STIX and TAXII Explained: Sharing Threat Intel at Speed

The Threat Intelligence Sharing Problem

Every security team relies on intelligence from outside its own walls. Vendor reports, government advisories, ISAC bulletins, commercial feeds and peer groups all carry information that could stop an attack before it lands. The problem is that this intelligence arrives in dozens of formats: PDFs, spreadsheets, emails, blog posts and proprietary feed formats that do not talk to each other.

That forces analysts to copy indicators by hand, reformat data for each tool and make judgement calls about context that was lost along the way. By the time a malicious domain reaches a blocklist, the adversary may already have moved on. Manual sharing is slow, error-prone and impossible to scale.

STIX and TAXII were created to fix this. Together they give the security community a common language for describing threats and a common way of moving that information between organisations and tools. In this post, we explain what STIX and TAXII are, how they work together and how your SOC can use them to turn shared intelligence into faster detection and response.

What Is STIX?

STIX (Structured Threat Information eXpression) is an open, JSON-based language for describing cyber threat intelligence in a consistent, machine-readable way. It was originally developed with sponsorship from the US Department of Homeland Security and is now maintained as an open standard by the OASIS Cyber Threat Intelligence Technical Committee. The current version, STIX 2.1, is the one most platforms support today.

Think of STIX as a shared vocabulary. Instead of one vendor calling something a "threat group" and another calling it an "adversary cluster", STIX defines standard objects with standard properties, so every tool understands exactly what it is looking at.

STIX 2.1 is built from three main building blocks:

• STIX Domain Objects (SDOs) describe the higher-level concepts analysts care about. There are 18 in STIX 2.1, including Threat Actor, Intrusion Set, Campaign, Malware, Tool, Attack Pattern, Indicator, Vulnerability, Infrastructure, Course of Action and Report.
• STIX Cyber-observable Objects (SCOs) capture the technical facts seen on a network or host, such as IP addresses, domain names, URLs, file hashes and email addresses.
• STIX Relationship Objects (SROs) connect everything together. A Relationship links two objects (for example, a threat actor "uses" a piece of malware), while a Sighting records that something was actually observed in the wild.

That relationship model is what makes STIX so powerful. Rather than passing around a flat list of indicators, you can share a connected story: this intrusion set runs this campaign, which uses this malware, which communicates with this infrastructure, which is detected by this indicator. Analysts get context, and machines get structure.

Here is a simplified STIX 2.1 Indicator for a malicious domain:

{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--8e2e2d2b-17d4-4cbf-938f-98ee46b3cd3f",
"created": "2026-09-20T09:00:00.000Z",
"modified": "2026-09-20T09:00:00.000Z",
"name": "Phishing domain used in credential harvesting campaign",
"indicator_types": ["malicious-activity"],
"pattern": "[domain-name:value = 'secure-login-example.com']",
"pattern_type": "stix",
"valid_from": "2026-09-20T09:00:00Z",
"confidence": 80
}

Notice the fields for validity dates and confidence. Those small details matter, because they let receiving tools decide automatically how much to trust an indicator and when to stop acting on it. Objects are usually shared together in a STIX Bundle, a single container that can hold hundreds of related objects.

What Is TAXII?

TAXII (Trusted Automated eXchange of Intelligence Information) is the transport protocol that moves threat intelligence between systems. Where STIX defines what the intelligence says, TAXII defines how it travels. It is also maintained by OASIS, and the current version, TAXII 2.1, is a RESTful API that runs over HTTPS.

A TAXII server is organised into a few simple parts:

• Discovery endpoint: tells a client which API roots the server offers.
• API roots: logical groupings of content, often used to separate different trust groups, customers or feed types.
• Collections: the core of TAXII 2.1. A collection is a logical repository of STIX objects that clients can read from, write to, or both, depending on their permissions.

Collections follow a request and response model. A client asks the server for objects, optionally filtering by type, ID or the time they were added, and the server returns them. This makes incremental polling easy: a SIEM or TIP can ask "give me everything added since my last check" every few minutes. The TAXII design also describes channels, a publish and subscribe model for pushing data to many subscribers, although collections remain what is specified and widely deployed in TAXII 2.1.

Because TAXII uses standard HTTPS with authentication and access control, organisations can share intelligence securely with exactly the partners they choose. The "Trusted" in the name is doing real work.

How STIX and TAXII Work Together

STIX and TAXII are independent standards. You can share STIX over email or file transfer, and TAXII can technically carry other content. In practice, they are designed to work as a pair: STIX packages the intelligence, and TAXII delivers it.

Why 2026 Is a Turning Point

STIX and TAXII intelligence flow · producers to SOC tools

A typical flow looks like this. A producer, such as an intelligence vendor, an ISAC or your own incident response team, describes what it has learned as STIX objects and publishes them to a collection on a TAXII server. Subscribed consumers poll that collection on a schedule. A threat intelligence platform ingests the bundle, scores and enriches it, then pushes relevant indicators on to the SIEM for detection, to SOAR for automated playbooks, and to EDR and firewalls for blocking. When your tools spot a match, that sighting can be shared back as STIX, so the whole community learns what is active right now.

The result is intelligence that moves in minutes rather than days, with its context intact and no analyst copying and pasting along the way.

Why STIX and TAXII Matter for Your SOC

Standards can sound academic, but STIX and TAXII solve very practical problems for security operations teams.

Speed. Automated ingestion means a newly reported phishing domain or command and control server can reach your detection stack within minutes of publication. Against fast-moving threats such as ransomware affiliates exploiting a fresh edge device vulnerability, that time saving can be the difference between a blocked connection and a full incident.

Context, not just indicators. Because STIX links indicators to malware, campaigns, threat actors and MITRE ATT&CK techniques, analysts can triage alerts faster. An alert that says "this IP belongs to infrastructure used by a known ransomware group targeting UK manufacturing" is far more actionable than a bare IP address.

Interoperability. Most modern security platforms can consume STIX over TAXII, including leading TIPs such as MISP and OpenCTI, and many SIEM, SOAR and XDR tools. Standardising on STIX and TAXII reduces vendor lock-in and makes it easier to change or add tools without rebuilding every integration.

Better sharing. Sector ISACs, government bodies and trusted peer groups increasingly share intelligence in STIX format. Supporting the standards lets you take part in these communities and contribute your own sightings, strengthening collective defence.

Less manual effort, fewer errors. Every copy and paste is an opportunity for a typo or a missed field. Automation frees analysts to focus on analysis, hunting and response rather than data wrangling.

Common real-world uses include feeding curated indicators into SIEM correlation rules, enriching alerts with actor and campaign context, triggering SOAR playbooks that block malicious infrastructure automatically, sharing incident findings with partners and supply chain members, and exchanging intelligence between a managed security provider and its customers.

Common Challenges and How to Get Started

STIX and TAXII remove much of the friction from intelligence sharing, but they do not remove the need for good judgement. The most common pitfalls we see are:

• Volume without value. Subscribing to every free TAXII feed is easy. Filtering millions of low-confidence indicators is not. Unfiltered feeds pushed straight into alerting quickly create false positives and alert fatigue.
• Inconsistent quality. Not every producer populates confidence, validity dates or relationships. Poorly formed STIX still needs scoring and enrichment before it can be trusted.
• Stale indicators. IP addresses and domains change hands. Without expiry and decay rules, yesterday's malicious IP becomes tomorrow's false positive.
• Version mismatches. Older tools may only support STIX 1.x or TAXII 1.x, which use XML rather than JSON. Check what your stack supports before you commit.
• Sharing hesitancy. Consuming is easy, but many organisations are nervous about sharing. Clear handling rules, such as the Traffic Light Protocol, and a trusted platform help build confidence.

If you are ready to put STIX and TAXII to work, a practical starting path looks like this:

1. Define your intelligence requirements. Decide which threats matter most to your organisation so you can choose feeds that answer real questions.
2. Audit your tooling. Confirm which of your SIEM, SOAR, EDR and firewall platforms can consume STIX 2.1 over TAXII 2.1.
3. Deploy a threat intelligence platform. A TIP acts as the hub: it pulls from TAXII collections, deduplicates, scores and enriches, then pushes curated intelligence to your security tools.
4. Start with a few high-quality sources. Your sector ISAC, government advisories and one trusted commercial feed will deliver more value than dozens of noisy ones.
5. Set scoring and expiry rules. Route high-confidence indicators to blocking and alerting, and lower-confidence data to enrichment and retrospective hunting.
6. Measure and share. Track how many detections and blocks come from shared intelligence, and start contributing your own sightings back to trusted partners.
   

Turning Shared Intelligence Into Cyber Threat Intelligence With Cybergen

STIX and TAXII solve the plumbing problem. They move threat data quickly and in a consistent format. But a feed on its own is not intelligence. Intelligence comes from understanding which threats matter to your organisation, what they mean for your risk and what you should do about them. That is where a mature Cyber Threat Intelligence (CTI) capability makes the difference.

Cybergen's Cyber Threat Intelligence services combine STIX/TAXII automation with analyst-led expertise, so you get both speed and context:

• Threat Intelligence Feeds: curated indicators of compromise delivered in STIX/TAXII, JSON or CSV, filtered for relevance rather than volume.
• Threat Intelligence Platform Build and Integration: a TIP deployed and connected to your SIEM and SOAR tools, so STIX intelligence flows straight into detection and response.
• Threat Intelligence Investigation: analyst-led deep dives into the actors and campaigns behind the indicators, mapped to MITRE ATT&CK.
• Threat Actor and Campaign Profiling: clear profiles of the nation-state groups and cybercriminal syndicates most likely to target your sector.
• Vulnerability Intelligence and Prioritisation: CVE intelligence overlaid with real-world exploit data, so you patch what attackers are actually using first.
• Dark and Deep Web Monitoring: surveillance of criminal forums and marketplaces for leaked credentials, data and early warnings of attacks.
• Brand and Digital Risk Monitoring: detection of spoofed domains, typosquats and impersonation targeting your organisation.
• Managed Attribution and Adversary Tracking: OSINT-based attribution with clear confidence scoring.
• Strategic CTI Reporting and Executive Briefings: board-level threat landscape reporting that links intelligence to business risk.
• Incident Response Intelligence Support: CTI analysts embedded alongside your responders during a breach.
  

Summary

Whether you are consuming your first TAXII feed or looking to get more value from an existing intelligence program, Cybergen can help you build CTI that is smarter, faster and more actionable.

Ready to put your threat intelligence to work? Discuss your CTI requirements with Cybergen today.

Ready to strengthen your security posture? Contact us today for more information on protecting your business.