("https://api.sikkerapi.com/taxii2/")
        .headers(headers)
        .send()
        .await?
        .json::<serde_json::Value>()
        .await?;

    println!("Title: {}", resp["title"]);
    Ok(())
}

# Bearer token auth
curl "https://api.sikkerapi.com/taxii2/collections/sikker-threat-intel/objects/?limit=10" \
  -H "Authorization: Bearer sk_free_..." \
  -H "Accept: application/taxii+json;version=2.1"

# Basic auth (for Sentinel, Splunk, and other SIEMs)
curl "https://api.sikkerapi.com/taxii2/collections/sikker-threat-intel/objects/?limit=10" \
  -u "apikey:sk_free_..." \
  -H "Accept: application/taxii+json;version=2.1"

import requests

response = requests.get(
    "https://api.sikkerapi.com/taxii2/collections/sikker-threat-intel/objects/",
    headers={
        "Authorization": "Bearer sk_free_...",
        "Accept": "application/taxii+json;version=2.1"
    },
    params={"limit": 10}
)

envelope = response.json()
for obj in envelope.get("objects", []):
    if obj["type"] == "indicator":
        print(f"{obj['name']} (confidence: {obj['confidence']})")

# Paginate using the 'next' cursor
if envelope.get("more"):
    next_cursor = envelope["next"]
    print(f"Next page cursor: {next_cursor}")

const response = await fetch(
  "https://api.sikkerapi.com/taxii2/collections/sikker-threat-intel/objects/?limit=10",
  {
    headers: {
      "Authorization": "Bearer sk_free_...",
      "Accept": "application/taxii+json;version=2.1"
    }
  }
);

const envelope = await response.json();
for (const obj of envelope.objects ?? []) {
  if (obj.type === "indicator") {
    console.log(`${obj.name} (confidence: ${obj.confidence})`);
  }
}

// Paginate using the 'next' cursor
if (envelope.more) {
  console.log(`Next page cursor: ${envelope.next}`);
}

<?php
$ch = curl_init("https://api.sikkerapi.com/taxii2/collections/sikker-threat-intel/objects/?limit=10");
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        "Authorization: Bearer sk_free_...",
        "Accept: application/taxii+json;version=2.1"
    ]
]);

$response = curl_exec($ch);
$envelope = json_decode($response, true);

foreach ($envelope['objects'] ?? [] as $obj) {
    if ($obj['type'] === 'indicator') {
        echo $obj['name'] . " (confidence: " . $obj['confidence'] . ")\n";
    }
}

package main

import (
    "encoding/json"
    "fmt"
    "net/http"
)

func main() {
    req, _ := http.NewRequest("GET",
        "https://api.sikkerapi.com/taxii2/collections/sikker-threat-intel/objects/?limit=10", nil)
    req.Header.Set("Authorization", "Bearer sk_free_...")
    req.Header.Set("Accept", "application/taxii+json;version=2.1")

    client := &http.Client{}
    resp, _ := client.Do(req)
    defer resp.Body.Close()

    var envelope map[string]interface{}
    json.NewDecoder(resp.Body).Decode(&envelope)
    fmt.Printf("More pages: %v\n", envelope["more"])
}

import java.net.http.*;
import java.net.URI;

HttpClient client = HttpClient.newHttpClient();
HttpRequest request = HttpRequest.newBuilder()
    .uri(URI.create(
        "https://api.sikkerapi.com/taxii2/collections/sikker-threat-intel/objects/?limit=10"))
    .header("Authorization", "Bearer sk_free_...")
    .header("Accept", "application/taxii+json;version=2.1")
    .build();

HttpResponse<String> response = client.send(request,
    HttpResponse.BodyHandlers.ofString());
System.out.println(response.body());

using System.Net.Http;
using System.Net.Http.Headers;

var client = new HttpClient();
client.DefaultRequestHeaders.Authorization =
    new AuthenticationHeaderValue("Bearer", "sk_free_...");
client.DefaultRequestHeaders.Accept.ParseAdd(
    "application/taxii+json;version=2.1");

var response = await client.GetAsync(
    "https://api.sikkerapi.com/taxii2/collections/sikker-threat-intel/objects/?limit=10");
var content = await response.Content.ReadAsStringAsync();
Console.WriteLine(content);

import java.net.http.*
import java.net.URI

val client = HttpClient.newHttpClient()
val request = HttpRequest.newBuilder()
    .uri(URI.create(
        "https://api.sikkerapi.com/taxii2/collections/sikker-threat-intel/objects/?limit=10"))
    .header("Authorization", "Bearer sk_free_...")
    .header("Accept", "application/taxii+json;version=2.1")
    .build()

val response = client.send(request, HttpResponse.BodyHandlers.ofString())
println(response.body())

require 'net/http'
require 'json'

uri = URI("https://api.sikkerapi.com/taxii2/collections/sikker-threat-intel/objects/?limit=10")
request = Net::HTTP::Get.new(uri)
request["Authorization"] = "Bearer sk_free_..."
request["Accept"] = "application/taxii+json;version=2.1"

response = Net::HTTP.start(uri.hostname, uri.port, use_ssl: true) do |http|
  http.request(request)
end

envelope = JSON.parse(response.body)
puts "More pages: #{envelope['more']}"

use reqwest::header::{ACCEPT, AUTHORIZATION, HeaderMap};

#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
    let mut headers = HeaderMap::new();
    headers.insert(AUTHORIZATION, "Bearer sk_free_...".parse()?);
    headers.insert(ACCEPT, "application/taxii+json;version=2.1".parse()?);

    let client = reqwest::Client::new();
    let resp = client
        .get("https://api.sikkerapi.com/taxii2/collections/sikker-threat-intel/objects/?limit=10")
        .headers(headers)
        .send()
        .await?
        .json::<serde_json::Value>()
        .await?;

    println!("More pages: {}", resp["more"]);
    Ok(())
}

curl "https://api.sikkerapi.com/taxii2/collections/sikker-threat-intel/objects/203.0.113.42/" \
  -H "Authorization: Bearer sk_free_..." \
  -H "Accept: application/taxii+json;version=2.1"

import requests

response = requests.get(
    "https://api.sikkerapi.com/taxii2/collections/sikker-threat-intel/objects/203.0.113.42/",
    headers={
        "Authorization": "Bearer sk_free_...",
        "Accept": "application/taxii+json;version=2.1"
    }
)

bundle = response.json()
for obj in bundle.get("objects", []):
    if obj["type"] == "indicator":
        print(f"Pattern: {obj['pattern']}")
        print(f"Confidence: {obj['confidence']}")

const response = await fetch(
  "https://api.sikkerapi.com/taxii2/collections/sikker-threat-intel/objects/203.0.113.42/",
  {
    headers: {
      "Authorization": "Bearer sk_free_...",
      "Accept": "application/taxii+json;version=2.1"
    }
  }
);

const bundle = await response.json();
const indicator = bundle.objects?.find(o => o.type === "indicator");
if (indicator) {
  console.log(`Pattern: ${indicator.pattern}`);
  console.log(`Confidence: ${indicator.confidence}`);
}

<?php
$ch = curl_init(
    "https://api.sikkerapi.com/taxii2/collections/sikker-threat-intel/objects/203.0.113.42/");
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        "Authorization: Bearer sk_free_...",
        "Accept: application/taxii+json;version=2.1"
    ]
]);

$response = curl_exec($ch);
$bundle = json_decode($response, true);

foreach ($bundle['objects'] ?? [] as $obj) {
    if ($obj['type'] === 'indicator') {
        echo "Pattern: " . $obj['pattern'] . "\n";
        echo "Confidence: " . $obj['confidence'] . "\n";
    }
}

package main

import (
    "encoding/json"
    "fmt"
    "net/http"
)

func main() {
    req, _ := http.NewRequest("GET",
        "https://api.sikkerapi.com/taxii2/collections/sikker-threat-intel/objects/203.0.113.42/", nil)
    req.Header.Set("Authorization", "Bearer sk_free_...")
    req.Header.Set("Accept", "application/taxii+json;version=2.1")

    client := &http.Client{}
    resp, _ := client.Do(req)
    defer resp.Body.Close()

    var bundle map[string]interface{}
    json.NewDecoder(resp.Body).Decode(&bundle)
    fmt.Println(bundle)
}

import java.net.http.*;
import java.net.URI;

HttpClient client = HttpClient.newHttpClient();
HttpRequest request = HttpRequest.newBuilder()
    .uri(URI.create(
        "https://api.sikkerapi.com/taxii2/collections/sikker-threat-intel/objects/203.0.113.42/"))
    .header("Authorization", "Bearer sk_free_...")
    .header("Accept", "application/taxii+json;version=2.1")
    .build();

HttpResponse<String> response = client.send(request,
    HttpResponse.BodyHandlers.ofString());
System.out.println(response.body());

using System.Net.Http;
using System.Net.Http.Headers;

var client = new HttpClient();
client.DefaultRequestHeaders.Authorization =
    new AuthenticationHeaderValue("Bearer", "sk_free_...");
client.DefaultRequestHeaders.Accept.ParseAdd(
    "application/taxii+json;version=2.1");

var response = await client.GetAsync(
    "https://api.sikkerapi.com/taxii2/collections/sikker-threat-intel/objects/203.0.113.42/");
var content = await response.Content.ReadAsStringAsync();
Console.WriteLine(content);

import java.net.http.*
import java.net.URI

val client = HttpClient.newHttpClient()
val request = HttpRequest.newBuilder()
    .uri(URI.create(
        "https://api.sikkerapi.com/taxii2/collections/sikker-threat-intel/objects/203.0.113.42/"))
    .header("Authorization", "Bearer sk_free_...")
    .header("Accept", "application/taxii+json;version=2.1")
    .build()

val response = client.send(request, HttpResponse.BodyHandlers.ofString())
println(response.body())

require 'net/http'
require 'json'

uri = URI("https://api.sikkerapi.com/taxii2/collections/sikker-threat-intel/objects/203.0.113.42/")
request = Net::HTTP::Get.new(uri)
request["Authorization"] = "Bearer sk_free_..."
request["Accept"] = "application/taxii+json;version=2.1"

response = Net::HTTP.start(uri.hostname, uri.port, use_ssl: true) do |http|
  http.request(request)
end

bundle = JSON.parse(response.body)
puts bundle

use reqwest::header::{ACCEPT, AUTHORIZATION, HeaderMap};

#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
    let mut headers = HeaderMap::new();
    headers.insert(AUTHORIZATION, "Bearer sk_free_...".parse()?);
    headers.insert(ACCEPT, "application/taxii+json;version=2.1".parse()?);

    let client = reqwest::Client::new();
    let resp = client
        .get("https://api.sikkerapi.com/taxii2/collections/sikker-threat-intel/objects/203.0.113.42/")
        .headers(headers)
        .send()
        .await?
        .json::<serde_json::Value>()
        .await?;

    println!("{:#}", resp);
    Ok(())
}

curl "https://api.sikkerapi.com/taxii2/collections/sikker-threat-intel/objects/?added_after=2026-02-01T00:00:00Z&limit=50" \
  -H "Authorization: Bearer sk_free_..." \
  -H "Accept: application/taxii+json;version=2.1"

import requests

response = requests.get(
    "https://api.sikkerapi.com/taxii2/collections/sikker-threat-intel/objects/",
    headers={
        "Authorization": "Bearer sk_free_...",
        "Accept": "application/taxii+json;version=2.1"
    },
    params={
        "added_after": "2026-02-01T00:00:00Z",
        "limit": 50
    }
)

envelope = response.json()
print(f"Indicators: {len(envelope.get('objects', []))}")
print(f"More pages: {envelope.get('more', False)}")

const params = new URLSearchParams({
  added_after: "2026-02-01T00:00:00Z",
  limit: "50"
});

const response = await fetch(
  `https://api.sikkerapi.com/taxii2/collections/sikker-threat-intel/objects/?${params}`,
  {
    headers: {
      "Authorization": "Bearer sk_free_...",
      "Accept": "application/taxii+json;version=2.1"
    }
  }
);

const envelope = await response.json();
console.log(`Indicators: ${envelope.objects?.length ?? 0}`);
console.log(`More pages: ${envelope.more}`);

<?php
$params = http_build_query([
    'added_after' => '2026-02-01T00:00:00Z',
    'limit' => 50
]);

$ch = curl_init(
    "https://api.sikkerapi.com/taxii2/collections/sikker-threat-intel/objects/?" . $params);
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        "Authorization: Bearer sk_free_...",
        "Accept: application/taxii+json;version=2.1"
    ]
]);

$response = curl_exec($ch);
$envelope = json_decode($response, true);

package main

import (
    "encoding/json"
    "fmt"
    "net/http"
    "net/url"
)

func main() {
    baseURL := "https://api.sikkerapi.com/taxii2/collections/sikker-threat-intel/objects/"
    params := url.Values{}
    params.Add("added_after", "2026-02-01T00:00:00Z")
    params.Add("limit", "50")

    req, _ := http.NewRequest("GET", baseURL+"?"+params.Encode(), nil)
    req.Header.Set("Authorization", "Bearer sk_free_...")
    req.Header.Set("Accept", "application/taxii+json;version=2.1")

    client := &http.Client{}
    resp, _ := client.Do(req)
    defer resp.Body.Close()

    var envelope map[string]interface{}
    json.NewDecoder(resp.Body).Decode(&envelope)
    fmt.Printf("More pages: %v\n", envelope["more"])
}

import java.net.http.*;
import java.net.URI;

String url = "https://api.sikkerapi.com/taxii2/collections/sikker-threat-intel/objects/" +
    "?added_after=2026-02-01T00:00:00Z&limit=50";

HttpClient client = HttpClient.newHttpClient();
HttpRequest request = HttpRequest.newBuilder()
    .uri(URI.create(url))
    .header("Authorization", "Bearer sk_free_...")
    .header("Accept", "application/taxii+json;version=2.1")
    .build();

HttpResponse<String> response = client.send(request,
    HttpResponse.BodyHandlers.ofString());

using System.Net.Http;
using System.Net.Http.Headers;

var client = new HttpClient();
client.DefaultRequestHeaders.Authorization =
    new AuthenticationHeaderValue("Bearer", "sk_free_...");
client.DefaultRequestHeaders.Accept.ParseAdd(
    "application/taxii+json;version=2.1");

var response = await client.GetAsync(
    "https://api.sikkerapi.com/taxii2/collections/sikker-threat-intel/objects/" +
    "?added_after=2026-02-01T00:00:00Z&limit=50");

import java.net.http.*
import java.net.URI

val url = "https://api.sikkerapi.com/taxii2/collections/sikker-threat-intel/objects/" +
    "?added_after=2026-02-01T00:00:00Z&limit=50"

val client = HttpClient.newHttpClient()
val request = HttpRequest.newBuilder()
    .uri(URI.create(url))
    .header("Authorization", "Bearer sk_free_...")
    .header("Accept", "application/taxii+json;version=2.1")
    .build()

val response = client.send(request, HttpResponse.BodyHandlers.ofString())

require 'net/http'

uri = URI("https://api.sikkerapi.com/taxii2/collections/sikker-threat-intel/objects/")
uri.query = URI.encode_www_form(
  added_after: "2026-02-01T00:00:00Z", limit: 50
)

request = Net::HTTP::Get.new(uri)
request["Authorization"] = "Bearer sk_free_..."
request["Accept"] = "application/taxii+json;version=2.1"

response = Net::HTTP.start(uri.hostname, uri.port, use_ssl: true) do |http|
  http.request(request)
end

use reqwest::header::{ACCEPT, AUTHORIZATION, HeaderMap};

#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
    let mut headers = HeaderMap::new();
    headers.insert(AUTHORIZATION, "Bearer sk_free_...".parse()?);
    headers.insert(ACCEPT, "application/taxii+json;version=2.1".parse()?);

    let client = reqwest::Client::new();
    let resp = client
        .get("https://api.sikkerapi.com/taxii2/collections/sikker-threat-intel/objects/")
        .query(&[("added_after", "2026-02-01T00:00:00Z"), ("limit", "50")])
        .headers(headers)
        .send()
        .await?;

    Ok(())
}

Endpoints

Five endpoints following the TAXII 2.1 specification. The API root and collection metadata are public (no API key). Object endpoints require authentication. The collection ID is sikker-threat-intel.

TAXII 2.1 endpoints

GET/taxii2/publicAPI Root information

GET/taxii2/collections/publicList available collections

GET/taxii2/collections/{id}/publicCollection metadata

GET/taxii2/collections/{id}/objects/API keyPaginated STIX indicator feed

GET/taxii2/collections/{id}/objects/{ip}/API keySingle IP as STIX bundle

API Root response

{ "title": "SikkerNet TAXII Server", "description": "STIX 2.1 threat intelligence from SikkerNet honeypot sensors and community reports", "versions": ["application/taxii+json;version=2.1"], "max_content_length": 10485760 }

Collection metadata

{ "id": "sikker-threat-intel", "title": "SikkerNet Threat Intelligence", "description": "IP reputation indicators from SikkerNet honeypot network", "can_read": true, "can_write": false, "media_types": ["application/stix+json;version=2.1"] }

Query Parameters

Parameters for the objects endpoint. Use added_after with your last poll timestamp for incremental updates. The next cursor enables keyset pagination through results.

Objects endpoint parameters

added_afterstringISO 8601 timestamp. Only return indicators updated after this time.

limitintegerPage size (default 100, max 1000).

nextstringOpaque cursor from previous response for pagination.

match[type]stringFilter by STIX object type (e.g. indicator).

⚠

Quota warning: Calling the objects endpoint without added_after returns the full dataset from the beginning. Each indicator counts against your daily quota. Without a time filter, a single request can exhaust your entire daily allowance. Always use added_after with your last poll timestamp for incremental updates.

TAXII Envelope

Responses are wrapped in a TAXII envelope. When more is true, pass the next cursor to fetch subsequent pages. The first page includes the SikkerNet identity object; subsequent pages contain only indicators.

TAXII Envelopeapplication/taxii+json

morebooleanTrue when additional pages are available

nextstring?Opaque cursor for the next page (keyset pagination)

objectsarrayArray of STIX 2.1 objects (identity + indicators)

{ "more": true, "next": "1707300000000:203.0.113.42", "objects": [ { "type": "identity", ... }, { "type": "indicator", ... }, { "type": "indicator", ... } ] }

STIX Indicator Format

Each IP is represented as a STIX 2.1 Indicator with deterministic IDs, confidence scores mapped from SikkerNet scoring, behavioral labels, and MITRE ATT&CK kill chain phase mappings. This is equivalent to the IP Check data but formatted for SIEM ingestion.

STIX Indicatorindicator (STIX 2.1)

typestringAlways "indicator"

idstringDeterministic UUID v5 (same IP = same ID)

spec_versionstringAlways "2.1"

patternstringSTIX pattern, e.g. [ipv4-addr:value = '1.2.3.4']

pattern_typestringAlways "stix"

confidenceinteger0–100, mapped from SikkerNet scoring

indicator_typesarraymalicious-activity, anomalous-activity, or benign

labelsarrayBehavior names (e.g. credential-stuffing, wget-download)

kill_chain_phasesarrayMITRE ATT&CK kill chain phases (e.g. initial-access)

external_referencesarrayMITRE ATT&CK technique references

valid_fromstringISO 8601 timestamp of earliest observed activity

created_by_refstringReference to the SikkerNet identity object

{ "type": "indicator", "id": "indicator--a1b2c3d4-...", "spec_version": "2.1", "created": "2026-01-15T08:30:00Z", "modified": "2026-02-07T14:22:00Z", "name": "Suspicious IP: 203.0.113.42", "pattern": "[ipv4-addr:value = '203.0.113.42']", "pattern_type": "stix", "valid_from": "2026-01-15T08:30:00Z", "confidence": 78, "indicator_types": [ "malicious-activity" ], "labels": [ "credential-stuffing", "wget-download" ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "initial-access" } ], "external_references": [ { "source_name": "mitre-attack", "external_id": "T1110.001", "url": "https://attack.mitre.org/..." } ], "created_by_ref": "identity--d3a2e6f1-..." }

Single IP Lookup

Append an IP address to the objects path to retrieve a STIX bundle for a single IP. Returns a bundle containing the SikkerNet identity and one indicator. Returns 404 if the IP has no recorded activity. Equivalent to the IP Check endpoint but formatted as STIX 2.1.

GET /taxii2/collections/sikker-threat-intel/objects/{ip}/ — Single IP bundle

{ "type": "bundle", "id": "bundle--...", "objects": [ { "type": "identity", "name": "SikkerNet", ... }, { "type": "indicator", "confidence": 78, ... } ] }

Response Headers

Object endpoints include quota tracking headers. Each indicator returned counts as one unit against your daily TAXII quota (separate from your lookup and blacklist quotas).

Quota headers

X-TAXII-LimitintegerYour daily TAXII indicator quota (tier-based).

X-TAXII-UsedintegerIndicators consumed today.

X-TAXII-RemainingintegerIndicators remaining in today's quota.

Retry-AfterintegerSeconds until quota resets (429 only). Resets at midnight UTC.

SIEM Integration

Configure your SIEM to poll the TAXII feed for automatic threat intelligence ingestion. Use added_after with your last poll timestamp for incremental updates. A typical polling interval is 15–60 minutes.

Authentication methods

Bearer tokenAuthorization: Bearer sk_your_api_key -- standard method for scripts, SDKs, and SIEMs that support Bearer auth.

Basic authAuthorization: Basic base64(username:sk_your_api_key) -- the username can be anything (e.g. your email or apikey). The password is your API key. Required for SIEMs that only support Basic auth (Microsoft Sentinel, some Splunk configurations).

SIEM setup guides

Microsoft SentinelUse the Threat Intelligence – TAXII data connector. Set API root to https://api.sikkerapi.com/taxii2/, Collection ID to sikker-threat-intel, Username to your email (or any value), and Password to your sk_... API key.

SplunkAdd a TAXII 2 data input under Settings > Data Inputs > Threat Intelligence. Set the collection URL to https://api.sikkerapi.com/taxii2/collections/sikker-threat-intel/. Use either Bearer or Basic auth depending on your Splunk version.

Elastic SecurityConfigure a Threat Intel Indicator Match rule pointing at the TAXII feed URL with your API key in the Authorization header (Bearer or Basic).

QRadarAdd a TAXII 2.1 reference set via the Threat Intelligence app. Use the discovery URL to auto-detect collections.

Errors

Object endpoints return errors as TAXII error messages

401Missing or invalid API key.check header

403API key disabled or expired.regenerate

404IP not found (single IP lookup).no activity recorded

429Daily TAXII indicator quota exhausted.upgrade or resets at midnight UTC

Get started — Connect your SIEM to real-time threat intelligence from our global honeypot network. STIX indicators include confidence scores, behavioral labels, and MITRE ATT&CK references. Create free API key →