Effective cybersecurity defense increasingly depends on the ability to share threat intelligence rapidly and at scale. The Structured Threat Information Expression (STIX) and Trusted Automated Exchange of Intelligence Information (TAXII) standards have become the foundation for automated threat intelligence sharing across the global cybersecurity community.
From Ad Hoc Sharing to Structured Standards
Before STIX and TAXII, threat intelligence sharing relied largely on unstructured formats such as PDF reports, email alerts, and spreadsheets of indicators. While valuable, these formats required significant manual effort to process and integrate into defensive tools. Analysts spent hours parsing reports and manually entering indicators into security platforms, creating delays that attackers could exploit.
STIX was developed under the leadership of OASIS, an international standards body, to provide a structured language for describing cyber threat information. The standard defines a rich data model that can represent not just simple indicators of compromise but also threat actors, campaigns, attack patterns, vulnerabilities, courses of action, and the relationships between these objects.
STIX 2.1: A Mature Standard
The current version, STIX 2.1, represents a significant maturation of the standard. It uses JSON serialization for ease of implementation, supports granular data marking for handling sensitive intelligence, and includes a comprehensive set of object types that map well to real-world threat intelligence workflows. The standard also defines relationship objects that enable analysts to build rich knowledge graphs connecting threat actors to their tools, techniques, and targets.
TAXII: The Transport Layer
While STIX defines the language for expressing threat intelligence, TAXII provides the transport protocol for exchanging it. TAXII 2.1 operates over HTTPS and supports two primary sharing models. The collection model allows clients to request intelligence from a server, enabling organizations to pull relevant intelligence on their own schedule. The channel model supports push-based distribution, where new intelligence is delivered to subscribers as it becomes available.
This flexibility allows organizations to participate in threat sharing at whatever level suits their operational needs. Large enterprises with dedicated threat intelligence teams can subscribe to multiple TAXII feeds and correlate incoming intelligence with internal telemetry. Smaller organizations can consume curated feeds that provide pre-analyzed, actionable intelligence without requiring extensive analytical resources.
Adoption Across the Ecosystem
Major security platforms now support STIX and TAXII natively. Threat intelligence platforms from vendors including Anomali, ThreatConnect, and MISP can both consume and produce STIX-formatted intelligence. Security information and event management systems from Splunk, IBM QRadar, and Microsoft Sentinel integrate TAXII feeds directly into their detection pipelines, enabling automated correlation of external threat intelligence with internal security events.
Government agencies have also embraced these standards. The US Department of Homeland Security operates the Automated Indicator Sharing program using STIX and TAXII, enabling bidirectional threat intelligence sharing between federal agencies and private sector organizations. Similar government-sponsored sharing programs operate in the United Kingdom, Australia, and across the European Union.
The Road Ahead
Ongoing development efforts focus on improving the standards’ ability to represent emerging threat categories, including cloud-native attacks, supply chain compromises, and threats to operational technology environments. As the cybersecurity community continues to mature its approach to collective defense, STIX and TAXII provide the essential technical foundation that makes large-scale automated intelligence sharing possible.
