STIX
Definition
Structured Threat Information eXpression. A standardised, machine-readable language for encoding and sharing threat intelligence objects such as indicators, threat actors, campaigns, and malware. Maintained by OASIS and widely supported by commercial and open-source intelligence platforms.
- Full name
- Structured Threat Information eXpression
- Purpose
- Encodes threat intelligence objects (indicators, actors, campaigns, malware)
- Maintained by
- OASIS
Common questions
What problem does STIX solve for threat intelligence sharing that free-text reports do not?+
Free-text threat reports require manual re-keying before an indicator can be loaded into detection tooling, while STIX's structured schema lets platforms parse and ingest indicators, relationships, and context automatically, which is what makes machine-to-machine sharing practical at scale.
Is STIX a transport protocol or a data format?+
STIX is a data format describing what the threat intelligence looks like; moving STIX objects between systems is a separate concern handled by a transport protocol such as TAXII.
Related terms
- Diamond Model
- An analytic framework that structures a cyber intrusion event around four linked elements: adversary, capability, infrastructure, and victim. The model makes explicit...
- Indicator of Compromise (IoC)
- An observable artefact that suggests a system has been involved in a malicious event. Static analysis produces file-based IoCs: cryptographic hashes, embedded...
- MITRE ATT&CK
- A publicly available knowledge base of adversary tactics, techniques, and procedures derived from real-world intrusion observations. Maintained by the MITRE Corporation. Techniques...
- Tactics, Techniques, and Procedures (TTPs)
- A three-level description of adversary behaviour. Tactics are the high-level goals (initial access, persistence, exfiltration). Techniques are the specific methods (spear-phishing, pass-the-hash)....
- TAXII
- Trusted Automated eXchange of Intelligence Information. The transport protocol used to share STIX content between organisations. TAXII defines server and client roles,...