What Are STIX And TAXII?
STIX describes threats, TAXII transports them, enabling automated threat intelligence sharing.
STIX and TAXII address the challenge of sharing cyber threat intelligence across different platforms in a way that machines can understand automatically. Prior to their standardization, organizations relied on disparate formats, making automated sharing inefficient and prone to errors. These standards establish a common language and delivery mechanism, crucial for modern threat intelligence operations and government initiatives like CISA’s Automated Indicator Sharing (AIS).
Essentially, STIX provides the standardized ‘what’ of threat information, and TAXII provides the standardized ‘how’ of its transmission. Together, they enable a more interconnected and responsive cybersecurity ecosystem.
How It Works
STIX functions as the language and TAXII as the delivery service for threat intelligence. STIX (currently version 2.1) models threat intelligence as a graph of interconnected objects. The fundamental components are STIX Domain Objects (SDOs), each representing a specific concept such as an Indicator (detectable patterns like file hashes), Malware, Threat Actor, Attack Pattern (often mapped to MITRE ATT&CK), Campaign, Identity, and Vulnerability. These objects are linked by Relationship objects (SROs) to form the graph, allowing for a comprehensive understanding of threat activities beyond isolated indicators.
TAXII is an application-layer protocol that transmits STIX data over HTTPS. A TAXII server organizes intelligence into collections, from which TAXII clients can publish or retrieve data. It supports a collection model for polling and a channel model for publish-subscribe distribution. Because TAXII is standardized, any compliant client can interface with any compliant server, a principle used by CISA’s AIS for community-wide indicator exchange.
Real-World Example
Here is a simplified STIX 2.1 Indicator object in JSON format, detailing a malicious file with a pattern for detection:
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--a932fcc6-e032-476c-826f-cb970a5a1ade",
"created": "2026-06-30T12:00:00.000Z",
"modified": "2026-06-30T12:00:00.000Z",
"name": "Malicious QakBot loader",
"description": "File hash observed delivering QakBot",
"indicator_types": ["malicious-activity"],
"pattern": "[file:hashes.'SHA-256' = 'f8e3...c1a9']",
"pattern_type": "stix",
"valid_from": "2026-06-30T12:00:00.000Z"
}A complementary Relationship object would then link this Indicator to a Malware object using “relationship_type”: “indicates”. This complete bundle can be published to a TAXII collection, enabling a subscribing Threat Intelligence Platform (TIP) or SIEM to ingest and deploy detections automatically.
Why STIX and TAXII Matter
The primary advantage of STIX and TAXII lies in their interoperability, allowing diverse entities like vulnerability databases, government sharing programs, commercial vendors, and open-source TIPs to exchange intelligence seamlessly without custom translation. STIX captures rich contextual details—including the actor, campaign, and techniques associated with an indicator—moving beyond simple data points. TAXII ensures secure and automated transfer of this information. This robust capability makes STIX/TAXII integration a common feature in most threat intelligence platforms, including MISP and OpenCTI, and is why platforms like SOCRadar utilize these standards for customer integration.
An effective analogy is that STIX is akin to a universally understood shipping label, and TAXII is the established courier network. The label ensures clarity of content, and the network ensures reliable delivery, allowing intelligence to be shared globally and understood upon arrival.
People Also Ask
Is STIX a file format or a language? STIX is a structured language, a data model that defines the objects and relationships used to represent threats, commonly expressed in JSON format.
Can I use STIX without TAXII? Yes, STIX data can be shared via files or other transmission methods. TAXII is specifically designed as a standardized protocol for its transport.
Who maintains STIX and TAXII? Both STIX and TAXII are open standards overseen by OASIS, a non-profit standards body, and have been widely adopted by government and industry sectors.
Sources and Further Reading
STIX Version 2.1 – OASIS Standard
OASIS CTI Documentation – STIX Examples
CISA – Automated Indicator Sharing (AIS)
CISA – AIS TAXII Server Connection Guide
Section 6: Putting Threat Intelligence to Work
- STIX provides a structured, machine-readable language for describing cyber threats.
- TAXII is the transport protocol used to exchange STIX-formatted threat intelligence.
- These standards enable automated, interoperable sharing of threat data between different systems.
- STIX captures rich context, including actors, campaigns, and techniques, not just isolated indicators.
- Key STIX objects include Indicators, Malware, Threat Actors, and Attack Patterns, interconnected by relationships.
