STIX Objects Explained: SDOs, SROs and Observables for CySA+

STIX — Structured Threat Information eXpression — is the language threat intelligence is written in. This article covers its object model in detail. For how STIX documents actually move between organizations, see TAXII and STIX Explained, which covers the transport side.

A blocklist says an IP address is bad. STIX says which intrusion set uses it, in what campaign, against which sector, employing which technique, and what to do about it.

That relationship modelling is the entire reason STIX exists and the reason it is more than a file format.

The Object Model

STIX 2.1 is JSON-based and defines three categories of object.

STIX Domain Objects (SDOs) — the nouns. Eighteen types in 2.1, and the ones worth knowing:

• Indicator — a detection pattern. Note that in STIX an indicator carries a pattern expression and a validity window, not just a bare value.
• Malware — a family or instance, with its capabilities.
• Threat Actor — the individual or group, with sophistication and motivation.
• Intrusion Set — a persistent grouping of behaviour attributed to one actor over time.
• Campaign — a specific set of activity against particular targets in a time window.
• Attack Pattern — the technique used, and this is where STIX maps onto MITRE ATT&CK.
• Tool, Vulnerability, Infrastructure, Identity, Location, Course of Action, Report, Grouping, Malware Analysis, Note, Opinion, Observed Data.

STIX Relationship Objects (SROs) — the verbs. Two types:

• Relationship — connects two SDOs with a named verb: indicates, uses, targets, attributed-to, mitigates, variant-of.
• Sighting — records that something was actually seen, by whom, when, and how many times. Distinct from a Relationship because a sighting is evidence rather than assertion.

STIX Cyber-observable Objects (SCOs) — the raw facts. An IPv4 address, a file with its hashes, a domain name, a URL, a process, a network traffic record. SCOs describe what was observed with no interpretation attached; an Indicator is what adds the claim that observing it means something.

That last distinction is a genuine source of confusion and worth holding onto: an SCO is a fact, an Indicator is an assertion about a fact.

Why the Graph Matters

Because objects reference each other by ID, a STIX bundle forms a graph. An analyst receiving one can answer questions a flat feed cannot:

• This domain is indicated by an Indicator, which is used by a Malware object, which is used by an Intrusion Set that targets the financial sector.
• That Intrusion Set uses three Attack Patterns, two of which we have no detection for.
• A Course of Action mitigates one of them.

The practical value is prioritization. Intelligence about an actor that targets your sector, using techniques you cannot currently detect, is worth acting on. The same indicator with no context is just another line in a blocklist.

Confidence, Marking and Versioning

Three features that matter operationally and separate STIX from simpler formats.

Confidence is expressed numerically from 0 to 100, with defined mappings onto scales such as Admiralty ratings. Not all intelligence is equally reliable, and the format says so explicitly.

Data markings carry handling restrictions, including TLP — the Traffic Light Protocol — so a bundle states how far its contents may be shared. This is what makes intelligence sharing between organizations workable.

Versioning and revocation. Every object has an ID and a modified timestamp, so intelligence can be updated or withdrawn. An indicator later found to be a false positive can be revoked rather than living forever in everyone's blocklist — a real problem with simpler feeds.

CySA+ (CS0-004) Exam Tips

• STIX is the format; TAXII is the transport. Know both expansions, and that OASIS maintains them at version 2.1.
• STIX is JSON-based and describes objects and their relationships.
• Know the main SDOs — indicator, malware, threat actor, intrusion set, campaign, attack pattern, course of action.
• Relationships and sightings are separate object types.
• Attack Pattern objects map to MITRE ATT&CK.
• Confidence scoring and TLP markings are built into the format.
• Evaluate intelligence on timeliness, relevancy and accuracy.

Key Takeaways

• STIX is a JSON language for expressing threat intelligence, not a transport protocol.
• Three object categories: domain objects (nouns), relationship objects (verbs), and cyber-observables (raw facts).
• An observable is a fact; an indicator is an assertion about it.
• The relationship graph is what makes it more useful than a blocklist.
• Confidence, TLP markings and revocation are built in.
• Attack patterns align with MITRE ATT&CK.