TAXII and STIX Explained: Threat Intelligence Sharing for CySA+
TAXII — Trusted Automated Exchange of Intelligence Information — is the protocol for moving cyber threat intelligence between organizations automatically. It is almost always mentioned alongside STIX, and the pairing is the thing to get straight first. STIX is the language. TAXII is the delivery mechanism. STIX says what the intelligence means; TAXII moves it from one system to another. A useful analogy: STIX is to TAXII roughly what a letter is to the postal service. You could write a STIX document and email it, and you could use TAXII to move something other than STIX, but they were designed together and are used together. Why Automated Exchange Matters Threat intelligence has a short shelf life. An IP address hosting a command-and-control server today may be clean next week. A malware hash is most useful in the hours after it first appears. Intelligence distributed as a PDF that an analyst reads on Thursday and types into a blocklist on Friday has already lost most of its ...