Payload Schema - FalconFeeds

STIX Bundle

Data is delivered to your TAXII 2.1 server as a STIX 2.1 bundle. Each new FalconFeeds post is converted into a bundle of related objects with the following structure.

{
  "type": "bundle",
  "id": "string",
  "objects": [
    {
      "type": "threat-actor",
      "spec_version": "string",
      "id": "string",
      "created":  "string",
      "modified": "string",
      "name": "string",
      "description": "string",
      "external_references": [
        { "source_name": "string", "external_id": "string" }
      ]
    },
    {
      "type": "identity",
      "spec_version": "string",
      "id": "string",
      "created":  "string",
      "modified": "string",
      "name": "string",
      "identity_class": "string",
      "sectors": ["string"],
      "contact_information": "string"
    },
    {
      "type": "relationship",
      "spec_version": "string",
      "id": "string",
      "created":  "string",
      "modified": "string",
      "relationship_type": "string",
      "description": "string",
      "source_ref": "string",
      "target_ref": "string"
    },
    {
      "type": "report",
      "spec_version": "string",
      "id": "string",
      "created":  "string",
      "modified": "string",
      "name": "string",
      "description": "string",
      "labels": ["string"],
      "published": "string",
      "object_refs": ["string"],
      "external_references": [
        { "source_name": "string", "external_id": "string", "url": "string" }
      ]
    }
  ]
}

Sample Feed

Each FalconFeeds post that triggers a STIX bundle looks similar to the following.

{
  "uuid": "8d5a1b3e-9a8c-4b6a-93f1-2e6c0f7b9b21",
  "title": "threat-actor leaks organization data",
  "content": "Threat actor has leaked customer data of organization (organization.com).",
  "category": "Data Leak",
  "threatActors": [
    {
      "uuid": "TA-056AF99E9MCE7BD7",
      "name": "threat-actor",
      "description": "Threat actor known for targeting e-commerce platforms."
    }
  ],
  "victims": [
    { "type": "Organization", "values": ["organization"] },
    { "type": "Site",         "values": ["organization.com"] },
    { "type": "Industry",     "values": ["E-commerce & Online Stores"] }
  ],
  "tags": ["data-leak", "e-commerce"],
  "discoveredAt": "2026-05-10T08:32:11Z",
  "publishedAt":  "2026-05-10T09:00:00Z",
  "meta": {
    "publishedURL": "https://example.tld/posts/threat-actor-organization"
  }
}

Field Mapping

Source field	STIX object	STIX field	Notes
All objects	`bundle`	`objects[]`	Each SDO is included in a single `bundle` keyed by `id` (`bundle--<uuid>`), and `report.object_refs` lists the IDs of the other SDOs.
`threatActors[].name`	`threat-actor`	`name`	Direct copy.
`threatActors[].description`	`threat-actor`	`description`	Direct copy.
`threatActors[].uuid`	`threat-actor`	`external_references[].external_id`	FalconFeeds threat-actor UUID preserved with `source_name: "FalconFeeds"`.
`victims[]` where `type = "Organization"`	`identity`	`name`	First organization value becomes the identity name; `identity_class` is set to `"organization"`.
`victims[]` where `type = "Industry"`	`identity`	`sectors`	Industry values mapped to STIX sector strings.
`victims[]` where `type = "Site"`	`identity`	`contact_information`	Site value emitted as `"domain: <value>"`.
Actor → victim link (implicit from `category`, `content`, `tags`)	`relationship`	`relationship_type`, `source_ref`, `target_ref`, `description`	`relationship_type` is `"targets"`; refs hold the `threat-actor` and `identity` IDs; `description` is a human-readable summary.
`title`	`report`	`name`	Direct copy.
`content`	`report`	`description`	Direct copy.
`tags`	`report`	`labels`	Direct copy.
`publishedAt`	`report`	`published`	Used in UTC.
`discoveredAt` / `publishedAt`	all SDOs	`created`, `modified`	All objects in a bundle share these timestamps.
`uuid`	`report`	`external_references[].external_id`	FalconFeeds post UUID preserved with `source_name: "FalconFeeds"`.
`meta.publishedURL`	`report`	`external_references[].url`	Source URL preserved with `source_name: "source"`.

All objects in a bundle share the same created/modified timestamp derived from discoveredAt/publishedAt, so consumers can treat the actor, victim, and their relationship as a single incident.