STIX / TAXII
Definition
Structured Threat Information eXpression (STIX) is a standardised language for describing threat intelligence objects. Trusted Automated eXchange of Intelligence Information (TAXII) is the transport protocol used to share STIX data between platforms, including from a TIP to a SIEM.
- STIX role
- Language for describing threat intelligence objects
- TAXII role
- Transport protocol for exchanging STIX data
- Typical flow
- From a Threat Intelligence Platform (TIP) to a SIEM
Common questions
Why are STIX and TAXII usually mentioned together rather than as separate technologies?+
STIX defines the content of a threat intelligence object while TAXII defines how that content moves between systems, so in practice a platform needs both working together, one to structure the data and the other to deliver it, for automated sharing to function.
Can an organisation use STIX without TAXII?+
Yes, STIX-formatted files can be exchanged manually or through another transport such as email or a file share, but doing so loses the standardised, automated feed capability that pairing STIX with TAXII is designed to provide.
Related terms
- EDR (Endpoint Detection and Response)
- An agent-based security tool deployed on individual endpoints (workstations, servers, mobile devices) that monitors process execution, file changes, network connections, and registry...
- MTTD / MTTR
- Mean Time to Detect and Mean Time to Respond: the two primary operational KPIs for a SOC. MTTD measures the gap between...
- SIEM (Security Information and Event Management)
- A platform that aggregates log and event data from systems, networks, and applications across an environment, correlates events against detection rules, generates...
- SOAR (Security Orchestration, Automation, and Response)
- A platform that receives alerts from the SIEM and other sources, executes automated playbooks to enrich and triage them, and integrates with...
- Threat Intelligence Platform (TIP)
- A system that ingests indicator feeds from external providers and internal sources, deduplicates and scores them, and exports curated indicators of compromise...