Cabby, an open-source Python library and command-line tool from EclecticIQ, provides developers with simple support for interacting with TAXII Services (1.0/1.1) either from their own code or on the command line.

Cabby makes it easy for you to include TAXII client capabilities into your own Python code, or to execute ad-hoc queries from the command line.

Interaction with TAXII Services cover the complete specifications for TAXII 1.x, including inbox, poll, discovery and collection management.

TAXII (Trusted Automated eXchange of Indicator Information) is a collection of specifications defining a set of services and message exchanges used for sharing cyber threat intelligence information between parties. Check the Cabby page on GitHub to get more information.

Key Features


TAXII services

Cabby supports all TAXII Services, including push and pull messaging, discovery, query tools and collection management.

Python library

Use Cabby in your code to authenticate and create a TAXII client, discover advertised services, poll content from a collection, fetch collections and push content into an Inbox using TAXII 1.0 or 1.1 specifications.

Command-line tool

Execute all the functions of a TAXII client from the command line, either for ad-hoc queries or for automated scripting.

Docker image

Try out Cabby using a ready-to-use Docker image provided by EclecticIQ.

Technical Overview

The fully-documented API covers the TAXII v1.0 and v1.1 specifications for interacting with TAXII servers.

Services include discovery, inbox, polling, collection and subscription management.

View on GitHub


From the developers of open-source projects OpenTAXII and Cabby, EclecticIQ Platform is a full-featured Threat Intelligence Platform (TIP) that delivers analyst-centric technology to consolidate, analyze, manage, action, and disseminate intelligence and reports.