# F5 BIG-IP STIX/TAXII Threat Intelligence iApp

**URL:** <https://community.f5.com/t/f5-big-ip-stix-taxii-threat-intelligence-iapp/77386>\
**Category:** F5 Technical Articles\
**Tags:** iapps, big-ip, irules, application-security\
**Created:** [September 11, 2026, 8:14pm UTC](https://community.f5.com/t/f5-big-ip-stix-taxii-threat-intelligence-iapp/77386 "2026-09-11T20:14:09Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Paolo\_Pambianco](https://d1p9zq3aats0t8.cloudfront.net/user_avatar/community.f5.com/paolo_pambianco/32/24596_2.png) [@Paolo\_Pambianco](https://community.f5.com/u/Paolo_Pambianco)\
**Post date:** [September 11, 2026, 8:14pm UTC](https://community.f5.com/t/f5-big-ip-stix-taxii-threat-intelligence-iapp/77386/1 "2026-09-11T20:14:09Z")

</div>

This solution provides an enterprise-grade&nbsp; **F5 BIG-IP iApp template and enforcement engine** that automates the ingestion of Threat Intelligence Indicators of Compromise (IOCs) from:

- **STIX 2.1 / TAXII 2.1 servers**
- **Remote HTTP/HTTPS feeds**
- **Local files**

The solution provides real-time L4/L7 threat blocking on selected Virtual Servers permitting to define which Application to protect and the prefered ingestion method to use.

 ![image_347559.png](https://d20hrnpixdzcsd.cloudfront.net/original/3X/6/e/6ec7f1de07153de7ad2ba11f5cf1e086a1a189e8.png)

## Key Features:

- **100% Self-Contained Deployment** : The iApp template embeds the complete Python ingestion engine as a Base64 payload. Deploying the template automatically provisions /shared/scripts/stix\_taxii\_importer.py with executable permissions on the BIG-IP without requiring manual file transfers over SSH/SCP.
- **Virtual Server Protection Modes** : Specify existing target Virtual Server(s) or deploy in standalone mode (Data Groups & background polling only).
- **Automated Multi-Source Threat Feed Ingestion** :
  - **OASIS TAXII 2.1** : Connects to discovery roots and collection endpoints with dynamic API root traversal and strict RFC headers.
  - **MISP Threat Feeds** : Direct ingestion of Threat feeds in JSON format, with automated multi-bulletin aggregation via manifest.json.
  - **Local PC File Upload** : Direct support for files uploaded through TMOS GUI ( **System \> File Management \> Data Group File List \> Import** ).
  - **Plain Text / CSV Feeds** : Supports custom blocklists in the plain text / CSV format.
  - Export of threat feeds using secure cli connection or via Data Group Export.

## Deployment Options

### Step 1: Import the iApp Template

1. In the BIG-IP GUI, navigate to&nbsp; **iApps \> Templates \> Templates**.
2. Click&nbsp; **Import…**.
3. Select&nbsp;stix\_taxii\_blocker.iapp.tmpl&nbsp;and click&nbsp; **Upload**.

### Step 2: Instantiate the iApp Service

1. In the BIG-IP GUI, navigate to&nbsp; **iApps \> Application Services \> Applications**.
2. Click&nbsp; **Create…**.
3. Select&nbsp; **stix\_taxii\_blocker** &nbsp;from the Template dropdown.
4. Configure the parameters.
5. Click&nbsp; **Finished**.

| Section | Parameter | Description |
| --- | --- | --- |
| **Virtual Server** | Protection Mode | Choose&nbsp; **Protect an Existing Virtual Server** &nbsp;or&nbsp; **Standalone** |
| | Target Virtual Server | Select the Virtual Server to protect (e.g. /Common/vs\_https) |
| | Inspect XFF | Enable to inspect&nbsp;X-Forwarded-For&nbsp;headers behind CDNs/proxies |
| **Threat Feed** | Source | Choose&nbsp; **TAXII 2.1 Server** ,&nbsp; **Remote Threat Feed URL** , or&nbsp; **Uploaded File / BIG-IP Local File** |
| | TAXII URL | Base URL of TAXII 2.1 discovery or collection endpoint |
| | Collection ID | Optional collection identifier (e.g.&nbsp;malicious-indicators) |
| | Remote Feed URL | URL of MISP JSON, ThreatFox CSV/JSON, or plain text blocklist |
| | Uploaded / Local File | Name of file imported in&nbsp; **System \> File Management** &nbsp;or local file path |
| | Authentication | Select&nbsp; **None** ,&nbsp; **Basic Auth** ,&nbsp; **Bearer Token** , or&nbsp; **API Key** |
| | Polling Schedule | Choose synchronization interval (e.g., Every 5 min, 1 hour, 24 hours) |
| | Outbound Proxy | Optional egress proxy URL (e.g.,&nbsp;[http://proxy.corp:8080](http://proxy.corp:8080)) |
| **Actions** | Action for Malicious IPs | Silently Drop,&nbsp;Send TCP Reset, or&nbsp;Log Only |
| | Action for Malicious URLs | Return Responsive 403 Block Page,&nbsp;Drop,&nbsp;Reset, or&nbsp;Redirect |
| **Whitelists** | IP Whitelist Table | Enter corporate subnets to exempt (e.g.,&nbsp;10.0.0.0/8,&nbsp;192.168.1.0/24) |
| | URL Whitelist Table | Enter internal domains or bypass paths (e.g.,&nbsp;internal.corp,&nbsp;/healthcheck) |

The iApp will automatically:

- Self-deploy the Python ingestion engine to&nbsp;/shared/scripts/stix\_taxii\_importer.py.
- Ingest initial threat intelligence data and populate external Data Groups.
- Generate and bind the optimized L4/L7 enforcement iRule to your Virtual Server.
- Configure scheduled background polling via iCall / cron.

If you want to remove one of the instantiated iApp service:

1. Reconfigure the iApp
2. Move “Attach mode” to Standalone (this will remove the protection from the VS)
3. Click&nbsp; **Finished**.
4. Delete the instantiated iApp

### &nbsp;