STIX and TAXII
noun · also STIX, TAXII · OASIS CTI documentation
Two OASIS standards for threat intelligence: STIX describes threats in a structured format, and TAXII defines how that data is shared between systems.
Threat intelligence is only useful at scale if machines can read it. STIX (Structured Threat Information Expression) is a JSON-based language for describing threat information as objects, such as indicators, malware, threat actors, attack patterns and vulnerabilities, and the relationships between them, for example "this indicator indicates this malware, which is used by this group". TAXII (Trusted Automated Exchange of Intelligence Information) is the protocol for publishing and retrieving that data over HTTPS from collections on a server.
Both are open standards maintained by OASIS, with version 2.1 the current release of each. Threat intelligence platforms such as MISP and OpenCTI, and SIEMs such as Microsoft Sentinel, can import STIX data from TAXII servers.
Example
A government CERT publishes indicators for an ongoing campaign on a TAXII server. Your threat intelligence platform polls the collection every hour, imports the new STIX indicators with their context and confidence, and pushes them to the SIEM, where a rule alerts whenever a matching domain or file hash appears in your logs.
Why it matters for a SOC analyst
STIX and TAXII are why indicators from feeds can show up in your SIEM automatically, with context about where they came from. Knowing the format helps you judge an indicator before acting on it: its source, confidence and validity period matter as much as the value itself, since many indicators expire within days.
Related terms
- Threat intelligence
Information about threats and threat actors, collected and analyzed so that an organization can make better security decisions.
- Indicator of compromise
An observable artifact, such as a file hash, IP address, domain or registry key, that suggests a system may have been compromised.
- Tactics, techniques and procedures
How an attacker operates: the goal of each step (tactic), the method used to reach it (technique) and the specific way it is carried out (procedure).
- Advanced persistent threat
A well-resourced, often state-backed group that targets specific organizations and works to stay hidden in their networks for months or years.