TAXII 2.1 NATIVE • OASIS CTI COMPLIANT

Protocol-Aware Telecom Threat Intelligence Feed

The only European sovereign threat feed delivering structured STIX 2.1 signaling indicators, 5G SEPP mutations, rogue base station telemetry, and CAMARA SIM swap fraud patterns directly into enterprise SIEM & SOAR pipelines.

SIEM CONNECTOR

Splunk Enterprise

Pre-built TelcoSec TA with CIM mapping for SS7/Diameter signaling and 5G HTTP/2 JSON logs.

✓ Splunkbase Certified App

SIEM CONNECTOR

Microsoft Sentinel

Native Data Connector streaming TAXII 2.1 collections directly into Sentinel ThreatIntelligenceIndicator.

✓ Microsoft Graph Security API

SIEM CONNECTOR

IBM QRadar

DSM and custom Universal Cloud REST feed parser for inter-carrier roaming GTP-U anomalies.

✓ QRadar App Exchange Ready

DATA PIPELINE

Elastic & Kafka

High-throughput event streaming via Kafka topics or Logstash HTTP poller with mTLS encryption.

✓ 10,000+ eps Throughput

📡

Live STIX 2.1 Feed Inspector & TAXII Poller

Simulate real-time ingestion from the TelcoSec European Sovereign TAXII server.

TAXII 2.1 ACTIVE

Filter Protocol:

STIX 2.1 BUNDLE OBJECT (OASIS CTI)ID: bundle--f81d4fae-7dec-11d0-a765-00a0c91e6bf6

{
  "type": "bundle",
  "id": "bundle--f81d4fae-7dec-11d0-a765-00a0c91e6bf6",
  "spec_version": "2.1",
  "confidence": 96,
  "threatActor": "APT41 / Barium (Telecom Sub-unit)",
  "targetSector": "5G Core SBA Roaming Hubs (N32)",
  "attackTechnique": "GSMA FS.36 PRD Violation / JWS Signature Stripping",
  "firstObserved": "2026-03-12 04:18 UTC",
  "description": "Malicious IPX mediator attempting to strip JWS JSON Web Signatures on 5G N32-f HTTP/2 roaming messages to alter subscriber AMF slice permissions.",
  "firewallAction": "SEPP-RULE-5G-902: DROP invalid JWS header and trigger CSIRT Article 23 alert.",
  "objects": [
    {
      "type": "indicator",
      "id": "indicator--9b1deb4d-3b7d-4bad-9bdd-2b0d7b3dcb6d",
      "created": "2026-03-12T04:20:00.000Z",
      "name": "5G SEPP Unsigned N32-f JSON Payload Injection",
      "pattern": "[network-traffic:dst_port = 8443 AND network-traffic:protocols[*] = 'http2' AND http-request-ext:method = 'POST' AND http-request-ext:request_header.'3gpp-sbi-message-priority' = '2']",
      "pattern_type": "stix",
      "valid_from": "2026-03-12T04:20:00Z"
    }
  ]
}

Confidence: 96% (Verified)

Threat Dossier Context

Threat Actor:APT41 / Barium (Telecom Sub-unit)

Target Industry:5G Core SBA Roaming Hubs (N32)

Attack Technique:GSMA FS.36 PRD Violation / JWS Signature Stripping

First Observed:2026-03-12 04:18 UTC

Malicious IPX mediator attempting to strip JWS JSON Web Signatures on 5G N32-f HTTP/2 roaming messages to alter subscriber AMF slice permissions.

Recommended Firewall Rule:

SEPP-RULE-5G-902: DROP invalid JWS header and trigger CSIRT Article 23 alert.

Automated TAXII 2.1 Poller Configuration

Copy pre-configured ingestion code for your automated security pipeline.

# Poll TAXII 2.1 collection objects with API Key
curl -X GET \
  "https://taxii.telcosec.eu/v21/collections/telecom-threats/objects/?match[type]=indicator" \
  -H "Accept: application/taxii+json;version=2.1" \
  -H "Authorization: Bearer ${TELCOSEC_CARRIER_API_KEY}" \
  -H "X-Client-Autonomous-System: AS3301"