Threat intelligence and analysis
STIX/TAXII
STIX and TAXII are open standards from OASIS for sharing cyber threat intelligence: STIX defines how threat information is represented, and TAXII defines how it is transported between systems.
STIX
Structured Threat Information Expression is a JSON format for describing threats as related objects: indicators, malware, attack patterns, threat actors, campaigns, infrastructure, and the relationships between them. An indicator in STIX carries a pattern to match, a validity period and links to what it indicates, so a receiving system gets context rather than a bare value.
TAXII
Trusted Automated Exchange of Intelligence Information is an HTTPS-based protocol for publishing and retrieving STIX content. A TAXII server exposes collections; clients poll them or push to them. It handles the plumbing, such as authentication, paging and filtering by time, so that producers and consumers do not each write their own.
Why they matter in practice
Most sharing between organisations, sector groups and vendors happens in STIX over TAXII, and most security platforms can consume it. For a brand-protection team, this is the format in which findings, such as a cluster of phishing hostnames with their infrastructure, can be handed to a customer's security team or a sharing group without a bespoke integration.
Related terms
Sources
- OASIS STIX 2.1 specification
- OASIS TAXII 2.1 specification
- NIST SP 800-150: Guide to Cyber Threat Information Sharing
External guidance is general. Adapt it to your legal, regulatory and operational requirements.