What is STIX/TAXII ?

Trevor Chandler

Well-known member
Jul 4, 2020
492
434
21,156
STIX/TAXII is a joint global initiative to drive threat intelligence sharing and collaboration among authorities.

STIX and TAXII allow transportation of threat information among IT security and intelligence technologies.

STIX (Structured Threat Information eXpression) and TAXII (Trusted Automated eXchange of Indicator Information) are pioneering standards developed under the Cyber Threat Intelligence Technical Committee, aiming to foster collaboration, standardization, and automation within the field of CTI (Cyber Threat Intelligence).



STIX provides a common syntax so users can describe threats consistently by their motivations, abilities, capabilities, and responses.

Structured Threat Information Expression (STIX) is a language and serialization format used to exchange cyber threat intelligence (CTI).

STIX is open source and free, allowing those interested to contribute and ask questions freely.

STIX is for anyone involved in defending networks or systems against cyber threats, including cyber defenders, cyber threat analysts, malware analysts, security tool vendors, security researchers, threat sharing communities, and more.

STIX is a standardized language that allows for the detailed representation and contextualization of cyber threat information. By providing a structured format, STIX ensures a unified way of describing diverse cyber threat information, thereby facilitating more effective communication, analysis, and application of this information.



Trusted Automated eXchange of Intelligence Information (TAXII) is the format through which threat intelligence data is transmitted.

TAXII is a communication protocol that supports the exchange of cyber threat information, including STIX data, in a secure and automated manner. It outlines how to transport these data, regardless of the method or mechanism, ensuring the safe, reliable, and efficient exchange of information.




Bonus Coverage:

What are the types of Threat Intelligence?
Cyber Threat Intelligence is mainly categorized as strategic, tactical, technical, and operational.




Is either of these - STIX or TAXII - covered in any of the CompTIA courses?????
 
Here is a funny but true story. When TAXII was being developed, everyone still used HTTP for transport. A bunch of folks got together and started working out how to create a secure data transport protocol for XML over HTTP. When they were finished and people started looking at their final product, much of what they developed went into HTTPS. Today, HTTPS is often used to transport STIX.
 
  • Love
Reactions: Trevor Chandler
Here is a funny but true story. When TAXII was being developed, everyone still used HTTP for transport. A bunch of folks got together and started working out how to create a secure data transport protocol for XML over HTTP. When they were finished and people started looking at their final product, much of what they developed went into HTTPS. Today, HTTPS is often used to transport STIX.
I love the story Mr. Biran Ford!!!