# TAXII 2.1 and Intelligence Exchange Concepts

> Understand sharing models and operate TAXII 2.1 discovery, collections, paging and submissions correctly.

Canonical: https://codelivly.com/rooms/cti-taxii-2-1-exchange
Last updated: 2026-10-28

| | |
|---|---|
| Level | Intermediate |
| Category | Cybersecurity |
| Lessons | 5 |
| XP | 100 |

**Purpose.** Teach analysts how structured intelligence actually moves between organisations, using the OASIS TAXII 2.1 protocol as the reference, so they can specify, review and troubleshoot feed integrations.

**Prerequisites.** Module 1 of this path (STIX 2.1). Basic familiarity with HTTP requests, status codes and headers.

**Outcomes.** By the end of the module you can:
- choose a sharing topology and push or pull model for a community and justify it
- walk the TAXII 2.1 resource hierarchy from discovery to collections and interpret permissions
- construct filtered, paginated requests and identify the correct watermark
- interpret add-object submissions and status resources, including partial failures
- specify validation, marking and revocation gates for a production client

**Practical completion objective.** In the lab, walk a simulated eight-exchange TAXII 2.1 session, extract the values a client must act on, and submit a client runbook.

## Lessons

1. Sharing Models: Push, Pull and Where TAXII Fits (15 min)
2. TAXII 2.1 Discovery, API Roots and Collections (15 min)
3. Objects, Manifests, Filtering and Pagination (15 min)
4. Operating a TAXII Feed Safely (15 min)
5. Lab: Walk Through a Simulated TAXII 2.1 Exchange (45 min)

## Related

- [Learning path: Threat Intelligence Operations and Sharing](https://codelivly.com/learning-paths/cti-operations-and-sharing)
- [All rooms](https://codelivly.com/rooms)