STIX & TAXII
The standards for sharing threat intelligence between organisations and tools
The Problem of Sharing
Threat intelligence creates value when it can be exchanged quickly and interpreted consistently. Sharing requires both a common language for content and a common transport method for delivery. Without standards, organisations struggle to automate ingestion, correlation, and action.
Before structured standards became common, sharing was frequently ad hoc: PDF reports, email attachments, CSV files, and vendor-specific formats. Those methods are difficult to parse at scale, hard to validate, and often too slow for operational response.
What is STIX?
STIX stands for Structured Threat Information Expression. It is an open standard from OASIS for representing cyber threat intelligence as structured, machine-readable data. Introductory documentation is available at https://oasis-open.github.io/cti-documentation/stix/intro.html.
STIX 2.1 defines 18 domain objects and explicit relationships, allowing analysts and systems to describe actors, malware, indicators, campaigns, vulnerabilities, and observed behaviours in a consistent model. This structure supports automation, cross-platform sharing, and better analytic traceability.
STIX Objects
Key STIX domain objects include Indicator for detection patterns, Observed Data for factual sightings, Threat Actor for adversary entities, Attack Pattern for behavioural methods, Malware for malicious software families, Campaign for coordinated activity, Vulnerability for known weaknesses such as CVEs, and Report for narrative analysis outputs.
Relationship objects connect these entities into usable intelligence graphs. For example, an Indicator may indicate Malware, a Threat Actor may use an Attack Pattern, and a Campaign may target a sector. These links are essential for automation and contextual analysis.
What is TAXII?
TAXII stands for Trusted Automated eXchange of Intelligence Information. It is the transport protocol used to exchange STIX content between producers and consumers. Introductory documentation is available at https://oasis-open.github.io/cti-documentation/taxii/intro.html.
TAXII supports two sharing models: Collection and Channel. Collection is pull-based, where clients request objects from server-hosted collections, similar to a REST API workflow. Channel is push-oriented, where publishers deliver updates to subscribers. TAXII 2.1 uses HTTPS and JSON for interoperable exchange.
How STIX/TAXII Work Together
STIX and TAXII are complementary. STIX defines the data model and object semantics. TAXII defines the transport layer and API interaction model. In common deployments, a TAXII server hosts collections of STIX objects, and clients poll for updates or subscribe for delivery.
A useful analogy is language and postal service. STIX is the language that ensures both sides interpret the same concepts. TAXII is the delivery mechanism that moves those messages reliably between systems. Together they enable automation across intelligence teams, SIEM, SOAR, and case management workflows.
Real-World Usage
Real-world ecosystems already use these standards. AlienVault Open Threat Exchange (OTX) supports structured intelligence sharing, and MISP supports STIX export for interoperability. Government and national security organisations, including ASD and ACSC channels, use STIX-style sharing for indicators and contextual reporting.
Commercial platforms such as Recorded Future and ThreatConnect import and export STIX data, and many security information and event management (SIEM) and security orchestration, automation, and response (SOAR) platforms can ingest STIX-based feeds. This broad tooling support makes standards-based sharing practical for both small and large teams.
Limitations
STIX 2.1 can be verbose, and large JSON bundles may be operationally heavy for constrained pipelines. Adoption is also uneven. Many organisations still exchange CSV files, PDFs, or vendor-proprietary data structures. As a result, interoperability often remains partial in mixed environments.
Data quality is another constraint. A standards-compliant feed is not automatically accurate or useful. Confidence scoring, analyst validation, and source evaluation are still essential. In practical terms, garbage in still produces garbage out, even when the schema is correct.
Continue Learning
- Threat Intelligence Overview — Revisit intelligence sources, actor models, and action workflows.
- MITRE ATT&CK — Learn how attack behaviours map to a common framework.
- Explore threat feeds → threat10.link42.app — See standards-aligned threat data in threat10.