TAXII (Trusted Automated eXchange of Indicator Information)
Definition
An OASIS open standard that defines an HTTPS-based protocol for transporting STIX content between organisations. A TAXII server exposes collections; clients poll or subscribe to receive updates.
- Full name (as used here)
- Trusted Automated eXchange of Indicator Information
- Standards body
- OASIS
- Transport
- HTTPS-based protocol
- Mechanism
- Server exposes collections; clients poll or subscribe
Common questions
Why does the expansion of the TAXII acronym vary between sources?+
The official OASIS standard expands TAXII as 'Trusted Automated eXchange of Intelligence Information', but 'Indicator Information' circulates in some training material and vendor documentation because indicators are the most common content TAXII carries. Both forms point to the same protocol, so the expansion in a given document is not a reliable signal of version or scope.
What is the practical benefit of polling versus subscribing to a TAXII collection?+
Polling lets a client request updates on its own schedule, which is simpler to implement, while a subscription pushes new content to the client as it becomes available, reducing latency between an indicator being published and an organisation ingesting it.
Related terms
- IoC (Indicator of Compromise)
- Observable artefact linked to malicious activity. File hashes (MD5, SHA-256, ImpHash, ssdeep, TLSH), IPs, domains, URLs, registry keys, mutex names, named pipes,...
- ISAC (Information Sharing and Analysis Center)
- A sector-specific membership organisation that collects, analyses, and redistributes threat intelligence among its members under confidentiality agreements. Examples include FS-ISAC (financial services),...
- STIX (Structured Threat Information eXpression)
- An OASIS open standard that defines a JSON-based language for describing cyber threat intelligence. STIX 2.1 defines objects for indicators, threat actors,...
- Threat Intelligence
- Processed, analysed information about adversaries, their capabilities, and their current or anticipated activities. Includes strategic intelligence (actor motivations and trends) and tactical...
- Traffic Light Protocol (TLP)
- A standardised colour-coded scheme for marking intelligence sharing restrictions. TLP:RED is for named recipients only; TLP:AMBER is for members' organisations; TLP:GREEN is...