STIX/TAXII
STIX and TAXII are independent standards. STIX does not rely on a specific transport method and TAXII can be used to transport non-STIX information and data.
STIX
STIX (Structured Threat Information Expression)
- structured data format for threat intelligence
- meant for machine to machine connections.
- enables the exchange of cyber threat information between systems. STIX provides a common syntax so users can describe threats consistently by their motivations, abilities, capabilities and responses and then translate to different systems (e.g., MISP).
TAXII
TAXII (Trusted Automated Exchange of Intelligence Information)
- protocol for sharing/transporting data via collections
Collection
There’s no fixed rule for group of collections, but they could by:
- Source
- Threat type
- Classifcation
- Industry
Question
What’s the point of having collections?
Answer
They let you organize STIX data logically so consumers can subscribe to only what they need, rather than pulling everything.